Phishing: the bank must reimburse the customer even if they have been negligent

Greater protection, and the right to an immediate refund, for users who make unauthorised digital payments (resulting from fraudulent transactions), even if their behaviour is characterised by negligence. This is the key point of the judgment of the Court of Justice of the European Union in Case C-70/25, published today, 15 October.

The case, which reached the Court of Justice of the European Union, began when a woman, a customer of a Polish bank, fell victim to a fraud involving phishing (i.e. a cyber scam in which a fraudster pretends to be a trustworthy organisation in order to steal personal data, login credentials or money). An individual claimed to be interested in buying an item the woman was selling on an online platform and sent her a fraudulent link, which appeared to come from the platform and was intended to confirm the sale. The woman then clicked on the link, which led to a website that looked exactly like her bank’s, and entered her details to log in to online banking. In this way, the fraudster managed to transfer a sum of around 700 euros from the customer’s bank account to an account in his own name.

The following day, the customer reported the fraudulent transaction to her bank, which, however, refused to refund the amount of the unauthorised payment, finding the customer guilty of gross negligence , as she had failed to fulfil her obligation to protect her personalised security credentials.

The customer then brought the matter before a Polish court, which, in turn, referred the matter to the Court of Justice to ask whether, under EU law, the bank, in its capacity as a provider of payment services, is obliged to refund the amount of an unauthorised transaction immediately, even if it considers that the customer has acted with gross negligence.

In its judgment in Case C-70/25, the Court of Justice of the European Union answered in the affirmative. Where an unauthorised payment transaction occurs, the payment service provider is, in principle, obliged to refund the amount of the transaction immediately, or at the latest by the end of the first working day following the day on which it became aware of the transaction or was informed of it, provided that the customer reports the incident immediately. There is a single exception to the obligation to refund immediately: where the payment service provider has reasonable grounds to suspect fraud committed directly by the customer and reports this in writing to the competent national authority. The fact that the unauthorised transaction was caused by gross negligence on the part of the customer does not exempt the payment service provider (the bank in this case) from making the immediate refund.