EU court: banks must refund fraud victims by the next working day
The EU Court of Justice says banks must reimburse unauthorised payments by the end of the next working day, even if the customer fell for a fake website. They can try to claw it back later, but must prove gross negligence.
Refund first, argue later. That is the upshot of a 15 October ruling by the Court of Justice of the European Union (case C-70/25), which strengthens protection for victims of bank fraud across the EU.
The case
A Polish woman put an item up for sale online. A supposed buyer sent her a link to a fake version of her bank’s website, where she entered her login details. The fraudster obtained the SMS confirmation code and took 3,000 zloty (about €700). She reported it the next day, but the bank refused a refund, saying she had been grossly negligent.
What the court said
- Banks must refund an unauthorised payment immediately, and no later than the end of the next working day after learning of it, if the customer reported it without delay.
- Entering credentials or a code does not, on its own, prove the customer authorised the payment.
- The only reason to delay is a reasonable suspicion of fraud by the customer, which must be reported in writing to the national authority.
- Banks can then seek the money back, but they must prove intent or gross negligence.
If it happens to you
Tell your bank straight away, report it to the police and, if the bank refuses, cite this ruling. Note that it covers payments you did not authorise; it does not cover every scam, such as when a customer is tricked into making a transfer themselves.
