EU court requires banks to make swift refunds after phishing
A bank may not refuse a refund in advance solely because it suspects gross negligence by the customer.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
The Court of Justice of the European Union ruled on Thursday that banks must in principle immediately refund an unauthorised payment. Even where gross negligence is suspected, a bank may not refuse the refund first and only then investigate who ultimately bears the loss.
The ruling concerns a Polish customer who entered her login details via a fake link on a counterfeit banking website. A third party subsequently transferred approximately €700. The bank refused to refund the money because, in its view, the customer had enabled the fraud through gross negligence.
The Court ruled that a payment service provider must reimburse an unauthorised payment immediately and no later than the end of the following working day, provided the customer informs the bank without undue delay. The exception applies where the bank has reasonable grounds to suspect fraud by the customer herself and reports those grounds to the competent national authority.
According to the judgment, a bank may later try to recover the amount. To do so, it must demonstrate that the customer breached her obligations intentionally or through gross negligence, for example by failing to protect security credentials carefully. The Court considers the refund and the final allocation of the loss to be two separate questions.
The judgment was delivered in preliminary ruling proceedings. The Court explained how European payment law must be applied; the Polish national court must still decide the individual dispute in accordance with that interpretation. The interpretation is nevertheless relevant to other national courts and payment service providers dealing with similar cases.
For Dutch banks and customers, the ruling may affect how phishing reports are handled, but its precise application also depends on Dutch legislation and the facts of each case. The ruling does not mean that every instance of fraud will ultimately be borne by the bank: after making a refund, a bank may still bring separate proceedings if it can prove gross negligence.
One story, several perspectives
What is established
- The Court takes immediate reimbursement as the starting point.
- A bank may later try to recover compensation from the customer.
- The bank must prove gross negligence.
Left
Arguments Consumers often find phishing difficult to recognise and have fewer legal and technical resources than banks. The bank should therefore first remedy the loss and improve its fraud detection.
Values Consumer protection, the balance of power and access to justice.
Consequences Banks initially bear more risk, but customers gain certainty more quickly and face fewer barriers to reporting fraud.
Centre
Arguments A swift refund is reasonable as long as banks can then investigate fraud and negligence carefully. Clear procedures are needed to protect both victims and banks.
Values Balance, legal certainty and practicability.
Consequences The rule may speed up disputes, but will probably also lead to more investigations and administrative costs.
Right
Arguments Customers also have a responsibility to protect passwords and security credentials. If banks always pay first, this could reinforce careless behaviour and incentives for fraud.
Values Personal responsibility, contractual clarity and market incentives.
Consequences Banks may introduce stricter checks and conditions, which could make services more cumbersome for all customers.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The substance of the article follows the judgment of the Court of Justice of 15 October 2026. The distinction between immediate reimbursement and subsequent recovery is expressly set out in the ruling.
- confirmed The Court requires banks in principle to provide immediate reimbursement of an unauthorised payment. — This is the core of the judgment in Case C-70/25. source
- confirmed The refund must be made no later than the end of the following working day if the customer reports the matter without undue delay. — This is stated in the Court's explanation. source
- confirmed After making a refund, a bank may still seek reimbursement from the customer where intent or gross negligence has been proven. — The Court expressly makes this distinction. source
- confirmed The Polish national court will continue to decide the individual dispute. — The Court emphasises that it does not itself decide the national dispute. source
Editor's note
The main legal rule has been taken directly from the judgment. The possible consequences for Dutch proceedings have been phrased cautiously; the judgment does not decide an individual Dutch dispute.Sources
- Judgment in Case C-70/25 Tukowiecka — Hof van Justitie van de Europese Unie
- Rażące zaniedbanie klienta nie zwalnia banku z obowiązku zwrotu środków — BS.net.pl
More on this in Dutch media
- NRC — „phishing banken”
- NOS — „phishing banken”
- Het Parool — „phishing banken”