A European court ruled banks must immediately reimburse victims of unauthorized transactions, even if negligence is suspected, shifting the burden of proof to financial institutions.
Unauthorized funds transferred
A person discovered unauthorized funds had been transferred from her bank account and contacted her bank to dispute the transaction and request reimbursement. Bank refused reimbursement
The bank refused to reimburse the funds, citing the client's alleged serious negligence in sharing login details, security codes, or validating notifications that allowed the fraud to occur. Legal question raised
This situation highlights a legal question addressed by the Court of Justice of the European Union (CJEU) in its October 15, 2026 decision (Case C-70/25). The case originated in Poland, involving a client of PKO BP bank who fell victim to a phishing scam. Phishing scam details
The client listed an item for sale online and was contacted by an individual posing as a buyer, who sent a link to a fraudulent site mimicking the bank's interface. The client entered her login details and provided a confirmation code received by SMS, enabling the scammer to transfer 3,000 Polish zlotys (approximately 705 euros) from her account. Client reported the fraud
The client reported the unauthorized transaction to her bank and the police, but the bank refused reimbursement, claiming the client's actions constituted serious negligence. The client then filed a lawsuit, prompting the Polish court to refer the matter to the CJEU. EU directive provisions
The CJEU ruled on the interplay of two provisions of the EU Directive (EU) 2015/2366 on payment services (DSP2): Article 73, which mandates immediate reimbursement of unauthorized payments, and Article 74, which outlines conditions for the payer's liability, including serious negligence. CJEU's key ruling
The CJEU ruled that the obligation to reimburse must occur immediately, without awaiting determination of the client's liability. The court emphasized that the suspicion of fraud by the client, not serious negligence, could justify the exception to immediate reimbursement. Banks must reimburse first
The CJEU clarified that banks must reimburse first and may later seek reimbursement from the client through legal channels if serious negligence is proven. The burden of proof for serious negligence lies with the bank. Ruling's broader impact
The ruling aims to prevent victims from initiating judicial procedures to enforce their right to reimbursement, which could delay resolution and incur costs. French courts must now interpret relevant provisions in light of the CJEU's decision. Significance of the ruling
The ruling is significant for cases involving phishing, bank identity theft, and transactions executed without the account holder's consent, reinforcing the principle that immediate reimbursement is a legal obligation regardless of alleged client negligence.
