October 16, 2026, 10:37 am | Read time: 4 minutes
If you fall victim to a phishing attack and lose money, your bank is not necessarily obligated to reimburse you. A new ruling by the European Court of Justice now strengthens the rights of bank customers. Banks cannot refuse a quick reimbursement solely because they accuse the customer of gross negligence.
Fraudster Lured Bank Customer to Fake Site
The ruling stems from a fraud case in Poland. A woman wanted to sell an item through an online sales platform. A supposed buyer sent her a link to confirm the sale. Instead, she ended up on a fake website resembling her bank PKO BP’s site, where she entered her online banking credentials.
The fraudster also obtained a confirmation code sent via SMS and transferred 3,000 zlotys, approximately 700 euros, to his account. The customer noticed the fraud the next day and informed her bank and the police. However, the bank refused reimbursement, accusing her of gross negligence in handling her banking data. The case was eventually referred by the competent court in Poland to the European Court of Justice.
On October 15, 2026, the ECJ ruled in case C-70/25 “Tukowiecka” on the interpretation of EU law. The specific dispute between the customer and her bank must be resolved by the competent Polish court based on this decision.
Banks Must Reimburse Unauthorized Payments
The key point is that the ECJ separates two questions: Must the bank initially repay the missing money? And who ultimately bears the loss? In the case of an unauthorized payment, the bank must generally reimburse the debited amount immediately. According to the ECJ, merely accusing the customer of gross negligence is not sufficient to refuse this initial repayment.
This is based on the European Payment Services Directive PSD2. According to the consumer portal “Mimikama,” the money must be credited back by the end of the next business day after the bank learns of the unauthorized payment. However, affected individuals must promptly inform their bank as soon as they notice the fraud.
An exception may apply if the bank has legitimate reasons to suspect that the customer acted fraudulently. This suspicion must be reported in writing to the competent national authority.
Sparkasse Must Refund Customers €10,000!
How to Protect Yourself Against Errors and Fraud when Making ransfers
When the ECJ Ruling Does Not Apply
However, this rule does not apply universally to every payment triggered by fraud. As Mimikama explains, the ruling concerns payments that the account holder did not consent to. If someone initiates and authorizes a transfer themselves, such as falling for a seemingly legitimate investment offer, they cannot automatically claim an immediate reimbursement.
Also of interest: Savings Bank warns! Failure to respond may prevent online payments
The decisive factor is not just whether fraudsters were involved, but whether the account holder consented to the specific payment. Even a transfer initiated through deception can legally be considered authorized.
The interpretation is not only relevant for the specific case in Poland. Since it involves EU law requirements, the decision also plays a role in similar cases in Germany and Austria.
Bank Can Reclaim the Money Later
For fraud victims, this initially sounds like good news. However, it’s not that simple. The quick reimbursement does not automatically mean that the bank will ultimately bear the loss.
The ECJ explicitly separates the initial repayment from the later question of who is liable for the loss. If a bank proves that the customer intentionally or with gross negligence violated their obligations, it can subsequently “assert claims against them.”
For those affected, this is the crucial point of the ruling: A bank cannot block the quick repayment of an unauthorized payment simply by citing possible gross negligence. Whether the customer ultimately has to bear the loss is assessed separately.