All it took was a fake link and a moment’s inattention. Suddenly, €700 had vanished from a bank account. When the victim asked her bank for a refund, it refused, arguing that she had only herself to blame. The EU’s top court has now clarified that even if a customer has been grossly negligent, the bank must give the money back — and only then work out who should bear the loss.
The ruling offers important protection to people who fall victim to phishing or other scams that result in unauthorised payments.
“The fact that the payment service provider takes the view that the customer has made the unauthorised transaction possible through gross negligence—in particular by failing to take the necessary measures to protect his or her personalised security credentials—does not entitle the payment service provider to refuse to refund immediately,” the court said.
That does not mean customers can never be held responsible for their own mistakes. If the bank proves that a customer’s own carelessness contributed to the loss, it can seek compensation afterwards.
A Polish victim of phishing
The case began with what looked like an ordinary online sale. A woman in Poland was selling an item on an online marketplace when a prospective buyer contacted her. He sent her a link supposedly needed to confirm the sale.
But the link led to a fraudulent website spoofing her bank’s online banking service. She entered her login details, which the scammer then used to transfer the equivalent of around €700 into his own account.
The fact that the payment service provider takes the view that the customer has made the unauthorised transaction possible through gross negligence does not entitle the payment service provider to refuse to refund immediately. — Court of Justice of the EU
The woman reported the transaction to her bank the very next day. The bank still refused to return the money. It argued that her gross negligence had allowed the scammer to access her account because she had failed to protect her security credentials adequately.
The dispute eventually reached the Court of Justice of the EU after a Polish court asked it to clarify the rules. Under the EU’s Payment Services Directive (PSD2), banks must refund unauthorised payments. The EU court now confirmed that this obligation still applies even when a bank believes the customer enabled the fraud by failing to take basic safety measures.
One narrow exception
Payment service providers must refund unauthorised transactions without delay. At the latest, by the end of the working day following the day on which they recorded the transaction or learned about it, provided the customer also reported it without undue delay.
A bank cannot sidestep this obligation simply by putting the blame on the customer. The court said two separate issues must be kept apart: whether the defrauded customer should receive a prompt refund, and who should ultimately bear the loss.
The court identified one exception to the immediate refund obligation in this context. A payment service provider may withhold the money if it has reasonable grounds to suspect that the customer himself committed fraud and reports those suspicions to the relevant national authority.
The burden of proof
The ruling does not mean customers can ignore security precautions without consequences. If a bank proves that a customer caused the loss through intentional conduct or gross negligence, it can subsequently seek compensation from them.
Crucially, however, the bank is the one who must bring the evidence. It cannot simply leave the customer to shoulder the burden of proof and fight for their rights in court.
That is where the ruling makes a practical difference. Anyone who falls victim to a scam already has to deal with lost money and often worries about the security of their account. If banks could refuse refunds based solely on their own assessment of a customer’s negligence, victims would first have to take legal action to recover money they are entitled to under EU rules.
Such an approach, the court said, would undermine the very obligation to provide immediate refunds and run counter to the aim of ensuring a high level of consumer protection.
What to do if money disappears
For consumers, the key lesson is simple: if something like this happens, report the suspicious transaction to your bank as quickly as possible. Prompt notification is one of the conditions for the refund obligation to apply.
The ruling establishes a clear order of events: refund the money first, provided the conditions under EU rules are met, and only then establish who is ultimately responsible for the loss.
