On October 15, 2026, the Court of Justice of the European Union — the EU's highest court — handed down a ruling with direct consequences for anyone who has lost money to a phishing scam. In Case C-70/25, the Court held that a bank must refund an unauthorized payment immediately — and in any event no later than the end of the business day following the day it became aware of, or was notified of, the transaction — even when the bank believes the customer was grossly negligent in letting the fraud happen.
The principle is short: refund first, argue later. The bank may still try to make the customer bear the loss afterwards — but only if it proves, with evidence, that the customer acted with intent or gross negligence. It cannot simply refuse the refund up front and make the victim fight to get the money back.
The dispute started in Poland. A bank customer was selling an item on an online sales platform when a supposed buyer sent her a link that appeared to come from the platform — a link that "confirmed" the sale. The link led to a fake website made to look like her bank's. She entered her online banking login details there, and the fraudster used them to transfer a sum equal to about €700 out of her account.
She reported the fraudulent transaction to her bank the next day. The bank refused to refund it, arguing she had been grossly negligent by failing to keep her security credentials safe. She sued in a Polish court, which asked the Court of Justice how EU payment-services law — Directive 2015/2366 (PSD2) — should be read. The Court's answer: the bank must refund immediately, negligence allegation or not. (The CJEU press office notes the case name used in the release is a fictitious name, to protect the real party's privacy.)
The judgment interprets three key provisions of the Payment Services Directive (Directive 2015/2366):
The Court's reasoning: letting banks withhold the refund on the basis of an alleged-negligence claim would empty the reimbursement obligation of its content — and force the victim to litigate just to recover their own money.
Timing matters on your side too. The refund right depends on you notifying your provider "without undue delay" after becoming aware of the transaction; EU law also gives an outer limit of 13 months from the debit date. In practice: report it the day you discover it, in writing, and keep the confirmation.
The directive provides only one exception to the immediate-refund obligation: where the bank has reasonable grounds to suspect fraud by the customer themselves and communicates those grounds in writing to the national competent authority. An internal belief that you were careless — even "grossly" careless — does not meet this bar.
Honesty requires the boundary, because this is the line banks and scammers alike will blur:
It means the bank cannot refuse the immediate refund by claiming you were grossly negligent. It must refund first. It may later try to make you bear the loss — but only if it proves, with evidence, that you acted with intent or gross negligence. The burden of proof is on the bank, not on you.
No. This ruling covers unauthorized transactions — where you did not consent to the payment, typically because a phisher used your credentials. If you knowingly authorized the transfer, even under deception, it is a different legal category. In the UK, authorized push-payment fraud has its own mandatory reimbursement regime; elsewhere, remedies differ.
Under the EU Payment Services Directive: immediately — and in any event no later than the end of the business day following the day the bank became aware of, or was notified of, the unauthorized transaction. Report it without undue delay; EU law gives you up to 13 months from the debit date to notify, but days beat months.
The ruling interprets EU law (Directive 2015/2366) and binds courts in EU member states; the UK's Payment Services Regulations 2017 contain a parallel provision. In the US, Regulation E gives you federal rights for unauthorized electronic transfers — report within 60 days of your statement and the bank must investigate, typically within 10 business days.
Sources (verified October 21, 2026): Court of Justice of the EU, Press Release No 147/26, Judgment in Case C-70/25 (October 15, 2026), https://curia.europa.eu/site/upload/docs/application/pdf/2026-10/cp260147en.pdf; Directive (EU) 2015/2366 (PSD2), Articles 71, 72(2), 73(1), 74(1). Coverage of the ruling by Agence Europe and Court Magazine corroborates the holding; the ruling itself is the authority.
