Bank Phishing: CJEU Orders Immediate Refund by the Bank (Judgment C-70/25)
The CJEU (C-70/25, 15 October 2026) closes the door on banks: alleging the customer's "gross negligence" no longer justifies refusing to refund phishing losses. Refund first; then, if appropriate, the bank claims the money back by proving fraud or gross negligence.
Legal review: Gabriel Padilla Franco, Elche Bar Association (ICAE) no. 1265 · 15 October 2026
The Court of Justice of the European Union (CJEU) has today, 15 October 2026, delivered a judgment that changes the rules of the game for victims of bank phishing across the European Union, including Spain. In case C-70/25 (N.O. v PKO BP S.A., ECLI:EU:C:2026:852), the First Chamber answers clearly: a bank cannot refuse to immediately refund the amount of an unauthorised transaction by alleging that the customer acted with gross negligence.
In plain terms: the bank refunds first; then, if it believes there was gross negligence or fraud by the customer, it must prove it and claim the money back. Gone are the days when the fraud victim had to sue to recover their own money.
In this article we explain what the CJEU has decided, what the Payment Services Directive (PSD2) actually says, how it fits with Spanish law and — most importantly — what to do if your bank has rejected your refund after a phishing attack. At the end, VIP subscribers can download the full judgment translated into Spanish and English in PDF.
The case: a 3,000-zloty phishing scam that reached Luxembourg
The facts are those suffered daily by thousands of bank customers:
- A customer of the Polish bank PKO BP listed an item for sale on an online auction portal.
- A fraudster, posing as an interested buyer, sent her a fake link mimicking the portal to "confirm the sale".
- The link led to a website replicating her bank's appearance. The customer entered her online banking credentials.
- Using those details, and an SMS code the victim herself provided under deception, the fraudster transferred 3,000 Polish zlotys (around €705) to his own account.
- The next day, the customer spotted the fraud and reported it immediately to the bank and the police.
- The bank refused to refund the money, arguing that the customer had acted with gross negligence by failing to protect her credentials.
The Koszalin District Court referred a preliminary question to the CJEU: may a bank refuse an immediate refund because the customer enabled the transaction through gross negligence? The CJEU's answer is a resounding no.
What the PSD2 says (Directive (EU) 2015/2366)
The judgment interprets three key provisions of the Payment Services Directive:
- Article 73(1) — The bank's obligation: where a payment transaction is unauthorised, the bank must refund the payer immediately after becoming aware of the transaction and, in any event, no later than the end of the first following business day. There is only one exception: the bank has reasonable grounds for suspecting fraud by the customer and communicates those grounds in writing to the relevant national authority.
- Article 74(1) — The payer's liability: the payer bears all losses where they result from fraudulent conduct or from a failure, intentional or due to gross negligence, to fulfil their obligations (for example, protecting personalised security credentials, Article 69).
- Article 72(2) — Burden of proof: it is for the bank to provide evidence proving the customer's fraud or gross negligence. The mere fact that the bank's records show the payment instrument was used does not prove the customer authorised the transaction.