Major EU Court Ruling: Banks Must Refund Phishing Victims Within One Business Day.
What Has the European Court Decided?
Under European payment services legislation, banks must refund unauthorised transactions without undue delay and no later than the end of the following business day after becoming aware of the transaction or receiving notification.
Importantly, a bank cannot simply refuse this initial refund because it believes the customer was careless or failed to protect their banking information.
There is a limited exception when the bank has reasonable grounds to suspect fraud by the customer and reports those suspicions in writing to the relevant national authority.
This ruling clarifies an important principle: banks must refund first and investigate potential customer negligence afterwards.
The Case That Changed Everything
The judgment followed a phishing incident involving a customer of a Polish bank.
The victim had advertised an item for sale online. A fraudster pretending to be an interested buyer sent a link that appeared to be part of the purchasing process.
The link directed the victim to a fraudulent website resembling her bank's official website. After entering her banking credentials, approximately €700 was stolen from her account.
When she reported the incident, her bank refused reimbursement, arguing that she had acted with gross negligence.
The dispute eventually reached the Court of Justice of the European Union, which clarified the bank's obligation to provide an immediate refund.
Does This Mean Every Victim Can Keep the Money?
Not necessarily.
The ruling does not eliminate customers' responsibility to protect their banking credentials.
If a bank subsequently establishes that a customer deliberately or through gross negligence failed to meet their security obligations, it may seek to recover the refunded money.
However, the bank must establish the legal grounds for that recovery. It cannot use an allegation of gross negligence alone to avoid the initial refund obligation.
This distinction is particularly important because it prevents customers from automatically bearing the financial burden while disputes remain unresolved.
What Does This Mean for Belgian and European Consumers?
The judgment provides important clarification for banks and consumers throughout the European Union.
Belgian consumer organisation Testaankoop welcomed the decision, arguing that banks have not always respected the existing reimbursement rules.
For victims of phishing, the ruling strengthens their position when challenging a bank's refusal to refund an unauthorised transaction.
However, consumers should understand that not every scam-related payment is necessarily an unauthorised transaction. Cases involving payments deliberately authorised by the customer may raise different legal questions.
What Should You Do If You Become a Victim of Phishing?
If you discover suspicious activity on your bank account:
- Contact your bank immediately and report the suspected fraud.
- Block affected bank cards, accounts or digital banking access where necessary.
- Preserve suspicious messages, emails, links and transaction records.
- Submit a formal reimbursement request for any unauthorised transactions.
- If your bank refuses to cooperate, consider contacting the relevant financial ombudsman or consumer protection organisation.
Acting quickly remains essential, even with stronger consumer protections.
A Turning Point for Digital Banking Security
Phishing attacks have become increasingly sophisticated. Fraudulent websites, convincing emails, fake customer service messages and impersonation techniques can make scams difficult to recognise.
The European Court's decision reinforces the importance of consumer protection in an increasingly digital financial system.
Banks remain responsible for complying with payment services legislation, while customers must continue taking reasonable precautions to protect their accounts.
The message from Europe's highest court is clear: an allegation of customer negligence does not allow a bank to postpone its legal obligation to refund an unauthorised payment.
This ruling marks an important development in the relationship between financial institutions and their customers, potentially making the process of recovering stolen funds faster and fairer.
Sources:
- Court of Justice of the European Union, Case C-70/25, Tukowiecka, judgment of October 15, 2026.
- Testaankoop, press release, October 15, 2026.
- HLN, reporting on the European Court's ruling, October 15, 2026.
Disclaimer: This article provides general information and does not constitute individual legal advice.
#Phishing #BankingSecurity #ConsumerRights #EuropeanUnion #Cybersecurity #FinancialProtection #DigitalBanking #OnlineFraud #BusiMatch
