EU top court: banks must refund fraud victims first, even if negligent

The Court of Justice of the European Union (CJEU) ruled on 15 October 2026 that banks and other payment service providers cannot delay or refuse refunding a customer hit by an unauthorised transaction just because they suspect the customer was grossly negligent. The judgment was issued in Case C-70/25, N.O. v PKO BP S.A., following a request for a preliminary ruling from a district court in Koszalin, Poland, lodged on 3 February 2025.

What happened in the underlying case

The case began with a Polish bank customer, identified in court papers only as N.O., who was targeted by a scammer posing as a buyer on an online sales platform. The scammer sent a fraudulent payment link disguised as a message from the platform. After the customer clicked the link and entered her banking credentials on a fake login page, the scammer transferred roughly €700 out of her account. Her bank, PKO BP, refused to reimburse her, arguing that she had been grossly negligent by entering her credentials on the fake page.

What the Court decided

The CJEU held that EU payment services law — the Payment Services Directive (Directive 2015/2366, known as PSD2) — requires a bank to refund the amount of an unauthorised transaction immediately, and no later than the end of the business day following the customer's report, regardless of whether the bank believes the customer acted with gross negligence. The Court found that letting banks withhold the refund while they investigate negligence claims would strip the reimbursement obligation of its practical effect and force victims to go to court simply to get their own money back.

The ruling does not prevent banks from later trying to recover the reimbursed amount. If a bank believes the customer deliberately or through gross negligence failed to protect their personalised security credentials, it can pursue a claim against the customer afterwards — but the burden of proving that negligence falls on the bank, typically before a judge, rather than on the customer at the moment of the fraud.

Why it matters across the EU

Because PSD2 is an EU directive applied in all 27 member states, the ruling is binding guidance for national courts and regulators across the bloc, not only in Poland. Consumer organisations say the practical effect is significant because many banks have routinely reversed the sequence the law intended: investigating suspected negligence first and paying out only afterwards, if at all. The Belgian consumer group Test-Achats/Testaankoop called the decision a turning point. Its spokesperson, Julie Frère, summarised the obligation as "Les banques doivent payer d'abord, discuter ensuite" ("banks must pay first, discuss later"), saying it confirms a rule banks had been circumventing in practice.

The Brussels Times reported that the ruling directly challenges current practice at Belgian banks, several of which have refused immediate reimbursement while they investigate whether a customer was careless with login details or one-time codes. Legal commentary on the case, including analysis published by Spanish outlet Ara, notes that the Court's answer applies specifically to the refund deadline set out in PSD2, that the ruling speaks in terms of 'payment service providers' more broadly rather than banks alone, and that it leaves providers free to litigate gross negligence separately, after the money has already been returned.

The scale of the problem

The ruling arrives as payment fraud losses have been rising across the EU and European Economic Area. A joint report by the European Banking Authority and the European Central Bank found that overall payment fraud losses reached €4.2 billion in 2024, up from €3.5 billion in 2023 and €3.4 billion in 2022 — a roughly 20% increase from 2023 to 2024. Within that total, fraud linked to credit transfers rose 16% year-on-year to €2.2 billion, and fraud on EU- and EEA-issued cards rose 29% to about €1.33 billion. For credit-transfer fraud specifically, the same report found that payment service users bore about 85% of the resulting losses, largely because scams trick people into authorising the transfer themselves.

What is still unclear

The judgment addresses unauthorised transactions — cases where someone else accessed or diverted the customer's money, as in phishing. It does not change the separate legal treatment of situations where a bank has objective grounds to suspect the customer authorised the payment themselves or was complicit in the fraud, which can still justify withholding a refund. How quickly individual banks across the EU change their internal refund procedures in response to the ruling, and whether national regulators will actively enforce it, remained to be seen as of 16 October 2026.