The Bank Pays First: Case C-70/25 and the Refund of Unauthorised Payment Transactions

2026.10.20 Author: Robert Nogacki

On 15 October 2026 the Court of Justice of the European Union ruled that a bank may not refuse the next-business-day refund of an unauthorised payment by pointing to the customer’s gross negligence. The money comes back first; the argument about fault comes later, in a claim the bank must bring and, if the customer resists, win in court. The case began with a 3,000-zloty phishing loss in the Polish city of Koszalin. It ends, for now, with a rule that binds every court in the Union, and with a footnote in Brussels, where the EU’s next payments rulebook already contains the exception the Court has just refused to read into the current one.

By Robert Nogacki, attorney at law, managing partner, Skarbiec Law Firm. Facts and law as of 20 October 2026.

A woman who does not exist, and a transfer that did

The woman at the centre of Case C-70/25 is called Tukowiecka, and she does not exist. The Court of Justice has anonymised private individuals in preliminary ruling cases since 2018, and since 2023 it has given such cases invented surnames, so that a woman who lost 3,000 zlotys to a link in a chat window can be cited in the law reports without lending them her real name. Behind the invented name is a real customer of PKO BP, Poland’s largest bank, identified in the file only as N.O., and a sequence of events that anyone who has ever sold a sofa online will recognise.

She listed an item on an auction site. A buyer appeared and sent a link that was supposed to confirm the sale. The page it opened looked exactly like her bank’s. She typed in her login details. Somewhere else, whoever was behind the page logged into her real account with them, ordered a transfer of 3,000 zlotys (about 705 euros) to an account of his own, and when the bank’s genuine system sent her a text message with a confirmation code, obtained that too, by the same deception. The next day she understood what had happened, called the bank and went to the police. The perpetrator was never identified. The bank refused to return the money. Its position, in substance, was that she had been grossly negligent with her security credentials and must bear the loss herself. The judgment of the First Chamber, ECLI:EU:C:2026:852, sets all this out in seven short paragraphs.

She sued. The District Court in Koszalin, a city in northern Poland a few kilometres from the Baltic, could have decided it as the small claim it was. Instead it stayed the proceedings and sent a question to Luxembourg: may a payment service provider refuse the immediate refund of an unauthorised transaction when, in its view, the payer made the transaction possible through gross negligence? (the referral, published in the Official Journal as C/2025/2516). The question looks technical. The two sentences that accompanied it were not.

Why a Polish court asked Luxembourg

The Koszalin judge told the Court that no Polish court had ever received a claim by a bank against a consumer for the return of a refunded unauthorised transaction on the ground of gross negligence. Polish courts had, on the other hand, received many claims by consumers against banks that had refused to refund (paragraph 23 of the judgment). From this the judge drew the obvious inference: the exception had become the rule, and the burden of starting a case, paying the court fee, gathering evidence from systems the customer does not control and drafting the pleadings had been shifted onto the weaker party (paragraphs 24 and 26).

The economics are not subtle. A bank that refuses risks little: losing, with interest, a lawsuit the customer must first bring, and, in the longer run, the attention of the regulator. A customer who wants 3,000 zlotys back must pay a fee, reconstruct what the bank’s own logs would show in a minute, and wait. Many give up after the first letter; that is an inference from practice, not a measured figure. A refusal is therefore cheaper than a refund even when the accusation behind it is weak. The judgment reverses the arithmetic. A bank that wants to keep the money must now claim it back and, if the customer refuses, sue, pay and prove.

Some background for the reader who does not spend her days with payment law. The statute in question is the second Payment Services Directive, PSD2, the 2015 EU measure that governs how money moves between accounts in the Union and who bears the loss when it moves without permission. Article 73 says that when a transaction is unauthorised, the payer’s bank must refund it immediately and in any event by the end of the next business day, a rule known in the trade as D+1. Article 74 says that the payer bears the losses in full if he acted fraudulently or breached his security obligations intentionally or with gross negligence. Poland transposed both rules into Article 46 of its Payment Services Act. For a decade the banks read the two articles as a single switch: gross negligence on, refund off. The Court has now read them as two stages.

What the Court of Justice held in C-70/25

The ruling, delivered by a chamber of five judges with Marko Bošnjak as rapporteur, rests on four pillars, each ordinary in itself and together decisive.

The text first. Article 73 contains a single exception to the next-day refund: the bank has reasonable grounds to suspect fraud and reports those grounds in writing to the national authority (paragraph 33). Fraud, in that sentence, means fraud by the payer, as recital 71 of the directive makes clear (paragraph 39). Gross negligence is not a second exception, and member states may not add one, because the directive is a measure of full harmonisation (Article 107, paragraph 49).

