EU court puts prompt refunds before bank negligence disputes
The EU Court of Justice ruled that banks cannot postpone refunds for unauthorised payments simply by alleging gross negligence by their customers. The money must normally be returned by the following working day, while any later claim against the customer proceeds separately. The Polish referral began with a phishing victim who lost 3,000 zlotys and was refused repayment.
Economics & Markets··Evening
Refund deadline comes before the negligence dispute
The Court of Justice of the European Union ruled on 15 October that a bank cannot delay refunding an unauthorised payment simply by alleging gross negligence by its customer. The judgment in case C-70/25 requires prompt repayment, normally by the end of the working day following notification or detection. A later claim against the customer remains possible.[1], [2]
An exception applies when the bank has reasonable grounds to suspect fraud by the customer. The payment service provider must notify the relevant national authority in writing. Alleging inadequate protection of a login, password or payment approval code does not by itself meet that exception. The refund deadline runs from the bank’s receipt of the notification or its own discovery of the unauthorised operation.[1]
A Polish phishing dispute reaches the EU court
The dispute began with a customer of PKO Bank Polski, a Polish bank. She followed a link to a counterfeit auction-site interface and disclosed payment credentials. A fraudster used them to take 3,000 zlotys from her account. After discovering the missing money, she requested repayment. The bank refused, saying she had not safeguarded her credentials and had disclosed them to an unauthorised person.[2]
The district court in Koszalin, Poland, referred the question to the EU court. It asked whether the refund had to be made immediately or whether alleged gross negligence entitled the bank to refuse. The dispute concerned EU payment-services legislation and the Polish law implementing it. These rules generally place responsibility for unauthorised payments on the payment service provider.[2]
Banks retain a later claim but carry the burden of proof
After making the refund, a bank can go to court to recover losses arising from a customer’s gross negligence where legal grounds exist. The bank carries the burden of proof. Whether conduct such as entering credentials on a counterfeit website reaches that threshold depends on a court’s assessment of the circumstances. The judgment does not decide which particular acts constitute gross negligence. Poland’s Financial Ombudsman received more than 10,000 requests for intervention concerning unauthorised payments during 2022–2025.[1], [2]
