The Court of Justice of the European Union has ruled that banks must immediately reimburse clients for unauthorized payments, even if the customer clicked a phishing link. In a precedent-setting ruling on October 15, 2026, in Case C-70/25, the court stated a specific refund deadline: no later than the end of the following business day.
Precedent Involving a Phishing Link
The case before the European Union’s highest court originated from an individual dispute involving a woman selling personal items on an online marketplace. Posing as a prospective buyer, a scammer sent her a link to a fraudulent payment page where the seller entered her online banking username and password. Around 700 euros was promptly withdrawn from her account. The financial institution refused to reimburse the loss, accusing the client of gross negligence and failure to adhere to security protocols.
Judges in Luxembourg ruled that this practice is unlawful. A mere presumption that an account holder failed to safeguard credentials does not entitle a bank to delay reimbursement. The only exception applies if the bank’s security department suspects the applicant of fraud and has submitted a formal complaint to the police or financial regulators.
Refunds for Unauthorized Payments and Legal Disputes
The court drew a clear procedural distinction: a bank must first reimburse the funds before assessing the cardholder’s degree of fault. If the lender later proves in court that the client committed intentional fraud or acted with gross negligence, it retains the right to recover the paid amount through legal action. However, credit institutions are now strictly prohibited from using such suspicions as grounds for an initial refusal to pay.
The ruling has clear legal limits and applies exclusively to unauthorized transactions where the individual did not authenticate the transfer. If a person voluntarily sends money to scammers on their own initiative, the automatic refund procedure does not apply. Legal experts advise victims of account fraud to promptly document correspondence with scammers, retain formal bank rejections, and demand refunds citing this EU ruling.
NEWSROOM IN notes: The EU’s Second Payment Services Directive (PSD2) formally established banks’ obligation to promptly refund stolen deposits years ago, but credit institutions routinely relied on claims of “gross negligence” to issue blanket rejections. The October 15 ruling sets a binding standard for all national courts across the bloc.