The structure next. Articles 73 and 74 govern different moments of the same procedure. The first imposes the refund. The second allocates the loss afterwards (paragraph 42). A bank that believes its customer was grossly negligent refunds first and then claims the money back by the legal means provided for that purpose (paragraphs 38 and 46), bearing the burden of proving the negligence under Article 72(2) (paragraph 40).

The purpose third. To read Article 74 as a licence to withhold the refund would deprive the refund of its useful effect and force the consumer to litigate at her own expense, an outcome the Court found hard to square with the high level of consumer protection the directive promises (paragraph 45). The Court’s press release puts it plainly: EU law separates the question of the refund from the question of who ultimately bears the loss.

The history last. The first Payment Services Directive, of 2007, contained no express exception to the refund; the fraud exception was added during the negotiation of PSD2 (paragraphs 48 and 49). A legislature that writes in one exception does not write in a second by silence.

Two governments, the Czech and the Italian, had argued that this reading sidelines the out-of-court dispute resolution that PSD2 obliges member states to provide. The Court answered that alternative dispute resolution covers every dispute under the directive’s conduct rules and is no substitute for the refund itself (paragraphs 50 and 51). It also noted, in passing, that nothing suggested Poland had used the option in Article 74 to limit the liability of a payer who has neither acted fraudulently nor breached his duties intentionally, an option that can cover gross negligence (paragraph 36). The 3,000 zlotys themselves will now be decided in Koszalin, by a court bound by this reading; the Court of Justice awards nothing.

The judgment follows the opinion of Advocate General Athanasios Rantos of 5 March 2026, one of the Court’s eleven advocates general, whose opinions advise the judges without binding them. In points 47 and 48 of the opinion, Rantos also rejected an Italian suggestion that the bank could refund and then simply debit the customer’s account again: that would leave the payer where he would have been without any refund, forced to sue. He noted in a footnote that in a number of member states providers had made refusal their default practice. The Court did not address the re-debit point in terms, but its reference to the legal means provided for the purpose is hard to reconcile with a unilateral re-debit, and the same practice, the conditional refund reversed once the complaint is closed, was condemned in September by Poland’s consumer authority.

Gross negligence, the bank’s favourite phrase

Polish law gives the banks nothing more than the directive does. The Payment Services Act of 19 August 2011 (consolidated text, Journal of Laws 2026, item 623) requires the D+1 refund in Article 46(1), with the single fraud exception, and in Article 46(3) places the full loss on a payer who caused the transaction intentionally or through an intentional or grossly negligent breach of the security duties listed in Article 42. Article 45 adds two sentences the banks have long disliked: it is for the bank to prove that a transaction was authorised, and the recorded use of a payment instrument, including a correctly entered code, is not sufficient proof either of authorisation or of gross negligence. The Court changed none of this. It changed the order in which it is applied.

What gross negligence means in a given case turns on the facts. In Polish civil law the term denotes a qualified form of fault: the breach of elementary rules of caution that would occur to anyone, conduct bordering on intent. Ordinary negligence, the mistake a reasonable person makes under stress and time pressure, is something else. The Financial Ombudsman, the public official who intervenes in disputes between customers and financial institutions, has said for years that gross negligence by consumers is rare. A person who fails, in a hurry, to notice that a login page is an imitation will, in my view, seldom meet the definition.

The Polish Supreme Court has shown how fine the distinctions are. In a judgment of 15 September 2023, II CSKP 1013/22, it dealt with a business customer: an institutional account, a 2015 contract that, as the Act allows for non-consumers, switched off among other things the statutory rules on the burden of proof and on the payer’s liability, and events of 15 March 2018, before the Polish provisions implementing PSD2 took effect. That limits the ruling’s doctrinal weight, not its evidential lesson. Trying to log in, the customer typed his login, his password and two successive text-message codes into a fake page. The first code let the attacker into the real account; the second let him define a “trusted recipient”, a payee to whom transfers needed no further confirmation whatever the amount. The same day three transfers of nearly 40,000 zlotys each left the account, close to 120,000 zlotys in all; the customer received no notification while they were being made, and only the last transfer was later secured and recovered. Both lower courts ordered the bank to pay: using a text-message code to log in was not gross negligence, they held, and unlimited transfers to trusted recipients without separate confirmation were a dangerous arrangement for customers. The Supreme Court confirmed that proving authentication is not proving authorisation and did not quarrel with the point about the dangerous arrangement, yet it set the judgment aside: the assessment of the customer’s diligence had been too superficial, and the appellate court had not even said under which legal regime the bank was liable, nor considered contributory negligence under the Civil Code. What the courts had to examine was the wording of the messages that carried the codes and how legibly the bank had reminded customers to compare the operation described in a text message with the one they were actually performing. The second message read, in substance, “Modification of the recipient database, code no. 2. Remember never to share the code with anyone”, and the customer used it for a second attempt to log in; such a description, the Supreme Court observed, fits a login attempt even less. The lesson is evidential: gross negligence is decided on the exact wording of the exchange between a human being and a system, above all on whether the operation named in the message matched the one the customer believed he was performing, not on the slogan that the customer gave away the code.

