.jpg)
A new ruling from the Court of Justice of the European Union clarifies banks' obligations when phishing leads to unauthorized payments. Even if a customer has acted with gross negligence, banks cannot delay reimbursement on that basis. To recover the loss afterward, they must prove the customer's fraud or gross negligence, making supporting evidence increasingly important.
In a recent case involving a Polish bank, a customer received a fraudulent link that led to a fake banking website. After she entered her online banking credentials, the attacker used those to transfer approximately €700 from her account.
The bank refused to reimburse the customer, arguing that she had failed to protect her security credentials. The dispute eventually reached the Court of Justice of the European Union (CJEU).
What the EU Court Ruled
On 15 October 2026, the CJEU ruled in Case C-70/25 that a payment service provider cannot refuse an immediate refund of an unauthorized transaction simply because it considers the customer grossly negligent.
Under PSD2, banks must generally refund unauthorized payments immediately, and no later than the end of the following business day after becoming aware of the transaction, subject to the applicable notification requirements.
The exception applies when the bank has reasonable grounds to suspect fraud committed by the customer and reports those grounds in writing to the competent national authority.
Importantly, immediate reimbursement does not necessarily mean the bank must ultimately bear the loss. A bank may subsequently seek reimbursement from the customer if it can prove that the loss resulted from an intentional or grossly negligent breach of the customer's obligations. Demonstrating that the bank had implemented state-of-the-art solutions to detect such fraud may also support its position when liability is disputed.
What This Means for Banks
The ruling reinforces an important distinction between refund obligations and the final allocation of liability.
Under PSD2, a record of successful authentication does not, by itself, necessarily prove that the customer authorized a payment or acted with gross negligence.
Banks cannot rely solely on suspected customer negligence to withhold an initial refund. They should be able to demonstrate the security measures they have implemented to mitigate these risks, while retaining evidence that can support fraud investigations and help establish customer liability.
The decision specifically concerns unauthorized transactions. It should not be interpreted as establishing the same refund obligations for every type of scam, including cases where customers knowingly authorize a payment after being deceived.
Why Preventing Fraud Matters More Than Ever
The financial and operational consequences of unauthorized payments make fraud prevention particularly important.
The phishing attack behind this ruling illustrates the risks of relying on credentials that attackers can steal or misuse, and why banks need protection that goes beyond the initial authentication step.
Banks need to implement security controls that help prevent unauthorized access, protect payment approvals, and identify suspicious activity throughout the digital banking journey.
Several capabilities play an important role:
- Mobile threat detection and risk signals help identify compromised devices, malicious activity, and suspicious conditions that may require additional protection, such as detecting an active voice call during authentication.
- Device-bound, phishing-resistant authentication reduces reliance on transferable credentials and helps prevent attackers from misusing stolen login details.
- Secure transaction signing cryptographically links payment approvals to specific transaction details, including the amount and recipient.
These measures cannot eliminate every type of fraud, but they can make unauthorized access and payment manipulation significantly harder. They also help banks document their fraud prevention efforts and gather valuable evidence when investigating disputed transactions.
Fraud Prevention as Evidence in Liability Disputes
The EU Court's decision reinforces why mobile application security and fraud prevention are no longer nice-to-have features for banks. They are essential for banks seeking to limit the financial consequences of fraud and demonstrate the measures they have taken to protect customers.
The Wultra Authentication Platform helps banks and fintechs protect digital interactions with security that adapts to risk and context, combining fraud prevention and mobile in-app security across every step of the digital banking journey with real-time customer warnings and step-up authentication when needed.
With Mobile In-App Protection, banks can detect mobile threats and use device and application risk signals to support fraud detection and risk-based security decisions. Combined with Mobile-First Authentication, banks can implement intelligent customer journeys that warn customers based on their risk exposure, apply step-up authentication when necessary, and gather evidence of the security measures taken to protect transactions.
The CJEU ruling does not change the role of these controls or remove banks' refund obligations. It does, however, reinforce the importance of implementing state-of-the-art fraud prevention solutions and gathering evidence that may strengthen banks' position in liability disputes.
Frequently asked questions
Does the ruling mean banks must refund every phishing-related payment?
No. The ruling concerns unauthorized transactions. Banks must generally refund these payments immediately, even when customer gross negligence is suspected. Payments that customers authorize after being deceived fall under different liability considerations.
Can banks recover losses if a customer was grossly negligent?
Yes. After making the initial refund, a bank may seek to recover the loss if it can prove that the customer intentionally or through gross negligence breached their security obligations.
Does successful authentication prove that a payment was authorized?
No. Under PSD2, successful authentication alone does not necessarily prove that the customer authorized the transaction or acted with gross negligence. Banks must provide supporting evidence when seeking to establish customer liability.
.webp)
