The ruling affects all bank customers in the European Union who encounter unauthorised transactions on their accounts. Until now, credit institutions, as consumer advocates note, have done exactly the opposite. They first examined the customer’s liability and only then decided whether to refund the money, supposedly forgetting that every account carries insurance for such cases.
What the case was about
In Poland, a bank customer fell victim to phishing. She wanted to sell something on an online platform, and a purported buyer sent her a fraudulent link. The woman followed it to a website that looked like the page of her bank and entered her online banking login details there. The fraudster stole 700 euros from her account.
The next day the customer reported this to the bank. The bank refused to refund the amount of the unauthorised transaction and accused the woman of gross negligence. The customer turned to a Polish court, which referred the matter to the Court of Justice of the European Union. The dispute concerned who should bear the 700-euro loss while it had not been established how carefully the customer had behaved.
What exactly the EU Court decided
In the case of an unauthorised transaction, the payment service provider is, as a rule, obliged to refund the amount immediately, at the latest by the end of the next business day. The period runs from the moment the provider learned of the unlawful transaction or received a report of it. Customers, for their part, must notify the bank of such transactions on their account without delay.
Are there exceptions?
An exception is possible in only one case. If there are grounds to suspect that the customer is engaged in fraud himself, and the bank has informed the competent national authority of this in writing, it need not refund the money immediately.
The bank’s view that the customer made the transaction possible through gross negligence does not give it the right to refuse a refund. In other words, the bank’s conviction that the customer was negligent is not sufficient grounds for refusal. What is required is a suspicion of fraud on the part of the customer himself and a written report to the competent authority.
What options remain open to the bank
Even if the bank is obliged to refund the money, at the second stage it may, where necessary, demand that the customer compensate the losses incurred. To do so, the bank must prove that the customer intentionally or through gross negligence breached his obligations, for example by failing to protect his data from unauthorised access. It is the bank that must prove gross negligence. The procedure is as follows. First the bank returns the money, and then, if it considers the customer at fault, it demands compensation for the losses and proves his guilt.
How the banking sector reacted
The National Association of German Cooperative Banks (BVR) points out that in Germany, under the case law of the Federal Court of Justice (BGH), banks have until now been recognised as entitled to set against a customer’s claim for a refund their own claim for damages. The basis is the customer’s gross negligence in breaching the duty of care. The association refers to the BGH ruling of 22 July 2025 (case XI ZR 107/24).
In the association’s view, how the EU Court‘s ruling will affect case law in Germany remains to be analysed. The banking association stressed that the court’s conclusion on the credit institution’s right to demand compensation from the customer for losses arising from his gross negligence is important.
How consumer advocates assess the ruling
The Bavarian Consumer Advice Centre noted that the EU Court’s ruling strengthens consumer rights. The rule that now applies to banks is: “First refund, then examine liability!” Until now, banking institutions have done the opposite. As a result, victims of fraud often had to expend a great deal of effort and in the end settle for a compromise or abandon their claim altogether because of the risk of legal costs.
In the centre’s assessment, victims will now far less often have to sue a bank to recover their money. Yes, and it is time for banks to get on with protecting customers from fraudsters rather than shifting their shortcomings in banking security onto what are often unprotected sections of society.
What those affected by account fraud should do
The Bavarian Consumer Advice Centre recommended that, immediately after discovering the fraud, one should block the possibility of online payments, the compromised card and, if necessary, electronic wallets. Every affected transaction should be explicitly described to the bank as “unauthorised” and a refund demanded.
It is recommended to keep the following as evidence:
- phishing messages and links;
- screenshots;
- the display of TAN codes;
- call logs;
- account statements;
- correspondence with the bank.
In addition, a criminal complaint should be filed with the police.
How many people become victims of cybercrime
According to data from the Federal Office for Information Security (BSI) for May 2026, over the past twelve months roughly one in ten residents of Germany, or more precisely 11 per cent, fell victim to internet crime. Most often people encountered fraud when shopping and banking online, unauthorised access to accounts, and phishing. The question of why, in the decades that these fraud schemes have existed, banks have still not found solutions to ensure the security of their customers remains open.
What next
The dispute between the customer and her bank will now be heard by a Polish court. In doing so, it is obliged to follow the EU Court’s ruling.
This court decision is important for all bank customers in the countries of the European Union. It establishes the rule that a bank must return stolen money immediately after being notified of the fraud, while the question of the customer’s fault may be raised by the bank later, but only on the basis of evidence of gross negligence or fraud on the part of the customer. How the EU Court’s ruling will affect banking practice in Germany is as yet unclear. But one thing is clear: no associations or collusion of banks will be able to undermine the ruling of the European court in the foreseeable future, and so they will have to begin thinking about effective methods of combating fraud. On the other hand, given that banks in Germany, too, now hire staff not for professional qualities but according to gender and other quotas, one can only hope that effective solutions will be found.
The latest decisions of such “specialists” consisted of large sums thrown away on an advertising campaign about phishing. That is, once again, instead of seeking technical solutions on the bank’s side, bank security staff shifted responsibility onto their customers.
Sources: AFP and dpa
