The Court of Justice of the European Union significantly strengthens the rights of bank customers following phishing attacks. In its judgment of 15 October 2026 (Case C-70/25), it clarified that banks or other payment service providers may not refuse to refund unauthorised payment transactions on the grounds that the customer enabled the fraud through gross negligence.
For those affected, this means a decisive improvement in their legal position: as a rule, the bank must initially make the refund. Whether the customer must ultimately bear the loss incurred is a separate question.
Phishing via a fake bank website
The CJEU’s decision in Case C-70/25 was based on a typical phishing case.
A customer of a Polish bank offered an item for sale on an online sales platform. A supposed prospective buyer sent her a link that appeared to originate from the sales platform and to serve the purpose of confirming the sale. In reality, the link led to a fraudulent website modelled on her bank’s website.
The customer entered her online banking access data on the fraudulent website. The fraudsters were then able to use this data to transfer money from the customer’s account to their own account.
Bank refuses refund
The customer reported the incident to her bank as early as the following day. However, the bank refused to refund the amount, arguing that the customer had enabled the unauthorised payment transaction through gross negligence by failing to adequately protect her personalised security credentials.
Was the bank allowed to refuse an immediate refund?
The referring Polish court asked the CJEU whether a payment service provider may refuse to refund an unauthorised payment transaction on this ground.
The CJEU answered in the negative. The customer’s gross negligence does not entitle the bank to refuse the refund that is, as a rule, owed without undue delay under EU law. Rather, the question of who must ultimately bear the financial loss must be assessed separately.
The effect of the decision is not limited to Poland, as the CJEU interprets Payment Services Directive (EU) 2015/2366 in a manner that is binding on all Member States. Accordingly, the judgment is also relevant in Germany.
Bank’s refund obligation
Under Art. 73(1) of Payment Services Directive (EU) 2015/2366, in the event of an unauthorised payment transaction, the payment service provider is generally obliged to refund the amount to the payer without undue delay. The refund must be made no later than by the end of the business day following the day on which the payment service provider becomes aware of, or is notified of, the payment transaction. An exception applies in particular where the payment service provider has reasonable grounds to suspect that the payer has committed fraud and communicates those grounds in writing to the competent national authority.
Gross negligence
By contrast, the bank may not refuse the refund solely because it alleges that the customer grossly negligently breached their obligations under Art. 69 of the Directive.
That provision requires payment service users, among other things, to take reasonable steps to protect their personalised security credentials. A breach of these obligations may have liability consequences. However, it does not eliminate the payment service provider’s prior refund obligation.
CJEU separates two legally distinct questions
The CJEU thus separates two legally distinct questions:
-
Refund obligation: Must the bank initially repay the amount of the unauthorised payment transaction?
-
Ultimate allocation of loss: Can the bank subsequently demand that the customer reimburse the refunded amount because of an intentional or grossly negligent breach of duty?
The key innovation lies in the binding separation of these two steps of assessment. The bank may not simply reject a refund claim by stating that the customer acted with gross negligence in handling their access data.
Consequences of the CJEU judgment for bank customers
In practice, banks often refuse refunds after phishing attacks on the grounds that the customer acted with gross negligence by disclosing access data, entering a TAN on a fake website or confirming a supposedly legitimate transaction.
Following the CJEU’s judgment, this line of argument is not sufficient to refuse an immediate refund.
This is of considerable importance for affected bank customers. Even if there is an allegation of a grossly negligent breach of duty, the bank must first comply with its refund obligation. It may not bring forward the assessment of the final allocation of liability in order to prevent the money from being repaid.
§ 675u BGB relevant
For German law, § 675u BGB (German Civil Code) is particularly relevant. Under that provision, in the event of an unauthorised payment transaction, the payment service provider is generally obliged to refund the payment amount without undue delay and, where applicable, to restore the debited payment account to the position it would have been in had the debit not taken place.
Account holder not generally exempt from liability
The CJEU judgment does not mean that customers are, in all circumstances, finally released from financial responsibility after every phishing attack.
Art. 74(1) of the Directive provides, under certain conditions, for the payer’s liability for unauthorised payment transactions where the payer has intentionally or with gross negligence breached certain obligations.
After making the refund, the bank may therefore generally attempt to recover the loss incurred from the customer. To do so, however, it must plead and prove the requirements of a corresponding claim.
Bank customer’s liability under § 675v BGB
Under German law, § 675v BGB (German Civil Code) must be taken into account in particular. The provision governs the payer’s liability in cases of misuse of a payment instrument and differentiates, among other things, according to the degree of fault.
Accordingly, the payer may be liable for the entire loss incurred if they enabled the unauthorised payment transaction with fraudulent intent or breached their obligations intentionally or with gross negligence. The CJEU clarified that the payment service provider may later demand that the customer compensate it for the losses attributable to the customer’s gross negligence. The money initially refunded may therefore be reclaimed by way of recourse, whereby the requirements of this claim must be set out separately.
The reclaim is therefore a separate procedural step that occurs later in time: the bank must first refund the loss and can only then demand repayment of the amount by separate means. To do so, it must prove misconduct on the part of the customer. The burden of proof for intent or gross negligence therefore lies with the bank in this second step, while the customer has access to the refunded amount in the meantime.
For practice, this means that the question of whether a customer actually acted with gross negligence remains relevant. However, it no longer determines whether the bank may refuse the refund initially owed, but may be decisive for the subsequent allocation of the loss.
Assessment required on a case-by-case basis
The specific facts must always be examined. Not every entry of access data on a fake website automatically constitutes gross negligence. Factors to be taken into account include, for example, the design of the fraudulent website, the manner in which contact was made, possible warnings, the specific authorisation of the transaction and the recognisability of the deception.
Judgment also of interest for older phishing cases
The judgment is also of interest for bank customers whose refund requests were rejected before 15 October 2026.
Anyone who received a rejection after a phishing attack that was essentially based on an allegation of gross negligence should have it reviewed whether claims can still be asserted.
In its decision, the CJEU did not order any temporal limitation of the effects of the judgment. In principle, this indicates that the interpretation of EU law must also be taken into account in disputes that are still pending.
Not all cases can be reopened
However, this does not mean that all concluded cases can automatically be reopened. Whether renewed assertion of a claim is possible depends, among other things, on limitation periods, the res judicata effect of court decisions, any settlements and the other circumstances of the individual case.
In older cases, it should therefore be examined in particular whether the claim is still enforceable and what legal steps have already been taken.
This applies especially to older phishing cases that were rejected solely by reference to gross negligence, provided they are neither time-barred nor finally adjudicated. A renewed demand against the payment service provider may then be considered in particular where the rejection was based exclusively on the allegation of fault and the transaction was undisputedly unauthorised.
Important step in favour of phishing victims
With its judgment of 15 October 2026 in Case C-70/25, the CJEU strengthens the position of bank customers who have become victims of unauthorised payment transactions.
The central message is: the bank may not refuse an immediate refund solely on the argument that the customer enabled the fraud through gross negligence.
This prevents the refund from initially being made dependent on what is often a complex and disputed assessment of fault.
However, the judgment does not mean that every refund must ultimately remain with the customer. An intentional or grossly negligent breach of duty may still lead to the customer’s liability under the statutory requirements. This question must, however, be examined separately from the initial refund obligation.
Assessment by MTR Legal
Digital attacks on bank accounts regularly raise issues of banking and payment services law, often involving demanding distinctions regarding authorisation and the allocation of risk. MTR Legal Rechtsanwälte assists clients when legal questions arise in connection with unclear account debits, access incidents or blocked online banking access and offers legal advice in banking law.
