ECJ: banks must refund unauthorised payments first, argue negligence later

The Court of Justice held that a payment service provider cannot refuse to refund a payer immediately for an unauthorised payment transaction on the ground that the payer enabled the transaction through gross negligenceEuropa. In its judgment of 15 October 2026Europa in Case C-70/25Europa (TukowieckaEuropa), the First Chamber ruledEuropa that Article 73(1) and Article 74(1) of Directive (EU) 2015/2366 must be interpreted as precluding such a refusalEuropa, even where the payer breached the duties to safeguard payment instruments and personalised security credentials laid down in Article 69 of that directiveEuropa.

The reference came from the Sąd Rejonowy w Koszalinie (District Court, Koszalin, Poland) in proceedings between a customer and PKO BP S.A. The customer, selling an object on an online auction platform, followed a link sent by a fraudster that she believed came from the platform, landed on a spoofed page mimicking her bank's website, and entered her online banking login details. The fraudster used those details to transfer PLN 3,000 (approximately EUR 705) out of her account, completing the transaction with an SMS confirmation code obtained from her by deceit. She reported the fraud to the bank and the police the next day; the bank refused to refund her, attributing the loss to her gross negligence in safeguarding her payment instrument.

The Court reasoned from the wording of Article 73(1) that the immediate-refund obligation — refund immediately and in any event no later than by the end of the following business day after noting or being notified of the transactionEuropa — admits only one exception: reasonable grounds for suspecting fraud, communicated in writing to the relevant national authorityEuropa. Gross negligence is not listed as a ground for refusing the immediate refundEuropa. Article 74(1) instead governs the later allocation of liability: a payer who acted fraudulently or who failed with intent or gross negligence to fulfil the Article 69 obligations bears all resulting losses, while losses from a lost, stolen or misappropriated instrument are otherwise capped at EUR 50.

The context and purpose of the rules confirm this two-stage reading. Article 72(2) places the burden of proving fraud or gross negligence on the payment service provider, and recital 71 describes immediate refund as the rule with only the fraud-suspicion investigation as a qualification. Letting providers withhold the refund on a unilateral assessment of gross negligence would strip the immediate-refund duty of effectiveness and force users — often consumers — to sue for their money and bear the costs, contrary to the directive's aim of a high level of consumer protection. The legislative history points the same way: neither the predecessor Directive 2007/64/EC nor the Commission's original proposal contained the fraud exception, and the EU legislature added only that one exception while subjecting the directive to full harmonisation under Article 107(1).

For practice, the consequence is that a provider which considers the payer grossly negligent must refund first and then pursue reimbursement from the payer through the remedies available for that purpose, proving the gross negligence itselfEuropa. Withholding the refund upfront is lawful only where the provider has reasonable grounds to suspect fraud by the payer and reports those grounds in writing to the competent national authorityEuropa. The out-of-court dispute settlement procedures under Article 102(1) remain available for any dispute under Titles III and IV of the directive and are unaffected.

Legal basis: Directive (EU) 2015/2366, Articles 69, 72(2), 73(1), 74(1), 102(1) and 107(1); judgment of the Court (First Chamber) of 15 October 2026 in Case C-70/25.