When a customer falls victim to phishing and an unauthorised payment is made from their account, can a bank refuse a refund solely because it considers the customer to have acted with gross negligence?
In Case C-70/25, Tukowiecka, decided on 15 October 2026, the CJEU clarified that a payment service provider cannot refuse an immediate refund solely because the customer’s conduct may amount to gross negligence. The judgment draws an important distinction between the obligation to refund an unauthorised transaction and the question of who should ultimately bear the loss.
The case concerned a customer of a Polish bank who was selling an item through an online platform. A prospective buyer sent her a fraudulent link, which appeared to be part of the platform’s process for confirming the sale. The link redirected her to a website imitating her bank’s website, where she entered her online banking credentials.
The fraudster used those details and, as a result of the deception, obtained an SMS confirmation code to transfer PLN 3,000 (equivalent to approximately €705) from her account. The customer realised the following day that she had been defrauded and notified both the bank and the police.
The bank refused to refund the amount, arguing that the customer had acted with gross negligence by failing to safeguard her security credentials. The customer brought proceedings before the District Court in Koszalin, which asked the CJEU whether the bank could refuse an immediate refund on that basis.
The case concerned Articles 73 and 74 of Directive (EU) 2015/2366 on payment services in the internal market (“PSD2”), which deal with the refund of unauthorised transactions and the customer’s potential liability for the resulting loss.
Under Article 69, customers must comply with the conditions governing their payment instruments and take all reasonable steps to keep their personalised security credentials safe. If they fail to do so intentionally or with gross negligence, and that failure causes the loss payment service providers under Article 74(1) may make them liable for the full amount of the loss. This is subject to the other protections in Article 74.
Article 73(1), however, requires the payment service provider to refund an unauthorised payment transaction immediately and, at the latest, by the end of the following business day after noting or being notified of the unauthorised transaction. This is subject to Article 71, which requires the customer to notify the provider without undue delay on becoming aware of the transaction and no later than 13 months after the debit.
Article 73(1) also provides a specific exception where the provider has reasonable grounds to suspect fraud by the customer and communicates those grounds in writing to the competent national authority.
The central question was whether a customer’s potential liability under Article 74 allowed the bank to withhold the immediate refund required by Article 73.
The CJEU held that a payment service provider cannot withhold an immediate refund simply because it considers the customer to have acted with gross negligence.
The Court interpreted Articles 73 and 74 as governing two separate questions:
Gross negligence is therefore not an additional exception to the refund obligation under Article 73.
This distinction is important because allowing banks to refuse refunds based on alleged customer negligence would weaken the protection intended by PSD2. Customers could otherwise be forced to bring legal proceedings, at their own expense, simply to obtain a refund.
That does not mean, however, that customers are automatically entitled to keep the refunded amount regardless of their conduct. As the Court explained, a provider may subsequently seek reimbursement through the appropriate legal remedies where the conditions under Article 74(1) are satisfied. To recover the loss, the provider must establish that the loss resulted from the customer acting fraudulently or failing, with intent or gross negligence, to fulfil one or more of their obligations under Article 69.
Importantly, the customer’s potential liability must be supported by evidence. Under Article 72(2) PSD2, where a customer denies having authorised an execution transaction, the use of a payment instrument does not, in itself, prove that a transaction was authorised or that the customer acted fraudulently or intentionally or with gross negligence failed to comply with their obligations under Article 69. The payment service provider must provide supporting evidence to establish fraud or gross negligence. The Court did not decide whether the customer in this case was grossly negligent; its ruling concerned the provider’s immediate refund obligation. Whether the customer’s conduct meets the threshold for gross negligence must be assessed on the evidence.
For banks and other payment service providers, the judgment reinforces the need to distinguish between an immediate refund obligation and any subsequent attempt to recover the loss from the customer. An allegation of negligence cannot, on its own, justify withholding a refund. If a provider later seeks reimbursement, it must support its position with evidence and establish that the conditions under Article 74(1) have been met.
For customers, the judgment confirms that falling for a phishing scam does not automatically remove their right to an immediate refund of an unauthorised payment, subject to the requirements above. Their conduct may still affect who ultimately bears the loss, but it does not, by itself, allow the provider to avoid its initial obligation.
Tukowiecka clarifies that a payment service provider cannot withhold an immediate refund simply because it considers the customer to have acted with gross negligence. Under PSD2, the obligation to refund an unauthorised transaction is separate from the question of who ultimately bears the loss. While the provider must fulfil its refund obligation, it may subsequently seek to recover the amount from the customer if the legal requirements are met and the customer’s liability is supported by evidence. The judgment thus reinforces the protection afforded to payment service users while preserving the possibility of holding customers liable where justified.
If adopted in the form of the Council’s first-reading texts of 21 October 2026, PSD3 and the PSR would qualify the future operation of the refund-first approach in Tukowiecka, without altering its interpretation of PSD2. Based on its latest proposed text, the PSR would permit a provider to defer an immediate refund on objectively justified suspicion of an intentional or grossly negligent breach of the payer’s Article 53 obligations, with those grounds communicated to the payer in writing.
Within 15 business days of noting or being notified of the transaction, the provider would have to refund or justify refusal and identify redress bodies. Article 56(2)–(3) would retain the provider’s evidential burden and require it to invite and consider the customer’s account of events. Once applicable, the PSR would therefore expressly introduce the gross-negligence exception absent from PSD2 with the Tukowiecka remaining relevant to cases governed by PSD2.
For more information on payment-services related obligations, as well as assistance on transition from the current PSD2 regime to the new PSD3/PSR requirements, kindly contact us at info@gtg.com.mt
Authors: Dr Cherise Abela Grech & Dr Mattea Pullicino