Refund first, argue later? CJEU decision on unauthorised payments

Case C-70/25, Tukowiecka

CJEU (First Chamber), judgment of 15 October 2026, ECLI:EU:C:2026:852

Disputes over fraud carried out through fake banking websites usually follow a familiar pattern in Portugal. The customer reports a transfer they did not make, and the bank declines to refund it, arguing that the customer was grossly negligent in disclosing their login details. The Court of Justice of the European Union has now settled the order in which that dispute must be resolved, and the answer favours the customer at the outset.

On 15 October 2026, the Court of Justice of the European Union (CJEU) ruled that a bank cannot refuse to refund an unauthorised payment immediately on the ground that it considers the customer grossly negligent. The bank may, however, later recover the loss, provided it proves that negligence.

The case

A Polish bank customer selling an item online received a link from a supposed buyer that led to a fake version of her bank’s website, where she entered her login details. A third party then transferred around EUR 700 from her account. She reported the fraud the next day, but the bank refused to refund her, alleging gross negligence in keeping her credentials safe. The District Court of Koszalin (Sąd Rejonowy w Koszalinie), hearing her claim, asked the CJEU whether the bank could refuse the refund on that ground.

What the Court decided

The Court read Articles 73(1) and 74(1) of Directive (EU) 2015/2366 (PSD2) as governing two separate stages. First, the bank must, in principle, refund immediately, and at the latest by the end of the business day following the day on which it became aware of, or was notified of, the transaction, provided the customer reported the transaction without undue delay. The only exception is where the bank has reasonable grounds to suspect fraud by the customer and communicates them in writing to the relevant national authority; suspected gross negligence does not qualify. Second, the bank may seek to recover the loss from the customer if it proves an intentional or grossly negligent breach of the customer’s security obligations. Allowing the bank to refuse the refund from the outset would, the Court noted, deprive that obligation of its effect and force customers to sue to enforce it.

The Portuguese framework

In Portugal, PSD2 was transposed by the Legal Framework for Payment Services and Electronic Money (RJSPME), approved by Decree-Law no. 91/2018, of 12 November. Article 114 mirrors the EU rule: the bank must refund immediately, and at the latest by the end of the following business day, unless it has reasonable grounds to suspect fraud by the customer and communicates them in writing, within that deadline, to the judicial authorities. A late refund bears default interest at the statutory rate plus ten percentage points (Article 114(10)). The recorded use of the payment instrument is not, in itself, necessarily sufficient to prove gross negligence, which the bank must demonstrate (Article 113(3) and (4)).

Under Article 115, the customer’s exposure is capped at EUR 50. Gross negligence extends it to the available balance or linked credit line, and fraud or deliberate breach to the full loss. Except in cases of fraud, the customer bears no losses after notifying the bank or where strong customer authentication was not required.

What changes

Before the ruling: the law already required an immediate refund, with suspected fraud as the only express exception, but did not expressly address gross negligence, and some banks refused refunds at the complaint stage on that ground. Customers then had to complain to the Bank of Portugal or go to court, bearing the cost and delay of doing so.

After the ruling: the refund comes first, even if the bank considers the customer grossly negligent. The burden of acting shifts to the bank, which must seek repayment, by agreement or through the courts, and prove that negligence.

Portuguese courts already required the bank to prove gross negligence; the CJEU now adds a rule of sequence. Refusing a refund at the complaint stage because the customer shared their credentials has no basis in EU law. The customer’s conduct becomes relevant only when the bank seeks to recover the loss (and not, it appears, by simply re-debiting the account). The ruling covers unauthorised transactions only, not payments the customer ordered personally, even if deceived. Where the customer has confirmed the transaction in the banking app, the bank may argue that it was authorised but the Court did not rule on that question, which will turn on the facts of each case.

For customers who fall victim to this kind of fraud, speed is decisive: notify the bank immediately, ideally in writing, and report the fraud to the police. If the refund is refused, they may complain to the Bank of Portugal, use alternative dispute resolution or go to court. For banks, complaint-handling procedures that withhold refunds on suspected gross negligence alone should be reviewed now.

Disclaimer

GFDL Advogados acts for individuals and companies that have lost funds to fraud, including phishing and crypto-asset investment schemes. The firm’s litigation practice pursues refund claims against banks and payment service providers, from the initial complaint to the Bank of Portugal and the courts, and represents victims as assistentes in the related criminal proceedings. Where funds have already moved on, the firm applies for preventive attachment of the assets identified. Recovery outside Portugal is coordinated with counsel in the relevant jurisdictions. Enquiries may be directed to hello@gfdl.legal.

This article reflects the law in force at the date of publication and is provided for general information. It does not constitute legal advice and should not be relied upon without advice on the specific circumstances.