The CJEU judgment of 15 October 2026 in Case C‑70/25, Tukowiecka, clearly separates the obligation to promptly refund funds from the subsequent determination of who ultimately bears the loss. A bank cannot withhold a refund simply because it accuses the customer of gross negligence.
The case involved a Polish bank customer who fell victim to a phishing scam. The scammer, posing as someone interested in purchasing an item listed on an online platform, sent her a fake link. The customer entered her online banking details on the fake website, and approximately €700 was then transferred from her account. The bank refused to refund the money, believing that the customer had grossly negligently failed to secure her data.
The Court answered the Polish court's question clearly. A suspicion of gross negligence on the part of the customer does not, in itself, allow a bank to refuse to immediately refund the money for an unauthorized transaction.
The principle arising from payment services regulations is that the amount of an unauthorized transaction must be refunded immediately, no later than the end of the next business day after the transaction is confirmed or a report is received. This is conditional upon the customer immediately notifying the bank.
The CJEU identified one exception to the obligation to repay immediately. If the bank has reasonable grounds to suspect that the customer has committed fraud and notifies the competent national authority in writing of these grounds, it may withhold the repayment. Merely alleging that the customer failed to exercise due care or acted with gross negligence is not sufficient to trigger this exception.
Return now, liability later
The CJEU ruling does not mean that the customer will always ultimately keep the refunded funds. The Court distinguished between two issues: the bank's obligation to promptly refund the funds and the final settlement of losses.
After the refund is made, the bank may seek compensation from the customer if it can prove that the customer intentionally or through gross negligence breached its obligations, in particular the obligation to protect personalised authentication data. However, the burden of proving gross negligence rests with the payment service provider.
In practice, this means that the bank should not make its reimbursement obligation conditional on the completion of an internal complaints procedure or on its own assessment of the customer's behavior. Instead, it may later investigate the circumstances of the incident and, if the conditions are met, pursue reimbursement for the loss incurred.
The ruling requires a review of banks' processes for handling reports of unauthorized transactions. In particular, it's worth checking whether the procedures:
- ensure reimbursement within the time limit prescribed by law, without automatic suspension due to allegations of gross negligence;
- distinguish between reporting suspected fraud on the part of the customer and a suspicion that the customer has acted with gross negligence;
- provide for written notification to the competent authority if the bank wishes to use an exception based on reasonable suspicion of customer fraud;
- allow you to collect and preserve the evidence needed to later prove a breach of duty by the client;
- clearly inform complaint handling, security and fraud prevention staff about the separate stages: reimbursement and determination of final responsibility.
Complaint response templates are also important. Refusal of an immediate refund based solely on the assertion that the customer "disclosed data" or "failed to exercise due care" may not meet the standard set by the CJEU. However, each case must be assessed taking into account the type of transaction, the method of authorization, the customer's report, and the available evidence.
A customer who notices a transaction they did not order should immediately notify the bank and retain proof of the notification. It's also worth securing messages, links, screenshots, call history, and correspondence with the bank. If the bank refuses a refund based solely on gross negligence, the C‑70/25 judgment may be a significant argument in a complaint or legal dispute.
However, it does not automatically mean that every transaction reported as unauthorized must be refunded in every situation. The key factors are the transaction's classification, the timing of the report, and whether a statutory exception related to reasonable suspicion of customer fraud applies.
The Tukowiecka ruling reinforces the practical importance of the principle of prompt repayment. A bank cannot treat an allegation of gross negligence as grounds for withholding a refund. It should first fulfill its obligation to repay the funds, and then—if it has grounds and can demonstrate them—seek compensation from the customer.
This article is for informational purposes only and does not constitute legal advice
Legal status as of October 15 , 2026
Author / Editor of the series:
