A bank cannot refuse an immediate refund for an unauthorised payment merely because it believes its customer was grossly negligent, the EU Court of Justice ruled on October 15.
The judgment separates getting the money back promptly from deciding who must ultimately bear the loss. A provider can later seek reimbursement if it proves that the customer’s intentional conduct or gross negligence caused the loss.
The case arose after a Polish customer followed a fraudulent sales-platform link to a website imitating her bank. An attacker used her login details to transfer roughly €700. She reported the transaction the next day, but the bank refused a refund.
Under the court’s interpretation, a promptly reported unauthorised payment must generally be refunded immediately, and at the latest by the end of the following business day. The exception is reasonable suspicion of fraud by the customer, reported to the competent national authority.
That exception is not the same as suspecting carelessness. The national court must now resolve the dispute using the EU ruling; the judgment does not itself decide whether this customer was grossly negligent.
Official court summary, C-70/25.
