EU Court: Banks must immediately refund unauthorised payments despite customer negligence

Payment services: gross negligence on the part of the customer does not exempt the payment service provider from the obligation to immediately refund the amount of an unauthorised payment transaction. The payment service provider may, however, subsequently seek reimbursement from the customer for losses resulting from the customer’s gross negligence.

Payment services: gross negligence on the part of the customer does not exempt the payment service provider from the obligation to immediately refund the amount of an unauthorised payment transaction. The payment service provider may, however, subsequently seek reimbursement from the customer for losses resulting from the customer’s gross negligence.

A customer of a Polish bank fell victim to a phishing attack: a third party showed interest in the purchase of an object that the customer was selling on an online sales platform. That third party sent the customer a fraudulent link, presented as originating from that platform and intended to confirm the sale. Thus deceived, the customer followed that link to a website spoofing her bank’s website where she entered her online banking service login details. Using these details, the third party was able to transfer a sum equivalent to approximately €700 from the customer’s bank account to an account held by that third party.

The day, the customer notified the fraudulent transaction to her bank. The bank nevertheless refused to refund the amount of the unauthorised payment transaction, taking the view that the customer had, through gross negligence, made that transaction possible by failing to comply with her obligation to keep her personalised security credentials safe.

Following that refusal, the customer brought an action before a Polish court, which asked the Court of Justice whether, under EU law, 2 the bank, as the payment service provider, is obliged to refund the amount of an unauthorised transaction immediately, even if it considers that the customer 3 has been grossly negligent.

In its judgment, the Court answers in the affirmative .

In the case of an unauthorised payment transaction, the payment service provider is, in principle, obliged to refund the amount of that transaction immediately, and in any event no later than by the end of the business day following the day on which it noted or was notified of the transaction, provided that the customer notifies the payment service provider of this without undue delay. There is only one exception 4 to that immediate refund obligation: where the payment service provider has reasonable grounds for suspecting fraud committed by the customer and communicates those grounds to the competent national authority.

The fact that the payment service provider takes the view that the customer has made the unauthorised transaction possible through gross negligence – in particular by failing to take the necessary measures to protect his or her personalised security credentials – does not entitle the payment service provider to refuse to refund immediately .

Under EU law, a distinction may be drawn between the issue of refund of the amount of the unauthorised payment transaction and the issue of who must ultimately bear the losses relating to that transaction.

Thus, initially, the payment service provider is obliged to proceed with the immediate refund . Subsequently, it may, where appropriate, seek reimbursement from the customer for the losses incurred if it establishes that those losses resulted from the customer’s failure, with intent or gross negligence, to fulfil his or her obligations, in particular the obligation to safeguard his or her personalised security credentials. It is for the payment service provider to prove the existence of such gross negligence on the part of the customer.

This approach is consistent with the objective of ensuring a high level of consumer protection . Allowing the payment service provider to refuse to refund from the outset by relying on gross negligence on the part of the customer would render the immediate refund obligation ineffective and would require the customer himself or herself to take the initiative to bring proceedings to assert his or her right, with the costs and inconvenience that this may entail.

NOTE : A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice of the European Union the interpretation of EU law or the validity of an EU act.

The General Court has jurisdiction to deal with requests for a preliminary ruling coming exclusively within the following areas (1) the common system of value added tax (VAT), (2) excise duties, (3) the Customs Code, (4) the tariff classification of goods under the Combined Nomenclature, (5) compensation and assistance to passengers in the event of denied boarding or delay or cancellation of transport services, or (6) the system for greenhouse gas emission allowance trading. The Court of Justice has jurisdiction to deal with all other requests for a preliminary ruling.

Neither the Court of Justice nor the General Court decides the national dispute itself. It is for the national court or tribunal to resolve the case in accordance with the ruling by the Court of Justice or by the General Court, which is similarly binding on other national courts or tribunals before which a similar issue is raised.

Unofficial document for media use, not binding on the Court of Justice. The presentation of the facts and the legal context refers to the relevant period and is based on the case file.

The full text and, as the case may be, an abstract of the judgment is published on the CURIA website on the day of delivery.

‌1 The name of the present case is a fictitious name. It does not correspond to the real name of any party to the proceedings.

‌2 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market.

‌3 This press release uses the term ‘customer’ to refer to the holder of the payment account in question. Directive 2015/2366 uses the term ‘payer’, which it defines as a natural or legal person who holds a payment account and allows a payment order from that account. This term is also used in the provisions governing unauthorised payment transactions. See Article 4(8), as well as Article 73(1) and Article 74(1) of that directive.

‌4 Article 73(1) of Directive 2015/2366.

Source – Judgment of the Court in Case C-70/25 [Tukowiecka]