Phishing scam: banks must repay customers right away

Whoever falls victim to a phishing attack and loses money as a result can hope for a quick refund. The European Court of Justice (ECJ) has significantly increased the rights of banking customers with its ruling of 15 October 2026. As a general rule banks are obliged to reimburse unauthorised payments immediately, even if they are alleging gross negligence. This follows a press release issued by the European Court of Justice (ECJ) in Case C-70 / 25, which specifically deals with online banking fraud, where a crook gains access to an account through a fake website. Payment not authorized? When the bank needs to refund the money VZ fordert Durchsetzung der Rückerstattungspflicht Fake bank website leads to money loss Phishing scam: banks must repay customers right away Image created with AI The starting point of the investigation was a phishing attack in Poland: a female bank customer advertised an article on an online marketplace. An imaginary purchaser sent her a link on which she claims to approve the sale. In fact, this link introduced you to a fake website that looked very much like your bank's own. The woman then entered her online banking login details, which the fraudster then used to transfer around £700 from your account to another account. The customer informed the bank the following day, but the bank refused to reimburse her, claiming that the woman acted grossly negligent. The case eventually ended in court. ECJ: banks must refund first The European Court of Justice has now made clear that banks are generally obliged to reimburse the amounts immediately for unauthorised transactions. The reimbursement must take place no later than the end of the following business day, after the bank has been informed of the operation. A possible breach of security rules does not justify refusing a refund in advance. An exception is if the bank has reasonable grounds to suspect that the customer has committed fraud and communicates these grounds in writing to the appropriate national authority. Possible recovery from gross negligence However, the ruling does not mean that a consumer is permanently exempt from liability in any case. As the lawyer Dr. Patrick Redell on anwalt. de explains, the court distinguishes between an immediate reimbursement and a later liability question. If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

This follows a press release issued by the European Court of Justice (ECJ) in Case C-70 / 25, which specifically deals with online banking fraud, where a crook gains access to an account through a fake website. Payment not authorized? When the bank needs to refund the money VZ fordert Durchsetzung der Rückerstattungspflicht Fake bank website leads to money loss Phishing scam: banks must repay customers right away Image created with AI The starting point of the investigation was a phishing attack in Poland: a female bank customer advertised an article on an online marketplace. An imaginary purchaser sent her a link on which she claims to approve the sale. In fact, this link introduced you to a fake website that looked very much like your bank's own. The woman then entered her online banking login details, which the fraudster then used to transfer around £700 from your account to another account. The customer informed the bank the following day, but the bank refused to reimburse her, claiming that the woman acted grossly negligent. The case eventually ended in court. ECJ: banks must refund first The European Court of Justice has now made clear that banks are generally obliged to reimburse the amounts immediately for unauthorised transactions. The reimbursement must take place no later than the end of the following business day, after the bank has been informed of the operation. A possible breach of security rules does not justify refusing a refund in advance. An exception is if the bank has reasonable grounds to suspect that the customer has committed fraud and communicates these grounds in writing to the appropriate national authority. Possible recovery from gross negligence However, the ruling does not mean that a consumer is permanently exempt from liability in any case. As the lawyer Dr. Patrick Redell on anwalt. de explains, the court distinguishes between an immediate reimbursement and a later liability question. If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

Fake bank website leads to money loss

Phishing scam: banks must repay customers right away Image created with AI The starting point of the investigation was a phishing attack in Poland: a female bank customer advertised an article on an online marketplace. An imaginary purchaser sent her a link on which she claims to approve the sale. In fact, this link introduced you to a fake website that looked very much like your bank's own. The woman then entered her online banking login details, which the fraudster then used to transfer around £700 from your account to another account. The customer informed the bank the following day, but the bank refused to reimburse her, claiming that the woman acted grossly negligent. The case eventually ended in court. ECJ: banks must refund first The European Court of Justice has now made clear that banks are generally obliged to reimburse the amounts immediately for unauthorised transactions. The reimbursement must take place no later than the end of the following business day, after the bank has been informed of the operation. A possible breach of security rules does not justify refusing a refund in advance. An exception is if the bank has reasonable grounds to suspect that the customer has committed fraud and communicates these grounds in writing to the appropriate national authority. Possible recovery from gross negligence However, the ruling does not mean that a consumer is permanently exempt from liability in any case. As the lawyer Dr. Patrick Redell on anwalt. de explains, the court distinguishes between an immediate reimbursement and a later liability question. If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

