EU court rules banks must refund phishing victims at once, even if negligent

The ruling

The Court of Justice of the European Union ruled on Thursday, 15 October 2026, that a bank must refund money taken in an unauthorized transaction without delay, even when it alleges the customer was grossly negligent. The judgment answered a question from a Polish court about cases such as phishing, in which stolen login details are used to move money out of an account. Under the court's reasoning, the refund is due by the end of the next business day after the transaction was discovered or reported. A bank may withhold payment only when it has reasonable grounds to suspect the customer committed the fraud, and even then it must notify the national authority in writing.

The Polish case

The dispute concerned a female customer of a Polish bank who had listed an item for sale online. A person posing as a buyer sent her a link, which led to a fake page resembling her bank's website, and she entered her online banking login details there. The fraudster used them to make a transfer of about 700 euro, according to pb.pl and Handelsblatt, while Rzeczpospolita put the sum at 3,000 zloty and named PKO Bank Polski as the bank. She reported the transfer the following day, but the bank refused, arguing she had been grossly negligent in protecting her login data. The case went to a district court in Koszalin, which referred the question to the EU court, and Rzeczpospolita reported that the Polish judge had reasoned that the risk of unauthorized transactions rests entirely with payment providers under Directive 2015/2366 and national law.

What the bank can do later

The judgment separates the obligation to pay quickly from the question of who ultimately bears the loss. A bank that later proves a transaction resulted from gross negligence on the customer's part may seek recovery, and the burden of proof rests with the bank. According to Rzeczpospolita, the court held that the bank is not entitled to assess whether the customer was negligent and cannot use that assessment to refuse a refund. VRT NWS reported that Belgian courts had already reached similar rulings, and that EU law takes precedence over national case law, which gives the judgment weight beyond the sum involved. Customers must still report unauthorized transactions without undue delay, and the Financial Ombudsman's office explained that claims lapse if no report is made within 13 months of the account debit.

Ombudsman and consumer groups

Michał Ziemiak, Poland's Financial Ombudsman, commented on the ruling and stressed that the customer is the victim of the fraud.

A client who reports a fraud is a victim, and the fact that they fell for manipulation does not mean they can be blamed and refused a refund.

The Ombudsman's office said it had received more than 10,000 applications concerning unauthorized payment transactions in 2022-2025, from people whose banks or payment institutions refused refunds, often citing gross negligence. A expert from the German Consumer Protection Association (vzbv) said a similar practice can be observed in Germany. Consumers there spend considerable effort on disputes, give up, accept unfavorable settlement offers, or avoid the courts because of the risk of litigation costs.