Finance & Banking
,
Fraud Management & Cybercrime
,
Geo-Specific
Top European Court Advisor Says Policy Should Be ‘Refund Now, Sue Later’
Banks must promptly refund phishing victims when the scams lead to unauthorized transactions, an advisor to the European Union’s top court has said.
See Also: Defending Financial Services Mobile Apps from Cyberattacks
The opinion, published Thursday by Court of Justice of the EU Advocate General Athanasios Rantos said a bank could still try to claw back the money from victims, should the financial institution establish that victims allowed the transaction out of “gross negligence.”
The CJEU usually follows the opinions of its advocates general, but not always. If it does so in this case, it would have a big impact on how banks treat phishing fraud in Poland and elsewhere in Europe, where victims usually have to suck up losses themselves.
The case in question involves an unnamed Polish woman who got duped on an online auction platform. Someone posed as a buyer for something she was selling and sent her a link that took her to spoofed versions of the auction platform and her bank’s website. She entered her bank login details and the miscreant used them to steal 3,000 Polish zlotys – $814 – from her.
The woman notified her bank, PKO Bank Polski, about the fraudulent transaction the following day. The bank refused to refund her for the stolen funds – so she sued it. The district court in the Polish city of Koszalin wasn’t sure how to interpret the EU Payment Services Directive on this matter, nor the Polish transposition of the directive, so it referred the case to the CJEU.
The directive, which came into force in early 2018, is supposed to strengthen consumers’ trust in the EU’s harmonized payments market. Under the law, a customer hoping for a refund must notify the payments provider promptly after finding out about an unauthorized payment, and also “take all reasonable steps to keep [the account’s] personalized security credentials safe.”
If the customer fails to keep those credentials safe, or they are acting fraudulently themselves, they may be liable to repay the payment provider the full amount of the transaction. The directive indicates that the provider needs to refund a phishing victim immediately, after being notified of the unauthorized payment.
PKO Bank Polski asserted that the Polish version of the law – national transpositions of EU directives can often put their own twist on matters, unlike with EU regulations – allows payment providers to avoid refunding customers, if they see gross negligence. The Polish court told the CJEU that payment service providers in the country generally refuse refunds in cases of unauthorized transactions, leaving it up to the customers to launch legal actions to try to reclaim what they lost.
The Polish district court nonetheless took the cautious view that the bank was in the wrong here, and Rantos agreed.
Specifically, Rantos said the wording of both the EU directive and its Polish implementation made it clear that banks could only try to delay immediate refunds if they suspected fraud on the customer’s part. If gross negligence is the suspicion, then the bank has to launch legal action on that basis after the refund has already taken place.
“By reserving exclusively to the case of fraud the option for such a provider not to refund immediately an unauthorized payment transaction, the EU legislature intended to remedy the practice whereby payment service providers alleged wrongful conduct on the part of the payer in order to refuse that refund, a practice which obliged the payer to bring legal proceedings in order to obtain the return of the amounts of unauthorized transactions,” Rantos wrote in his opinion.
The Italian government also weighed into the case with a compromise interpretation of the law, under which the bank would have to refund the customer immediately, even if they suspect them of gross negligence, but would then be able to reclaim the money without having to launch legal proceedings. Rantos said the directive did not support this idea, and in any case it would leave the customer in the same position as if they never received the refund.
Spain’s Supreme Court ruled in April 2025 that the EU directive puts the onus on banks to prove their customers’ negligence or fraudulent actions in phishing cases, if they want to avoid covering the losses.
In its 2025 report on payment fraud, the European Banking Authority said national interpretations of the concepts of “authorization” and “gross negligence” led to victims having to bear 85% of annual losses, with fraudulent credit transfers totaling around 2.2 billion euros in 2024.