Bank fraud: banks can no longer refuse an immediate refund on the grounds of ‘gross negligence’

In a judgment delivered on 15 October 2026 (Case C-70/25, Tukowiecka), the CJEU significantly strengthened the protection of consumers and users of payment services in the European Union.

Until now, banks frequently refused to refund funds stolen in phishing scams (where the victim inadvertently discloses their login details), citing a lack of care on the part of the customer. The situation has now changed.

Key conclusions of the judgement:

• Refund first, investigation later: In the event of an unauthorised transaction and a prompt request from the customer, the bank is obliged to make an immediate refund. Only after returning the money may the bank discuss the customer’s liability.
• The burden of proof lies with the bank: To reclaim the refund from the customer, it is up to the bank to prove beyond reasonable doubt the existence of fraud or gross negligence (the mere use of the victim’s data or means of authentication being insufficient).
• Strict exception: The bank may only refuse immediate reimbursement if it has reasonable grounds to suspect fraud on the part of the customer themselves, in which case it must report this in writing to the competent authority.

This decision removes the need for those affected to immediately resort to lengthy legal proceedings simply to recover what is rightfully theirs. Nevertheless, swift, resolute and legally sound assistance from the bank, as well as from the relevant judicial authorities, remains crucial from day one.

Please read the attached document from the Criminal, Misdemeanours and Compliance team at MFA Legal & Tech for a detailed analysis of the impact of this decision on legal and banking practice.