C-70/25: refund by tomorrow, prove negligence later

On 15 October 2026, the Court of Justice of the European Union (CJEU) ruled in case C-70/25 (Tukowiecka, ECLI:EU:C:2026:852) that banks must refund an unauthorised payment by the end of the next business day, even when they suspect the customer was grossly negligent. Negligence now decides who bears the loss, not whether the customer is refunded. The bank can reclaim the money only by proving intent or gross negligence, and by going to court if the customer refuses to repay. That is the rule under PSD2, which still applies today; the draft Payment Services Regulation (PSR) would change it once it takes effect.

Key takeaways

• Refund comes before blame. Suspected gross negligence no longer justifies refusing or delaying a refund for an unauthorised payment.
• The burden sits with the bank. To recover the loss, the bank must prove gross negligence, and if the customer refuses to repay, take them to court.
• Recovery is rarely worth it. In our assessment, litigating a €700 phishing loss costs more than the loss, so most of these refunds become permanent costs.
• Prevention is the remaining lever. The cheapest unauthorised fraud is the one stopped before a transaction is initiated.

What did the EU court decide in C-70/25?

The case started with a routine phishing attack in Poland. A customer selling an item online received a link from a supposed buyer, entered her banking credentials on a fake copy of her bank's website, and lost about €700 (PLN 3,000) to a transfer she never made. She reported it the next day (judgment, paragraphs 15 to 17). Her bank refused to refund her, arguing she had been grossly negligent.

The District Court in Koszalin asked the CJEU whether that refusal was allowed under the second Payment Services Directive (PSD2), the EU law that sets refund rules for payments across all member states. The court answered no, following the Advocate General's opinion of 5 March 2026 (judgment, paragraphs 27 and 52).

The judgment rests on three articles of PSD2:

• Article 73(1) requires the bank to refund an unauthorised payment immediately, and no later than the end of the next business day, provided the customer reports it without undue delay. The only exception is a reasonable suspicion that the customer committed fraud, reported in writing to the national authority (paragraphs 31 to 34).
• Article 74(1) decides who bears the final loss. A customer who breached their security obligations with intent or through gross negligence can be made to carry it (paragraphs 35 and 42).
• Article 72(2) puts the burden of proving that negligence on the bank. A transaction made with the customer's credentials does not, on its own, prove it (paragraph 40).

The court treats these as two separate stages: refund first, then a possible claim (paragraphs 38 to 42 and 46). Member states cannot add gross negligence as a second exception (paragraphs 34 and 49). The Court also rejected the argument that this undermines out-of-court dispute resolution (paragraphs 50 and 51).

What changes in how banks handle refunds?

Many EU banks used suspected negligence to decide, at the complaint stage, whether to refund at all. That decision point is gone.

Poland previews the enforcement path. On 4 September 2026, the Polish consumer authority UOKiK accepted commitment decisions from four banks (Alior Bank, mBank, BNP Paribas and Bank Millennium). They undertook to re-examine certain previously rejected claims and to stop treating successful authentication as proof of authorisation, and ten further proceedings against other banks remain open. C-70/25 settles the gross-negligence question at EU level. Where authentication ends and authorisation begins in social-engineering cases is still open. 

Worth knowing: The ruling does not settle whether a payment confirmed inside the banking app, or with a code entered without understanding that it approved a payment to a third party, counts as authorised. Poland’s UOKiK treats authentication and authorisation as different questions, and national courts will decide case by case, so the line between “unauthorised” and “authorised” will keep moving. In the Polish case itself, the fraudster used an SMS confirmation code obtained from the customer by deceit, yet the referring court treated the payment as unauthorised. The Court answered on that premise and did not rule on the classification.

Why does refund-first make prevention the only lever left?

Under refund-first, the loss lands on the bank's books the day after the customer reports it. Getting it back means proving gross negligence and, if the customer refuses to pay, going to court. In our assessment, for a typical phishing loss of a few hundred euros, that process often costs more than it recovers.

That leaves two places to act. After the fact, the bank can trace the funds and try to freeze them at the receiving account, which works only if the receiving bank spots the mule account quickly. Before the fact, the bank can stop the fraud before a transaction is initiated, so there is nothing to refund.

The scale makes the choice urgent. Payment fraud losses in the European Economic Area (EEA) reached €4.2 billion in 2024, up from €3.5 billion in 2023, according to the European Banking Authority (EBA) and European Central Bank (ECB).

Does the ruling cover scams the customer authorised?

Not as such. C-70/25 applies to unauthorised payments, where a criminal uses stolen credentials. A customer who is deceived into sending money themselves falls outside Article 73, although the boundary is contested (see the Polish example above). The gap is not small: manipulation of the payer accounted for more than half of the value of fraudulent credit transfers in the EEA in 2024 (EBA/ECB, 2025).

