CJEU mandates immediate reimbursement for unauthorized payments

The Court of Justice of the European Union (CJEU) has ruled that banks must immediately reimburse victims of unauthorized payments, regardless of the client's level of negligence. This decision, made on October 15, 2026, under the C-70/25 case, changes how banks handle such situations by requiring them to pay first and then prove the client’s serious negligence.

Payment fraud increases in France

In 2024, France experienced 1.2 billion euros in payment fraud, according to the Banque de France. Previously, banks could deny reimbursement if the client was found to be negligent, but under the new rules, they must cover the loss immediately and then attempt to show that the client was seriously at fault.

Banks face new responsibilities and penalties

Banks must reimburse victims within one business day after the unauthorized payment is reported. If they fail to do so, they face increasing penalties in the form of interest charges. Nora Amroun, a lawyer, explained that the interest rate increases by 5 points immediately, 10 points after 7 days, and 15 points after 30 days.

Victims benefit from faster recovery

European households are better protected under the new rules. For example, a Polish woman who lost 700 euros to phishing would now recover the funds within 24 hours instead of facing lengthy disputes. In France, victims previously lost up to 15,000 euros, but this new system aims to reduce such losses.

Banks must prove client negligence

Financial institutions are now required to prove that a client was seriously negligent, which demands more resources and expertise. Lawyers note that this shift requires banks to invest in human and technological capabilities to meet these new obligations and avoid costly delays.

French law aligns with new EU ruling

France already had a law in August 2022 requiring immediate reimbursement, but enforcement was inconsistent. The CJEU ruling clarifies that even in cases where negligence is suspected, reimbursement must occur within one business day, except in cases of proven or suspected fraud before a court.

Authentication not enough to prove consent

The Court of Cassation in France has ruled that strong authentication methods, such as two-factor verification, do not prove a client’s consent in cases involving psychological manipulation. This makes it harder for banks to argue that a client was at fault in certain situations.

Future impact on banking and consumers

The CJEU ruling shifts financial responsibility from consumers to banks, enhancing consumer protection and purchasing power. However, how the European banking sector adapts to these new rules, and whether the increased costs will be passed on to customers, remains uncertain.