In fact, this link introduced you to a fake website that looked very much like your bank's own. The woman then entered her online banking login details, which the fraudster then used to transfer around £700 from your account to another account. The customer informed the bank the following day, but the bank refused to reimburse her, claiming that the woman acted grossly negligent. The case eventually ended in court. ECJ: banks must refund first The European Court of Justice has now made clear that banks are generally obliged to reimburse the amounts immediately for unauthorised transactions. The reimbursement must take place no later than the end of the following business day, after the bank has been informed of the operation. A possible breach of security rules does not justify refusing a refund in advance. An exception is if the bank has reasonable grounds to suspect that the customer has committed fraud and communicates these grounds in writing to the appropriate national authority. Possible recovery from gross negligence However, the ruling does not mean that a consumer is permanently exempt from liability in any case. As the lawyer Dr. Patrick Redell on anwalt. de explains, the court distinguishes between an immediate reimbursement and a later liability question. If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

The customer informed the bank the following day, but the bank refused to reimburse her, claiming that the woman acted grossly negligent. The case eventually ended in court. ECJ: banks must refund first The European Court of Justice has now made clear that banks are generally obliged to reimburse the amounts immediately for unauthorised transactions. The reimbursement must take place no later than the end of the following business day, after the bank has been informed of the operation. A possible breach of security rules does not justify refusing a refund in advance. An exception is if the bank has reasonable grounds to suspect that the customer has committed fraud and communicates these grounds in writing to the appropriate national authority. Possible recovery from gross negligence However, the ruling does not mean that a consumer is permanently exempt from liability in any case. As the lawyer Dr. Patrick Redell on anwalt. de explains, the court distinguishes between an immediate reimbursement and a later liability question. If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

ECJ: banks must refund first

The European Court of Justice has now made clear that banks are generally obliged to reimburse the amounts immediately for unauthorised transactions. The reimbursement must take place no later than the end of the following business day, after the bank has been informed of the operation. A possible breach of security rules does not justify refusing a refund in advance. An exception is if the bank has reasonable grounds to suspect that the customer has committed fraud and communicates these grounds in writing to the appropriate national authority. Possible recovery from gross negligence However, the ruling does not mean that a consumer is permanently exempt from liability in any case. As the lawyer Dr. Patrick Redell on anwalt. de explains, the court distinguishes between an immediate reimbursement and a later liability question. If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

A possible breach of security rules does not justify refusing a refund in advance. An exception is if the bank has reasonable grounds to suspect that the customer has committed fraud and communicates these grounds in writing to the appropriate national authority. Possible recovery from gross negligence However, the ruling does not mean that a consumer is permanently exempt from liability in any case. As the lawyer Dr. Patrick Redell on anwalt. de explains, the court distinguishes between an immediate reimbursement and a later liability question. If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

An exception is if the bank has reasonable grounds to suspect that the customer has committed fraud and communicates these grounds in writing to the appropriate national authority. Possible recovery from gross negligence However, the ruling does not mean that a consumer is permanently exempt from liability in any case. As the lawyer Dr. Patrick Redell on anwalt. de explains, the court distinguishes between an immediate reimbursement and a later liability question. If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

Possible recovery from gross negligence

However, the ruling does not mean that a consumer is permanently exempt from liability in any case. As the lawyer Dr. Patrick Redell on anwalt. de explains, the court distinguishes between an immediate reimbursement and a later liability question. If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

As the lawyer Dr. Patrick Redell on anwalt. de explains, the court distinguishes between an immediate reimbursement and a later liability question. If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

If the bank can prove that the customer acted intentionally or grossly negligently in breach of its security obligations, it is entitled to recover the resulting damage afterwards. The onus is on the payment service provider to prove this. What the verdict means for German bank customers The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

What the verdict means for German bank customers

The decision is also relevant for Germany. It concerns the interpretation of the European Payment Services Directive PSD2 and is thus relevant for comparable legal disputes within the EU. For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

For phishing victims, especially when they are in a much better starting position than their banks, they cannot just refuse a refund on the grounds of gross negligence. Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

Affected persons should report suspicious transactions to their banks immediately, block online banking accounts, and secure all evidence. It would also be a good idea to file a complaint with the police. But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

But, importantly, the judgment applies to unauthorised payments. Whoever approved a wire transfer to a fraudster may find themselves in a different legal situation. A claim for a refund depends on the concrete circumstances. It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .

It's not unusual for banks to blame victims of account fraud for gross negligence, the consumer group has found. But the law is clear .