The Court of Justice of the European Union (CJEU) has clarified the refund obligations applicable to unauthorised payment transactions (CJEU, judgment of 15 October 2026 – Case C-70/25, ECLI:EU:C:2026:852). According to the judgment, a payment service provider may not refuse an immediate refund solely because it alleges that the customer was grossly negligent in handling personalised security credentials. Whether the customer must ultimately bear the resulting loss must be assessed separately.
Phishing Case Before a Polish Court
Fake Website and Unauthorised Transfer
The case arose from an item that the customer of a Polish bank had offered for sale on an online marketplace. A purported prospective buyer sent her a link that was allegedly intended to confirm the sale. In fact, the link took her to a fake website designed to appear as though it were operated by her bank.
The customer entered her online banking credentials on the website. The perpetrator also obtained a confirmation code sent by SMS and subsequently initiated a transfer of 3,000 zloty, equivalent to approximately EUR 705, to the perpetrator’s own account.
Bank Refused the Refund
The following day, the customer informed her bank of the payment transaction. The bank refused to issue a refund, arguing that the customer had been grossly negligent in breaching her duty to protect her personalised security credentials and had thereby enabled the transfer.
The customer subsequently brought legal proceedings to enforce her refund claim. The Sąd Rejonowy w Koszalinie (District Court in Koszalin) hearing the dispute requested that the CJEU interpret EU law. The request was received by the Court on 3 February 2025 and concerned Article 73(1), read in conjunction with Article 74(1), of Directive (EU) 2015/2366 on payment services in the internal market, the Second Payment Services Directive (PSD2).
PSD2 Provisions on Refunds and Liability
Obligation to Issue an Immediate Refund
Article 73(1) PSD2 generally requires the payment service provider to refund the amount of an unauthorised payment transaction immediately. The refund must be made no later than the end of the business day following the day on which the payment service provider became aware of or was notified of the transaction.
This is subject to the customer notifying the payment service provider of the unauthorised transaction without undue delay. The use of the term “payer” in the Directive does not constitute a finding that the person concerned consented to the specific payment.
Separate Regulatory Areas Under the Directive
According to the CJEU, an immediate refund must be distinguished from the final allocation of the loss:
- Article 73(1) PSD2 governs when the payment service provider must refund the amount of an unauthorised payment.
- Article 74(1) PSD2 addresses the circumstances under which the payer must bear the loss resulting from the transaction.
- Article 69(2) PSD2 requires payment service users, in particular, to protect personalised security credentials against unauthorised access.
A potential breach of duty by the customer therefore does not, in itself, extinguish the refund obligation. It may, however, be relevant to a subsequent claim by the payment service provider for recovery of the loss.
Gross Negligence Does Not Preclude a Refund
Only Suspected Fraud by the Customer Permits an Exception
According to the CJEU’s decision, an allegation of gross negligence is not sufficient to refuse or delay an immediate refund. An exception to this obligation applies only where there are reasonable grounds to suspect that the customer acted fraudulently. The payment service provider must also communicate those grounds in writing to the competent national authority.
Such suspicion against the customer must be distinguished from fraud committed by an external phishing perpetrator. Even conduct that the bank considers to be a serious breach of the customer’s duties of care does not replace the requirements for the exception laid down in Article 73(1) PSD2.
A Refund Does Not Determine Final Liability
Refunding the unauthorised amount does not mean that the customer is necessarily entitled to retain that amount permanently. Following the refund, the payment service provider may examine whether the loss resulted from an intentional or grossly negligent breach of duty by the customer.
If the payment service provider seeks repayment of the refunded amount, it bears the burden of proving the relevant breach of duty. It must therefore establish that the customer breached their obligations intentionally or through gross negligence and that the loss resulted from that breach. The decision does not find that the customer in the main proceedings did, in fact, act with gross negligence.
Consumer Protection Through the Separation of Claims
Refund Must Not Depend on the Outcome of a Liability Dispute
The Court based its interpretation on the high level of consumer protection pursued by PSD2. If a payment service provider were permitted to withhold a refund merely on the basis of an allegation of negligence, the customer would first have to initiate court proceedings simply to obtain the refund. This would expose the customer to burdens and potential costs, even though Article 73(1) PSD2 is specifically intended to ensure that the account balance is restored promptly.
EU law therefore separates the prompt financial relief afforded to the customer from the subsequent determination of liability. At the same time, it does not release payment service users from their obligation to protect login credentials, confirmation codes and other personalised security credentials against unauthorised access.
Advocate General’s Opinion Consistent With Subsequent Judgment
In his Opinion of 5 March 2026, Advocate General Athanasios Rantos had already taken the view that the payment service provider must issue the refund first. If the customer subsequently refused to repay the amount, the payment service provider would itself have to enforce any recovery claim it asserted.
The judgment was delivered by the First Chamber of the CJEU. Judge Bošnjak acted as Judge-Rapporteur. The decision was published in Luxembourg on 15 October 2026.
Implications for Banks and Payment Service Users
Separate Assessment of Refund and Recovery Claims
Banks and other payment service providers must distinguish between a claim for an immediate refund and a potential subsequent recovery claim. Investigations into whether a customer disclosed their online banking credentials intentionally or with gross negligence do not, in themselves, permit the refund to be delayed.
Under German law, this distinction particularly concerns the relationship between § 675u BGB (German Civil Code) on refunds for unauthorised payment transactions, § 675v BGB on the payer’s liability and § 675w BGB on evidentiary requirements. The CJEU’s interpretation of EU law must be observed when applying these provisions.
Polish Court to Decide the Individual Case
The CJEU did not conclusively decide the specific payment dispute. In preliminary ruling proceedings, the Court provides a binding interpretation of the relevant EU law; the assessment of the facts and the decision on the claim remain matters for the national court.
The Sąd Rejonowy w Koszalinie must therefore still determine the consequences of this interpretation for the main proceedings. This includes, in particular, the unresolved question of whether the customer did, in fact, breach her obligations through gross negligence.
Legal Advice on Unauthorised Payment Transactions
The decision demonstrates that a claim for an immediate refund and potential subsequent liability are subject to different requirements. Companies, investors and private individuals dealing with unauthorised payment transactions, refund claims or recovery claims can obtain banking law advice from MTR Legal tailored to the circumstances of their particular case.
