EU Top Court Rules Banks Must Promptly Refund Phishing Losses Even When They Claim Customer Negligence

The European Union's highest court has issued a ruling with real consequences for victims of phishing scams. In a judgment delivered on October 15, 2026, the Court of Justice of the European Union ruled that a bank must refund an unauthorized payment right away, even when it believes the customer was grossly negligent in letting the fraud happen.

The bank can still try to get the money back from the customer later. But under the ruling, it has to refund first and prove its case afterward, according to the court's official press release in Case C-70/25.

The Case Behind the Ruling

The dispute began in Poland. According to the court's summary, a bank customer was selling an item on an online sales platform when a supposed buyer sent her a link that appeared to come from the platform and claimed to confirm the sale.

The link led to a fake website made to look like her bank's site. She entered her online banking login details there, and the fraudster used them to transfer a sum equal to about 700 euros out of her account.

She reported the fraudulent transaction to her bank the next day. The bank refused to refund it, arguing that she had been grossly negligent by failing to keep her security credentials safe. She sued in a Polish court, which asked the Court of Justice how EU law on payment services, Directive 2015/2366, should be read.

What the Court Decided

The Court of Justice answered that the bank must refund the money immediately. Under EU law, when a payment is unauthorized, the payment service provider has to refund it no later than the end of the business day after it notices or is told about the transaction, as long as the customer reported it without undue delay.

The court said there is only one exception to that rule. A provider can hold off if it has reasonable grounds to suspect that the customer committed fraud and it reports those grounds to the relevant national authority.

A bank's view that the customer was grossly negligent, for example by handing over login details on a fake website, is not enough to refuse the immediate refund, the court held.

Refund First, Argue Later

The key idea in the ruling is that two questions are kept separate. The first is whether the money must be returned to the account now. The second is who should ultimately carry the loss.

On the second question, the bank keeps its options open. The court said the provider may later seek reimbursement from the customer if it can show the losses resulted from the customer's intentional or grossly negligent failure to meet their obligations, including the duty to protect personal security credentials. The burden of proving that gross negligence falls on the bank, not the customer.

The court explained that this approach protects consumers. If banks could refuse refunds from the start by claiming negligence, the immediate refund rule would mean very little, and customers would have to take legal action themselves, with all the cost and inconvenience that brings.

What the Ruling Does Not Decide

The judgment does not settle whether this particular customer was negligent, or who will finally bear the 700 euro loss. As with all preliminary rulings, the Court of Justice interprets EU law and sends the case back. It is now up to the Polish court to resolve the dispute in line with the ruling, which is also binding on other national courts facing the same issue.

The case name, Tukowiecka, is also not the customer's real name. The court notes that it is a fictitious name that does not correspond to the real name of any party.

Why It Matters Beyond Poland

Fake links that imitate an online marketplace or a bank, like the one in this case, are a common phishing tactic. The ruling gives customers in every EU country a clear point to rely on: report an unauthorized payment quickly, and the bank's first step should be a refund rather than a refusal.

For banks, the message is that a negligence argument is something to prove after the money has been returned, not a reason to keep it. For readers in the United States, the ruling does not apply. Unauthorized electronic transfers there fall under separate federal rules, the Electronic Fund Transfer Act and its Regulation E.

The Bottom Line

The Court of Justice drew a simple line: refund first, then argue about fault. Anyone who spots an unauthorized payment should report it to their bank right away, keep a record of when they did, and know that in the EU, a bank's claim of carelessness does not by itself justify holding back a refund.