Banks Must Refund Phishing Victims Before Blaming Them

Banks must refund phishing victims first and argue about their carelessness afterwards. The Court of Justice of the EU ruled this on 15 October, and it holds for anyone with a bank account in the EU who loses money to a fraudster using stolen login details.

The case came from Poland. A woman had put an item up for sale on an online marketplace. A fraudster posing as a buyer sent her a link to a copy of her bank’s website, she typed in her login details, and about 700 euros went to the fraudster’s account. She reported it the next day. Her bank refused to pay, saying she had been grossly negligent, and a Polish court asked the EU judges whether a bank may do that.

Banks refund phishing victims first, then go after them

They may not. According to the German news agency dpa, which relayed the Court’s own press statement, banks must refund the money immediately even when they accuse the customer of gross negligence. The only exception under EU law covers a bank that has reasonable grounds to suspect the customer of fraud and informs the national authority in writing. The Court pointed to the goal of a high level of consumer protection.

Read also: When Any Video Can Be Fake, Who Tells the Court?

The law firm Bratby, which analysed the judgment, adds two details: the refund is due at once and at the latest by the end of the following business day (Article 73(1) of the Payment Services Directive, the EU’s payments law), and the bank has to prove the gross negligence it alleges.

The blame comes second, and in court

The bank keeps a later claim. If it can show that the customer was grossly negligent with her security data, she can be made to carry the loss. Athanasios Rantos, the Advocate General who advised the Court in March, said that a customer who then refuses to pay has to be taken to court by the bank.

In the Polish case the sequence ran the other way: the bank decided on negligence, kept the money and left the customer to sue. Bratby says a refusal at the outset forces the consumer to litigate at her own cost, which is hard to square with the Court’s consumer-protection goal.

Germany’s consumer federation knows the pattern

The vzbv, the federation of German consumer organisations, says banks in Germany behave similarly. Consumers put a lot of effort into disputes with their payment providers, give up, or accept poor settlement offers, and many avoid court because of the cost risk. The ruling puts the refund ahead of that dispute.

What the ruling leaves open

The Polish case concerned a payment the fraudster made with the woman’s stolen credentials. Fraud in which a scammer poses as the bank is the target of the payments reform now moving through Brussels. In a provisional political agreement of late November 2025, lawmakers agreed that the bank would refund in full if the customer reports the fraud to the police and informs the bank.

Online platforms would owe money to banks that reimbursed victims if they were told about fraudulent content and left it up. The text still needed formal adoption by Parliament and Council at the time it was reported.

Read also: Brussels Fined Big Tech 2.46 Billion. Washington Threatens Tariffs

Who pays in the end

The law firm CMS, assessing the Advocate General’s opinion, expects the refund duty to “likely” cause losses on bank balance sheets and costs “likely” to be passed on to customers. That is CMS’s assessment. On the Advocate General’s reading the bank has to do the suing, and on Bratby’s reading it has to prove the gross negligence it alleges. Until it does, the money stays with the customer.