Banks must promptly refund unauthorized payments, even if they believe a customer’s gross negligence allowed the fraud to happen. The Court of Justice of the European Union ruled on Thursday that banks cannot use that allegation to withhold the initial refund. They must return the money first, then seek to recover it if they can prove the customer was responsible under the applicable rules.
The ruling does not give customers blanket protection against phishing losses. After issuing a refund, a bank can seek reimbursement if it proves the loss resulted from the customer’s intentional or grossly negligent breach of their obligations. The payment service provider bears the burden of proof.
The refund deadline is tight. As a general rule, the bank must return the money immediately, and no later than the end of the business day following detection or notification of the unauthorized transaction, provided the customer notified it without undue delay.
The court identified only one exception to the immediate-refund requirement: the provider must have reasonable grounds to suspect that the customer themselves committed fraud and must inform the relevant national authority. Suspecting that a customer carelessly handed over their credentials is not the same as suspecting that they committed fraud.
The case began with a phishing scam in Poland. A woman had listed an item for sale on an online trading platform when someone posing as a buyer sent her a fake link, supposedly to confirm the sale. The link led to a website imitating her bank’s site, where she entered her online banking login details. The scammer used those credentials to transfer the equivalent of approximately €700 from her account to their own.
She reported the unauthorized transaction to her bank the next day. The bank refused to refund the money, arguing that she had been grossly negligent by failing to adequately protect her personal security credentials. That was the bank’s allegation, not an established finding that the customer was liable.
The Polish court handling her case asked the EU court whether the bank still had to reimburse her immediately when it considered her conduct grossly negligent.
In its answer, the EU court said this interpretation supports a high level of consumer protection. Allowing banks to refuse refunds from the outset based on alleged gross negligence would make the immediate-refund requirement ineffective. Customers would instead have to enforce their rights through costly, time-consuming court proceedings.
The legal dispute over who ultimately bears the loss can therefore continue after the money is returned. To recover the refund, a bank must prove that the customer’s intentional or grossly negligent breach caused the loss. It cannot make the customer wait for their money while that allegation is contested.
