EU court: banks must refund phishing victims immediately, even if they blame the customer
Even when a bank alleges “gross negligence”, it has to refund by the end of the next business day and can only seek the loss back afterwards.
Fell for a phishing scam and your bank says it is your fault? In the European Union, that is no longer enough to deny a refund. The Court of Justice of the EU ruled on Thursday, October 15, that a bank must immediately refund an unauthorised payment even if it believes the customer was “grossly negligent”. Only afterwards, and only by proving that negligence, can it try to recover the money.
The case
It started in Poland. A customer was selling an item on an online platform when a supposed buyer sent her a link to “confirm the sale”. The link led to a fake copy of her bank's website, where she entered her online banking login. The fraudster used those details to transfer the equivalent of about €700. She told her bank the next day, and the bank refused to refund her, arguing she had failed to keep her credentials safe.
What the court decided
- If the customer reports it without undue delay, the bank must refund an unauthorised transaction by the end of the business day after it is notified at the latest.
- The only exception is when the bank has reasonable grounds to suspect fraud by the customer and reports those grounds to the national authority.
- Believing the customer was careless does not entitle the bank to refuse the refund. It can seek the loss back later, but the burden of proving gross negligence is on the bank.
What it means
The ruling interprets the EU Payment Services Directive (PSD2) and binds courts in every EU member state. In practice it flips the burden: instead of the victim having to sue to get paid, the money comes back first, and it is up to the bank to argue about blame. The court said that letting banks refuse from the outset would make the immediate refund obligation “ineffective”.
The decision applies only within the European Union, so it does not cover the US or the UK, which have their own rules. The security lesson travels everywhere, though: banks do not send links to confirm a sale, and your login belongs only in the official app or website. If you do get scammed, tell your bank as fast as you can, because the timing of the report matters.
