Back
Automatically translated version. May contain inaccuracies compared to the original.
First the refund — then the dispute: EU Court protected phishing victims from banks' refusals
Even if a customer entered their data on a fake website, the bank cannot delay returning the money solely because it considers the customer careless.
This ruling was made by the Court of Justice of the European Union 15 October 2026 in case C‑70/25 Tukowiecka. It concerns the interpretation of the EU Payment Services Directive — it is not a decision of the European Central Bank.
In the case of an unauthorized payment transaction, the bank must refund the funds immediately, but no later than the end of the next business day after it learned of the transaction or received notice from the customer. The customer must notify the bank without undue delay.
A mere allegation of gross negligence — for example, that the customer entered login details on a phishing page — is not enough to refuse an immediate refund. An exception is possible if the bank has reasonable grounds to suspect that the customer themselves committed fraud and has notified the competent national authority of this in writing.
After refunding the funds, the bank may seek compensation from the customer if it proves that the customer intentionally or through gross negligence failed to fulfill their obligations. The bank bears the burden of proof.
The ruling concerns unauthorized transactions specifically. National courts of EU member states must take the CJEU’s interpretation into account when considering similar cases.
💬 ABleaks_bot
💕 Join
Telegram publication
