Banks cannot refuse to refund an unauthorised payment simply because they believe a customer acted with gross negligence, according to a judgment delivered by the Court of Justice of the European Union (CJEU) on 15 October 2026.

The ruling clarifies how banks must apply existing European payment-services legislation when customers report fraudulent transactions. It separates the obligation to refund an unauthorised payment promptly from the subsequent question of whether the customer should ultimately bear the financial loss.

The decision could be significant for victims of phishing and other forms of banking fraud, although it does not mean that every payment connected to a scam must automatically be reimbursed.

A €700 Phishing Scam Led to the European Court Case

The case, known as Tukowiecka (C-70/25), originated in Poland.

A woman selling an item through an online marketplace was contacted by someone posing as a prospective buyer. She received a link that appeared to relate to the transaction but led to a fraudulent website imitating her bank's online platform.

After entering her banking credentials, approximately €700 was taken from her account through a payment transaction carried out by the fraudster.

The woman notified her bank the following day and requested a refund. The bank refused, arguing that she had failed to protect her security credentials adequately by entering them on a fraudulent website.

The dispute eventually reached the CJEU, which was asked to clarify whether a bank could rely on alleged gross negligence to refuse an immediate refund for an unauthorised payment.

Banks Cannot Use Suspected Gross Negligence to Refuse an Immediate Refund

In its judgment of 15 October, the Court ruled that Articles 73 and 74 of the EU Payment Services Directive must be interpreted as preventing a payment service provider from refusing immediate reimbursement of an unauthorised transaction solely because it believes the customer enabled the transaction through gross negligence.

The decision distinguishes two separate questions: whether the bank must refund the unauthorised payment immediately, and who should ultimately bear the financial loss.

Where the legal conditions for reimbursement are met, the bank cannot use an allegation of gross negligence as a reason to withhold the initial refund. The obligation to reimburse generally requires the amount to be restored immediately and, at the latest, by the end of the following business day after the bank becomes aware of or is notified of the unauthorised transaction, subject to the applicable statutory exception.

The judgment therefore reinforces the protection provided by existing EU legislation rather than creating an entirely new reimbursement system.

What Happens If the Bank Believes the Customer Was Negligent?

The ruling does not mean that a customer's conduct is irrelevant or that banks must ultimately absorb every loss arising from fraud.

If a bank believes a customer acted with gross negligence, it may investigate the circumstances and pursue the legal remedies available to it. However, that allegation cannot, by itself, justify refusing the initial refund of an unauthorised payment.

The distinction is important because victims may be deceived into disclosing credentials or other security information without intending to authorise a fraudulent transaction. Under the interpretation established by the Court, the bank must first comply with its reimbursement obligation where the relevant legal requirements are satisfied.

The Court's decision also preserves the distinction between gross negligence and suspected fraud committed by the customer. The EU payment-services framework provides a separate exception where a bank has reasonable grounds to suspect fraud by the customer and communicates those grounds in writing to the competent national authority.

The Ruling Does Not Cover Every Type of Cyber Scam

The legal scope of the judgment is particularly important for customers seeking reimbursement.

The case concerns an unauthorised payment transaction. It should not be interpreted as a ruling that banks must automatically reimburse every loss associated with an online scam.

For example, a victim might be tricked into revealing credentials that a criminal then uses to make an unauthorised transfer. In another situation, a victim might personally approve a transfer after being deceived by someone impersonating a bank employee or a legitimate business.

Those situations can raise different legal questions. Whether a payment is unauthorised, what evidence is available and which statutory provisions apply all matter when determining the customer's rights.

Customers affected by suspected fraud should report the transaction to their bank promptly, preserve relevant messages and evidence, and request a formal explanation if reimbursement is refused.

Spain Already Has Legal Protections for Unauthorised Payments

Spain's payment-services legislation already provides for the reimbursement of unauthorised payment transactions in the circumstances specified by law.

The CJEU judgment clarifies how the corresponding EU rules must be interpreted when a bank alleges gross negligence by the customer. It is therefore relevant to the application of existing Spanish protections, rather than a new blanket entitlement to compensation for all cyber fraud.

The ruling also follows years of disputes over the responsibility of banks and customers when criminals gain access to accounts through phishing, telephone scams and other forms of digital deception.

In each case, the circumstances of the transaction remain important. A payment that the customer did not authorise is legally different from one the customer personally approved after being deceived, even if both arose from a scam.

What the Decision Means for Victims of Banking Fraud

The central effect of the judgment is to clarify the order in which an unauthorised payment dispute must be handled.

When the conditions for reimbursement are met, a bank cannot simply refuse the immediate refund because it considers the customer to have been grossly negligent. Questions about the customer's conduct and the final allocation of the loss must be dealt with separately under the applicable legal framework.

For victims, this provides an important clarification when challenging a refusal based solely on alleged negligence. It does not remove the need to establish that the transaction falls within the relevant legal protections, nor does it guarantee reimbursement in every case.

The judgment strengthens the distinction between a bank's immediate obligations following an unauthorised payment and the later assessment of responsibility for the fraud.