Judgment of the European Court of Justice of 15 October 2026 – C-70/25, Tukowiecka
Banks and other payment service providers may not refuse or delay the reimbursement of unauthorised payment transactions solely because they accuse the customer of gross negligence. The Court of Justice of the European Communities (ECJ) held that: Tukowiecka clear. The decision is relevant in particular for complaint management, fraud prevention and the compliance processes of payment service providers.
The case: phishing and an unauthorized transfer
In the main proceedings, a customer had become the victim of a phishing attack. The perpetrators got their access data through fake links in connection with an online marketplace or the supposed access to their bank account. A transfer of over 3,000 Polish Złoty (PLN) was carried out without their effective authorization.
The customer informed her bank and the police the following day. However, the bank refused a refund. She relied on the customer to act grossly negligently.
At the heart of the procedure was the question whether a payment service provider may initially refuse to refund an unauthorized payment transaction if it assumes that the customer has made fraud possible by gross negligence.
We're lawyers for Compliace. Use a first consultation.
The decision of the ECJ: refund in principle immediately
The ECJ relied on the reimbursement obligation under Article 73(1) of the Payment Services Directive (PSD2, Directive (EU) 2015/2366). After that, the payment service provider must refund an unauthorized payment transaction without delay. The refund must be made no later than the end of the business day following the determination or notification of the payment transaction.
The Directive provides for a narrowly limited exception: if the payment service provider has legitimate grounds for suspecting fraud, it must notify these reasons in writing to the competent national authority. The mere assertion that the customer acted grossly negligently is not sufficient to suspend the obligation to refund without further delay.
The ECJ thus strengthens the protection of customers whose accounts have been burdened by unauthorized payment transactions. The refund may not be made solely dependent on whether the payment service provider already accuses the customer of misconduct.
Reimbursement and liability shall be examined separately
For the legal and organisational evaluation, the distinction between the initially existing refund obligation and the subsequent liability issue is decisive.
Pursuant to Art. 74 para. 1 PSD2, a payment service user may, under certain conditions, be liable for all losses arising from an unauthorized payment transaction if he has deliberately or grossly negligently infringed certain obligations. However, it must be examined separately whether such liability actually exists.
From the possible accusation of gross negligence, it does not automatically follow that the bank may refuse the refund initially provided for. The refund and possible subsequent recovery should therefore be distinguished from each other in law.
For payment service providers, this means that you should not refuse a refund solely on the basis of an internal assessment of the customer's behaviour. Rather, they have to assess separately the legal conditions for reimbursement and for possible subsequent use of the customer.
Obligations to provide evidence and evidence
The obligations of payment service providers also play an important role. Pursuant to Article 72(2) PSD2, the mere recording of the use of a payment instrument is not sufficient in any case to prove that the payment transaction was authorised or that the payment user acted fraudulently or grossly negligently.
The payment service provider shall provide the relevant circumstances on the basis of appropriate evidence. A flat-rate reference to the use of correct access data or a technically properly recorded transaction shall not replace this verification.
For compliance practice, it follows that decisions to refuse reimbursement should be documented in a comprehensible manner and based on concrete facts.
Consequences for Compliance and Complaint Management
The decision has a practical impact on banks and other payment service providers. Existing procedures for the processing of phishing cases and unauthorized payment transactions should be checked to see whether they sufficiently separate the obligation to refund and the subsequent liability check.
The following measures are particularly relevant:
- Review refund processes: The legal deadlines and requirements for the reimbursement of unauthorised payment transactions must be reliably observed.
- Document grounds for refusal: The mere accusation of gross negligence should not serve as a flat-rate justification for a refused or delayed refund.
- Legally examine exceptional cases: Where the payment service provider relies on a suspicion of fraud, the legal requirements, including the necessary written notification to the competent national authority, shall be complied with.
- Secure evidence: Communication procedures, technical protocols and other relevant circumstances should be documented in such a way as to allow legal review.
- Adapt complaint management: Complaints about phishing and unauthorized payment transactions should be handled in accordance with a clear procedure that does not mix the reimbursement obligation with the final liability assessment.
- Training of staff: The responsible employees must be able to distinguish between the question of whether a payment transaction was authorised, the legal obligation to refund and a possible liability of the customer.
These measures help to reduce legal risks and make decisions vis-à-vis customers and supervisory authorities comprehensible.
By decision in the case Tukowiecka The ECJ makes it clear that the reimbursement of unauthorised payment transactions cannot be refused without further reference to a possible gross negligence of the customer. The statutory reimbursement obligations under PSD2 must be fulfilled first of all; a possible liability of the customer must be assessed separately.
Therefore, it is important for banks and payment service providers to clearly delimit reimbursement decisions, suspected fraud checks and subsequent liability or recovery procedures. We are experts and help you with this.
Reference: Case C-70/25 ECJ, judgment of 15 October 2026, Case C-70/25 Tukowiecka.
Note: This article is for general information and does not replace legal advice in individual cases.