We use cookies on our website.
Some of them are necessary for the functioning of the site, but you can decide about others. View more
In a high-profile decision, the Court of Justice of the EU has set a significant milestone in the field of banking law and consumer protection. The issued judgment of the Court of Justice of the EU in Case C-70/25 (Tukowiecka) provides crucial clarification for the handling of unauthorized payment transactions, as it meticulously interprets the provisions governed by the European Directive (EU) 2015/2366 on payment services in the internal market (PSD2).
A customer of a Polish bank entered their banking credentials on a fake website via a fraudulent link (phishing), after which a third party transferred approximately EUR 700 from their account. The bank rejected the customer's request for reimbursement, arguing that by entering their security credentials, the customer had acted with gross negligence. The official communication from the Court of Justice of the EU presents the facts of the case and the decision in greater detail.
The Court ruled that the gross negligence of a customer does not, in itself, constitute a reason for a bank to refuse the immediate reimbursement of money. As a rule, the bank must return the amount immediately, and no later than by the end of the next business day after it detected the transaction or was notified thereof. An exception applies only if the bank has reasonable grounds to suspect fraud by the customer themselves and communicates those grounds to the competent national authority.
The significance of the judgment lies primarily in the clear distinction between the immediate reimbursement of funds and the ultimate liability for the loss. Its practical implications can be summarized into three key highlights:
1. Alleged Gross Negligence Does Not Justify Rejecting Immediate Reimbursement
When faced with a reimbursement claim, a bank cannot merely claim that the customer acted with gross negligence by clicking a fraudulent link or disclosing security credentials and withhold the reimbursement on this basis. The potential liability of the customer remains relevant, but it must be addressed separately from the obligation of immediate reimbursement.
2. The "Reimburse First, Claim Recourse Later" Rule
Provided that the relevant conditions are met, the bank must first reimburse the funds. Subsequently, it may claim recourse if it proves that the loss resulted from a fraudulent or grossly negligent breach of the user's obligations.
Consequently, as a rule, consumers do not have to initiate legal proceedings first to secure reimbursement while bearing the financial consequences of the unauthorized transaction themselves. However, this does not mean that the consumer is permanently exonerated from liability or all potential costs of a subsequent dispute. This distinction is explicitly emphasized by the Court of Justice of the EU in its official explanation of the judgment.
3. An Important Message for Banks' Internal Procedures
For banks, the decision means that claim handling procedures must clearly differentiate between timely reimbursement and the subsequent assessment of customer liability. Where existing procedures do not ensure this, they will need to be adapted accordingly.
The decision may further reinforce the importance of rapid fraud detection, quality evidence collection, and efficient handling of reports. However, it does not mandate specific technological solutions or a compulsory scope of new investments in security systems.
For Banks: The burden of proof regarding gross negligence lies entirely with the bank. It is essential to distinguish between the obligation to provide immediate reimbursement and the ultimate liability for the incurred loss. As a rule, the bank must first return the funds to the customer’s account, and only then can it demand recourse from the customer, provided it proves that the loss is a consequence of an intentional or grossly negligent breach of their obligations.
For Consumers: A claim for immediate reimbursement cannot be rejected solely based on the allegation that the user acted with gross negligence by clicking a fraudulent link. Crucially, however, the consumer must report the detected unauthorized transaction to the bank without undue delay.
Yes. In Slovenia, the field of payment services and user protection is systematically regulated by the Slovenian Payment Services, Services of Issuing Electronic Money and Payment Systems Act (ZPlaSSIED). The interpretation of EU law provided by the Court of Justice of the EU is binding on Slovenian courts when deciding on the same legal question.
Note: The judgment applies exclusively to unauthorized transactions. If a user knowingly authorizes a transfer to a fraudster themselves (e.g., in the case of so-called investment scams), the legal assessment may differ.
The judgment of the Court of Justice of the EU brings an important clarification: a bank may not refuse immediate reimbursement solely on the grounds of a customer's alleged gross negligence. If the conditions are met, it must first return the money and subsequently pursue any potential claim for recourse due to a proven intentional or grossly negligent breach of the user's obligations.
For the consumer, this means that the question of their potential liability should not, as a rule, delay immediate reimbursement. For the bank, it means it must clearly separate the handling of the reimbursement claim from proving the grounds for a subsequent recourse.
ODI Law provides clients with expert advice and support in navigating significant transactional, structural and regulatory changes in the banking and insurance sectors.