Banks Must Refund Unauthorised Payments, EU Court Rules
The Court of Justice of the European Union says customer negligence alone does not let banks withhold refunds for unauthorised transactions.
Updated on Nov. 4, 2026 in Financial Crime
Live Poll
Should banks have to refund scam victims quickly, even if they were careless?
The Court of Justice of the European Union ruled on 15 October that banks must generally refund customers for unauthorised transactions, even where negligence is alleged. The ruling interprets the EU Payment Services Directive (PSD2) and follows a case in which a Polish woman lost approximately €700 in an online banking scam.
Why it matters
The decision places the burden of proving gross negligence on financial institutions and limits when banks can recover funds from customers. It affects how banking customers across the European Union can seek reimbursement after fraud.
The woman lost approximately €700 after a scammer directed her to a fraudulent website resembling her bank's online banking page, and the bank refused a refund citing gross negligence. Banks must provisionally reimburse customers for allegedly unauthorised transactions by the end of the following business day, and unauthorised transactions must generally be reported within 13 months.
The players
Court of Justice of the European Union
The EU's highest court, responsible for interpreting European Union law and ensuring its uniform application across member states.
Banco de Portugal
Portugal's central bank, which supervises the country's banking sector and has published guidance on customer reimbursement obligations.
The details
A scammer posing as a buyer on an internet marketplace sent the woman a link to confirm a purchase, which led to a fraudulent site designed to look like her bank's online banking page. The bank's refusal rested on claims that she had been grossly negligent in protecting her security credentials, a position the ruling now constrains.
Timeline
15 October 2026: Court of Justice of the European Union delivers the ruling on bank refund obligations.
End of the following business day: Deadline for banks to provisionally refund customers for alleged unauthorised transactions.
Within 13 months: Generally allowed window for reporting unauthorised transactions.
Legal Context
The ruling interprets PSD2, the EU directive that sets refund and liability rules for electronic payments across member states. By placing the burden of proving gross negligence on banks, it narrows the grounds on which institutions can deny reimbursement under that framework.
Customers whose bank refuses a refund for an unauthorised payment may now be able to dispute the denial, since banks must generally reimburse by the end of the following business day. Individuals are still responsible for losses up to €50 and should report unauthorised transactions within 13 months.
The takeaway
Report unauthorised transactions to your bank promptly and keep records of the communication, since reporting windows are limited and banks bear the initial burden of reimbursing you. Be cautious with links that claim to confirm purchases or require logging in to banking pages.
Further reading
Explore more on Financial Crime to see how fraud cases like this one are handled across banks and courts.
Source note: This article includes information reported by The Portugal News.
Live Poll
Should banks have to refund scam victims quickly, even if they were careless?
