CJEU orders banks to refund phishing losses immediately, even when they allege gross negligence by the customer

The Court of Justice of the European Union has settled a question affecting thousands of bank claims across Europe every year: when a customer suffers an unauthorised payment transaction after falling for a phishing scam, the bank cannot refuse a refund by alleging that the customer acted with gross negligence. The judgment in case C-70/25 (Tukowiecka), delivered on 15 October 2026, interprets Directive (EU) 2015/2366 on payment services (PSD2) and fixes a clear rule: the amount is refunded first, and only afterwards is it decided who ultimately bears the loss.

The facts: a fraudulent link and 700 euros stolen

The case began with a customer of a Polish bank who listed an item for sale on an online platform. A third party, posing as an interested buyer, sent her a link that appeared to come from the platform but led to a website imitating her bank's. The customer entered her e-banking credentials there, and the fraudster transferred an amount equivalent to about 700 euros to his own account. The next day, she notified the transaction to her bank, which refused to refund it: in its view, she had enabled the fraud by grossly breaching her duty to protect her personalised security credentials.

The Polish court referred a preliminary question to the CJEU: does Union law oblige the payment service provider to refund the amount immediately even where it considers that the customer was grossly negligent? The Court's answer is yes.

Refund first, argue later

The judgment separates two planes that banking practice tended to merge. The first is the immediate-refund obligation of Article 73(1) of the Directive: faced with an unauthorised transaction notified without unjustified delay, the provider must restore the amount by the end of the following business day at the latest. The only exception is where there are reasonable grounds to suspect fraud by the customer, communicated in writing to the competent national authority. Alleged gross negligence by the customer is not among the grounds for refusing the refund.

The second plane is the final allocation of the loss. Under Article 74, the user may ultimately bear the losses if they acted fraudulently or failed, deliberately or through gross negligence, to meet their security obligations. But that discussion happens afterwards: the provider refunds the amount and, if it sees fit, claims reimbursement from the customer, bearing the burden of proving gross negligence. Article 72 reinforces that evidentiary scheme: it is for the provider to prove that the transaction was authenticated, duly recorded and accounted for, and unaffected by technical failure.

The Court grounds the outcome in the objective of a high level of consumer protection: allowing the bank to deny the refund upfront would deprive the immediate-refund obligation of its useful effect and force the customer to litigate to recover their money, with all the costs that entails.

The Spanish transposition: Articles 45 and 46 of Royal Decree-Law 19/2018

In Spain, PSD2 was incorporated through Royal Decree-Law 19/2018 on payment services. Its Article 45 enshrines the immediate-refund obligation and Article 46 regulates the payer's liability in terms parallel to Articles 73 and 74 of the Directive. The Tukowiecka doctrine is therefore directly applicable to Spanish claims over unauthorised transactions: consumer and banking law firms handling these files now hold a forceful European argument against the most common bank response, the customer's alleged negligence in handing over their credentials.

For daily practice, the judgment suggests adjusting pre-litigation claim letters and pleadings: it is wise to separate expressly the immediate refund (which admits no negligence exception) from the user's possible final liability (which the bank must prove), and to document the date and time of notification, since the refund period runs from it. It is an argument that adds to the toolkit we reviewed in our guide to the abbreviated administrative procedure and in the analysis of the Organic Law on the Right of Defence, and it connects with the credential protection we covered in AI and professional secrecy.

What comes next

The case returns to the Polish court, which must resolve the dispute in line with the interpretation now fixed. Meanwhile, the judgment already binds every national court dealing with similar problems, and it will predictably enter the argumentation of phishing, smishing and bank-spoofing claims across the EU. More analysis in our legal news section.