ECJ on phishing: banks must refund account fraud first

What the ECJ ruled on 15 October

On 15 October 2026 the Court of Justice of the European Union ruled, in case C-70/25, that a bank may not refuse to refund an unauthorised payment merely because it accuses the customer of gross negligence. The case concerned a Polish bank customer who, after a fake sales link, entered her online-banking credentials on a convincing copy of her bank's site; the fraudster transferred around 700 euros to his own account. Under EU payment services law, for unauthorised payments the payment service provider must generally refund without delay first, and may reclaim the amount only afterwards, if the loss was caused by the customer's gross negligence. If you want to know who ultimately bears the loss in a disputed online payment, the logic is set out in our guide to chargebacks on cards and direct debits.

Who the ruling affects

The ruling affects, first, bank customers who fall victim to phishing: they get their money back faster, provided they report the incident in time. It affects banks and payment service providers too, which must now refund first and settle the negligence question later; only where there is a justified suspicion that the customer is committing fraud may they suspend the refund, and they must then notify the competent authority in writing. For merchants the ruling is a signal: the burden for unauthorised payments sits with whoever operates the systems, not with the person who was deceived — a line that also runs through chargeback rules on card payments.

Why this shifts fraud defence

The ruling reverses the order, and that is the core. Until now, institutions could delay a refund for a long time by alleging gross negligence, until the customer gave up or shrank from the cost risk of litigation. Now the rule is: money back first, dispute afterwards. That removes part of the fraud's effect, because the burden of going to court moves from the person who was deceived to the one who executed the payment.

For payments this does not mean technology becomes superfluous — the opposite. If institutions have to refund faster, every prevented phishing payment is worth hard cash. Strong customer authentication, payee verification and, above all, educating the people who release payments remain the real defence. The ruling governs who bears the loss; preventing it still has to happen beforehand. The Bundesbank's “Phishen Impossible” campaign targeted exactly this point.

What to do now

1. As a customer or business, report unauthorised debits to your payment service provider immediately — a timely report is the condition for the provisional refund.
2. Define within the company who is responsible for transfers and approvals, and allow no account change on verbal request by phone, email or messenger.
3. If a refund is refused, point to the ECJ line: refund first, negligence afterwards — and, in case of doubt, involve the consumer advice centre.