That gap is closing from other directions:

• EU Payment Services Regulation (PSR): the provisional agreement reached by the European Parliament and Council in November 2025 would make payment providers reimburse customers manipulated by a scammer impersonating their bank, and requires a check of the payee's name against the IBAN before every transfer. Formal adoption is still pending. The same text would also let a bank hold an unauthorised-payment refund for up to 15 business days where it has objectively justified reasons to suspect intent or gross negligence, so the next-business-day rule applies only until the regulation takes effect.
• UK PS25/5: the UK Payment Systems Regulator's consolidated policy statement (May 2025), which brings together its earlier policy statements including PS23/4, sets the mandatory APP fraud reimbursement requirement for Faster Payments and CHAPS. Sending and receiving firms split each claim 50/50, up to £85,000 per claim, and the customer is reimbursed within five business days unless the clock is stopped for defined reasons. In its first year (October 2024 to September 2025), UK payment firms reimbursed £173 million, 88% of in-scope losses by value, across about 188,000 in-scope claims.

The direction is the same in both markets: liability follows the bank that could have stopped the payment, whoever pressed the button.

How can banks stop these losses before a transaction is initiated?

Credential theft and manipulation leave different traces before the payment. When credentials are stolen, as in C-70/25, the account changes first: a login from a new device, a password reset or changed contact details, then a new payee or an international transfer from an account that never sends them. When a customer is manipulated into paying, the signals sit in the customer's behaviour: an unsettled call to the contact centre, repeated attempts to pay a new payee, a limit raised just before a large transfer. The first is the case C-70/25 covers; the second falls under the rules for authorised scams above, and the line between them is contested. Each signal looks harmless on its own and is spread across multiple channels and weeks, which is why tools that score one transaction or one session at a time see only part of the picture. Session-level and transaction-level controls remain useful, but they work best alongside an account-level view built over weeks and multiple channels.

In practice, stopping these losses before a transaction is initiated comes down to four disciplines:

• Treat the account as the unit of risk. Combine payee changes, contact-detail changes, login events and contact-centre notes into one view per customer, so a customer being set up for fraud can be contacted or protected before a payment is submitted.
• Watch the receiving side as closely as the sending side. Inbound payment analysis spots accounts that receive and quickly forward proceeds, which is where recovery succeeds or fails.
• Keep an auditable record of every decision. If a bank does pursue a customer for gross negligence, it needs evidence of what it saw and when, so log signals, alerts and actions with timestamps.
• Build on the existing stack. Feed signals from the fraud tools the bank already runs into the account view rather than replacing them, and decide where the data is processed and who operates it.

The timing matters. C-70/25 binds the courts of every member state that face the same question. PSD2 still governs refunds today, but once the PSR takes effect it is set to add impersonation liability and a 15-business-day hold for suspected gross negligence. Instant payments leave about 10 seconds to decide. A bank that acts only once the transaction exists has already incurred the refund.

What should fraud leaders do this quarter?

1. Rewrite complaint procedures so unauthorised payment refunds go out by the next business day, with negligence reviewed afterwards.
2. Quantify exposure on previously refused claims. The judgment interprets existing law and sets no cut-off date, so earlier refusals can be challenged, subject to national limitation periods, the 13-month notification limit and any final judgments. Ask Legal which claims remain open in each market.
3. Measure how many unauthorised fraud refunds you recovered in the last 12 months, and at what legal cost.
4. Map where pre-fraud signals live today, such as payee changes, contact-centre notes, and login events, and whether anyone sees them together.
5. Check inbound monitoring: how quickly can you identify a mule account receiving phishing proceeds?
6. Prepare for the PSR by testing which impersonation scams your current controls would have stopped.

Frequently asked questions

What is CJEU case C-70/25?

A judgment of 15 October 2026, in which the Court of Justice of the European Union ruled that banks must refund unauthorised payments within one business day, even if they suspect the customer was grossly negligent.

Can a bank still refuse a refund after C-70/25?

Only if it has reasonable grounds to suspect the customer committed fraud and reports them in writing to the national authority. Suspected negligence is not enough under PSD2, which still applies today. The draft PSR would allow a hold of up to 15 business days on suspected gross negligence once it takes effect.

Can the bank get the money back?

Yes, if it proves the customer acted intentionally or with gross negligence. If the customer refuses to repay, the bank must go to court.

Does the ruling apply to APP scams?

Not as such, but the boundary is contested. C-70/25 covers unauthorised payments. Where a customer entered a code without understanding that it approved a payment to a third party, Poland’s UOKiK treats authentication and authorisation as different questions, so some of these cases can still count as unauthorised. Authorised scams fall under national rules today and, for bank impersonation, under the upcoming EU Payment Services Regulation.

Does the ruling apply outside Poland?

Yes. CJEU rulings on EU directives set the authoritative interpretation of the directive in every member state, including Spain, Portugal, and Germany. The practical impact varies: France, for example, already requires immediate refunds under national law.

Want to compare how fraud platforms handle pre-transaction detection? Download the Buyer's guide: How to Evaluate an APP Fraud Prevention Platform.