A bank cannot refuse an immediate refund of money from an unauthorised transaction merely because it considers the customer grossly negligent – the Court of Justice of the European Union (CJEU) ruled on Thursday, 15 October, in case C-70/25. The judgment followed a question from a Polish court in Koszalin.
The case concerns a customer of a Polish bank. According to CJEU press release No 147/26, the woman visited a website strikingly similar to her bank’s site and entered her login details there. A fraudster used them to transfer the equivalent of about 700 euros (about PLN 3,000) from her account. The following day the customer reported the transfer to the bank, but the bank refused to refund it. It held that by grossly negligent conduct she had enabled the transaction, as she had failed to protect her authentication data. The customer sued the bank, and the Polish court – the District Court in Koszalin – asked the Court of Justice to interpret the EU rules. Documents in the InfoCuria database show that the defendant bank was PKO BP.
What the Court ruled
The principle the Court confirmed in the judgment is as follows: for an unauthorised transaction, the bank must in principle refund the money immediately, and at the latest by the end of the business day following the day on which it noticed the transaction or was informed of it. There is one condition: the customer must report it without undue delay. The bank’s belief that the customer grossly neglected security safeguards does not give it a right to refuse.
The only exception the CJEU mentions applies where the bank has justified grounds to suspect fraud by the customer itself and notifies the competent national authority in writing.
The bank can still pursue the money
The judgment does not mean that a defrauded customer will always keep the recovered funds. According to the CJEU, the bank may later seek to recover its losses from the customer if it proves intentional conduct or gross negligence, especially in protecting authentication data. What changes is the order: first the refund, then any dispute. In the Court’s view, if the bank could refuse in advance, the customer would have to pursue their rights alone and bear the costs.
The point on the reporting deadline is supported by an earlier ruling in case C-665/23 of 1 August 2025. It shows that a customer loses the right to a refund if, through intentional fault or gross negligence, they delay reporting, even within 13 months of the debit to the account (CJEU press release No 97/25).
Reactions in Poland
As Interia reports, citing institutional statements, Financial Ombudsman Michał Ziemiak held that a bank cannot be a “judge in its own case”, while the Office of Competition and Consumer Protection (UOKiK) assessed that the judgment confirms the line the office had pursued in its proceedings. The Polish Bank Association (ZBP), quoted by Interia, said the ruling is consistent with the direction of changes banks have been introducing for some time and that a bank retains the right to seek repayment from the customer. According to money.pl, legal adviser Wojciech Bochenek does not rule out an increase in court proceedings, but doubts that banks will sue customers en masse over small sums, because proceedings require evidence and carry a risk of losing.
What it means for customers
- After spotting an unauthorised transaction, report it to the bank immediately – this is the condition for a refund within the deadline of the end of the next business day.
- According to the CJEU, a bank’s refusal based solely on an allegation of gross negligence is contrary to the EU Payment Services Directive (2015/2366). Customers can cite this in a complaint and, if there is a dispute, turn to the Financial Ombudsman.
- People whose banks previously refused a refund may consider pursuing their claims. The CJEU ruling binds national courts, but assessing a specific case, including gross negligence, is for the court.
- After a refund, the bank can still demand the money from the customer if it proves their fault.
Komentarze