In Case C‑70/25 Tukowiecka, the Court of Justice of the European Union held that a payment service provider cannot refuse to make an immediate refund of an unauthorised payment transaction simply because it believes the customer acted with gross negligence. Instead, the provider must first refund the customer and then, if appropriate, pursue recovery from the customer afterwards.
The facts
The case arose in the context of a phishing scam. A customer of a Polish bank was selling an item online when a fraudster sent a fake link purportedly connected with the sale. After following the link and entering her online banking credentials into a spoof website, the fraudster used those credentials to transfer approximately €700 from her account.
The customer notified the bank the following day, but the bank refused reimbursement. It argued that the customer had acted with gross negligence by failing to protect her personalised security credentials and had therefore enabled the fraud to occur.
The Polish court referred questions to the CJEU about how to interpret the refund provisions in the revised Payment Services Directive (PSD2).
The Court's ruling
The Court concluded that where an unauthorised payment transaction has occurred, the payment service provider is generally required to refund the amount immediately and, in any event, no later than the end of the following business day after becoming aware of, or being notified of, the transaction, provided that the customer reports the transaction without undue delay.
There is only one exception. A provider may withhold the refund where it has reasonable grounds to suspect customer fraud and communicates those grounds to the relevant national authority.
Importantly, the Court held that a provider's belief that the customer acted with gross negligence does not fall within that exception and therefore does not justify refusing an immediate refund.
Refund first, argue later
The key point in the judgment is the distinction between:
- the obligation to refund an unauthorised payment transaction; and
- the separate question of who should ultimately bear the loss.
According to the Court, PSD2 establishes a two-stage process. First, the provider must make the refund. Second, it may seek reimbursement from the customer if it can establish that the customer intentionally or, with gross negligence, breached obligations relating to the protection of personalised security credentials. The burden of proving gross negligence rests on the payment service provider.
Why this matters for UK financial services firms
Although the decision interprets EU law, it addresses provisions that have close counterparts in the UK's payment services regime. The judgment is therefore likely to be scrutinised by UK banks, payment institutions, e-money firms and their advisers when considering the allocation of losses arising from authorised push payment fraud and other phishing-related incidents.
The judgment reinforces a consumer-protection-oriented approach to unauthorised transactions. It suggests that reimbursement mechanisms should operate quickly, without requiring customers to engage in potentially lengthy disputes about negligence before receiving redress. For firms, the practical consequence is that investigations into customer conduct may not justify delaying reimbursement where an unauthorised payment transaction has been established. Instead, providers may need to focus on post-refund recovery strategies supported by robust evidence of gross negligence.
The ruling also highlights the evidential challenges involved in establishing gross negligence. The Court expressly emphasised that it is for the provider to prove the customer's failure to comply with their obligations and the requisite level of culpability.
Looking ahead
The decision shows the CJEU interpreting PSD2 in a way that prioritises effective consumer protection and the practical effectiveness of statutory refund rights. The Court considered that allowing providers to withhold reimbursement based on alleged gross negligence would undermine the immediate refund mechanism and force customers to commence proceedings to vindicate their rights.
Financial institutions should therefore review their fraud and reimbursement procedures carefully. Where unauthorised payments are reported, the distinction between immediate refund obligations and the ultimate allocation of loss may become increasingly important in both litigation and complaints handling.
