CJEU on phishing: alleged gross negligence alone does not justify refusing a refund

What the CJEU actually decided

A consumer wanted to sell goods through a sales platform. A purported buyer sent a link to a fake banking website. Using captured login details and a fraudulently obtained SMS code, the perpetrator transferred PLN 3,000. The customer discovered this the next day and notified her bank and the police. Her bank refused a refund on the grounds of alleged gross negligence.

The CJEU separates two questions: must the bank refund first, and who ultimately bears the loss? Under its judgment of 15 October 2026, C-70/25, an allegation of gross negligence cannot suspend the first obligation. Paragraphs 31 to 42 and 46 to 52 are particularly relevant.

The proceedings originated in Poland. The CJEU answers a preliminary question on the Payment Services Directive, PSD2. It does not itself finally award a sum to the customer; the national court decides the underlying proceedings.

Refund first does not mean no ultimate liability

For an unauthorised payment, Article 73(1) PSD2 generally requires an immediate refund, no later than the end of the following business day after the bank becomes aware of it or receives notification. The bank cannot first leave the entire gross-negligence dispute unresolved at the customer’s expense and refuse the refund on that basis.

A specific exception concerns justified suspicion of fraudulent conduct by the customer, with the reasons communicated in writing to the competent national authority. This does not mean merely that an outside perpetrator has committed a phishing fraud, as paragraph 39 makes clear.

After the refund, however, the bank may seek compensation if the statutory requirements are met, for example where the customer caused the loss through a grossly negligent breach of security obligations. The bank must prove gross negligence. The judgment expressly leaves this potential ultimate liability intact.

What does this mean for bank customers in Germany?

Our assessment: the judgment is also relevant to German cases because sections 675u, 675v and 675w of the German Civil Code implement the EU rules. Section 675u governs refunds, section 675v possible compensation claims by the bank, and section 675w evidence. A refusal letter relying solely on alleged gross negligence should therefore be reassessed in light of the judgment.

The CJEU emphasises that the current PSD2 rules differ from the previous Payment Services Directive. Older decisions therefore cannot be applied without checking the law then in force. C-70/25 does not establish that banks must pay in every fraud case.

Unauthorised payment or a transfer you made yourself?

The judgment concerns unauthorised payments. Authorisation depends on consent to the particular transaction; section 675j of the German Civil Code is relevant in Germany. A person who validly approved a specific transfer cannot automatically rely on the same refund rule merely because they were deceived.

It therefore matters what was actually displayed and approved: a payment with an amount and payee, registration of a new device, or something else. Under section 675w, a TAN or app confirmation does not necessarily prove authorisation or gross negligence on its own. The technical sequence and further evidence remain decisive.

What to do immediately after phishing

Contact the bank using a reliable telephone number you have obtained independently. Have affected access credentials and payment instruments blocked, report the disputed transactions and ask about recalling the transfer. A recall does not guarantee repayment. Keep confirmation that your notification was received.

Section 676b requires notification without undue delay after discovery. The generally applicable maximum period of 13 months after the debit is not a waiting period; its start also depends on the legally required information. Reporting the matter to the police does not replace notifying the bank.

These records help when a refund is refused

Record what happened honestly and as soon as possible. Identify gaps in your memory instead of presenting assumptions as facts. Never send PINs, TANs or passwords. The following are particularly useful for a review:

• Bank statements showing the date, amount and payee of the disputed payments.
• Text messages, emails, call logs and any screenshots of approval screens.
• The times of discovery, notification to the bank and blocking, together with reference numbers.
• The full refusal letter and previous correspondence with the bank.

If the bank refuses: what we examine

DR. SARAFI Rechtsanwälte reviews the refund claim, the evidence and possible counterclaims by the bank. This includes the specific approval, security requirements, warnings and notification to the bank. Whether an out-of-court demand or court proceedings make sense also depends on the amount lost, costs and available evidence.

The judgment improves the position in cases of unauthorised payments. It neither replaces an assessment of your individual case nor guarantees that you may ultimately retain the money.