A European Union court has ruled that banks must generally reimburse unauthorised payments by the next business day, even where they suspect customers mishandled their credentials, leaving disputes over negligence for later.
A ruling from the Court of Justice of the European Union has strengthened the hand of bank customers who lose money to phishing, making clear that lenders must repay unauthorised payments quickly even when they suspect the account holder was careless with login details. According to the judgment delivered on 15 October 2026, the money should generally be restored by the end of the next business day after the bank is notified, with any dispute over fault dealt with afterwards.
The case arose in Poland after a woman placed an item for sale online and received a link from someone posing as a buyer. The link led her to a fake banking page that closely resembled her own bank’s website, and she entered her online banking credentials there. The fraudster then used those details to gain access to her account and move about 700 euro to another account, in what is a classic phishing attack: a scam that uses counterfeit messages or websites to trick victims into revealing passwords, security codes and other sensitive information.
When the customer reported the theft the following day, the bank refused to reimburse her, arguing that she had acted with gross negligence by failing to protect her credentials. A Polish court referred the dispute to the Luxembourg-based court for guidance on how to interpret the EU’s payment-services rules, including the provisions of the PSD2 directive dealing with unauthorised transactions and liability.
The judges said the bank cannot delay repayment simply because it believes the customer was imprudent. They drew a clear line between the immediate duty to refund an unauthorised payment and the separate question of who should bear the loss in the end. In practice, that means the bank must return the funds first and may later try to recover them if it can prove the customer acted fraudulently or with gross negligence. The court also said that a payment authenticated in a technical sense does not automatically mean it was authorised by the account holder.
There is one narrow exception. If a bank has reasonable grounds to suspect the customer is attempting to commit fraud, it may withhold repayment, but it must inform the relevant national authority of its concerns. Otherwise, the judgment says, allowing banks to refuse immediate reimbursement based only on alleged negligence would strip away the protection intended by EU law and force victims into lengthy disputes before they see their money again.
The ruling also has practical significance for Italy, where the EU’s payment-services regime has already been incorporated into domestic law through changes to Legislative Decree 11/2010. Article 11 covers reimbursement for unauthorised operations, while Articles 10 and 12 deal with proof of authentication and the payer’s liability. The decision does not create a new right so much as sharpen an existing one, and it is likely to influence how Italian courts and banks handle contested transactions.
That matters because not every online scam fits the same legal pattern. The court’s ruling concerns payments carried out by a fraudster using stolen credentials. It is different where a victim is tricked into personally authorising a transfer, such as sending money to a supposed safe account or approving a payment on a smartphone without realising the true destination. In those cases, the transaction may still count as authorised, even if the customer was deceived into making it.
For account holders, the immediate lesson remains straightforward: report the problem at once, ask for the payment to be disowned formally and keep records of every message, reference number and response from the bank. In Italy, consumers can also escalate a refusal through the complaints process and, if necessary, to the Arbitro Bancario Finanziario. The Bank of Italy has already warned intermediaries about problems in how they handle these disputes, including refusals of reimbursement, delays and poor communication with customers. The new judgment now gives that warning greater legal weight.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