There is a further layer, which courts are only beginning to see. The contemporary scam is a script, written with the tools of social psychology and increasingly with artificial intelligence, designed to switch off a person’s judgment for the few minutes that matter. I have written about this at length, and about why a nineteenth-century doctrine of defective consent cannot see it (Internet Fraud and the Limits of the Civil Code); the firm’s public warnings site documents the mechanisms one by one (The brain in a trap: why we fall for financial fraud, in Polish). For present purposes one thing matters. After 15 October 2026, the bank that calls a customer grossly negligent will have to persuade a judge of it as a claimant, with the full burden of proof, rather than as the author of a refusal letter.

What the ruling leaves untouched: transfers the victim made herself

The Court decided a case about an unauthorised transaction, one ordered by the thief after he had taken the keys. A large part of the money lost in Poland today disappears another way. The customer, persuaded by a fake bank employee, a fake police officer, a fake buyer or a fake investment adviser, knowingly orders the transfer himself to the account he was given. Under Article 40 of the Polish act such a transfer is authorised, because the payer consented to that payment in the manner agreed with the bank, even though he was mistaken about who would receive the money and why. The D+1 mechanism does not reach it, and the judgment in C-70/25 changes nothing about it.

The scale is not small. According to the National Bank of Poland, banks reported 39,200 fraudulent credit transfers worth 245.9 million zlotys in the first quarter of 2026; nearly 34,000 of those cases, worth over 152 million zlotys, resulted from manipulation of the payer, a category that covers both the phishing of credentials and the transfer the victim executes with her own hands. The banks’ own losses came to just over 27 million zlotys, 11 per cent of the total; the dominant part of the remainder, the central bank says, fell on the account holders.

The line between the two kinds of case is thinner than the law pretends. The fraudster controls the victim’s phone remotely; the victim types in a code sent “to cancel the transfer” that in fact approves it; the customer confirms an operation in the app without seeing what she confirms. The President of UOKiK, the Office of Competition and Consumer Protection and Poland’s consumer watchdog, has repeated for years that authentication is not authorisation and that consent must relate to the specific transaction. The scripts themselves, the policeman who needs your savings moved to a “safe account”, the buyer who has “already paid”, are described on the warnings site (Telephone scams: how fraudsters get victims to transfer money, in Polish; When the State Calls for Your Money: Anatomy of the Perfect Scam, in Polish).

The EU legislature has recognised the problem only in part. The agreed text of the Payment Services Regulation, the PSR, which will replace PSD2 with a directly applicable rulebook, makes a bank liable for a transfer the customer made under the influence of someone impersonating the bank itself, the practice known as spoofing, subject to conditions that include a police report. Impersonation of the police, a prosecutor, a public office or a family member stays outside the provision, a limitation the Polish Bank Association has called rational. The victim of the “police officer” scam therefore gains no refund right from that provision. What the PSR adds is indirect: it makes transaction monitoring a duty of the provider and attaches liability to its failure (Article 83 of the compromise text), so the outcome will depend on what the bank did, or failed to do, before it executed the transfer. Beyond that, what remains is the criminal track, an attempt to freeze the money on the receiving account and, in my view, an overdue revision of the civil law of mistake, deceit and duress.

A second boundary deserves a sentence. Article 46 protects a payment account held with a payment service provider. It does not protect money the customer himself paid into an “investment platform”, nor crypto-assets entrusted to an exchange; an unauthorised transfer to such a platform’s account is a different matter, and D+1 applies there as anywhere else. Inside the platform or the exchange there is no D+1 and no bank that returns the money the next morning, only slower and weaker heads of liability, among them the custodian’s liability for lost crypto-assets under Article 75(8) of MiCA (Fake investment platforms: how they work and how to defend yourself, in Polish; Investment Fraud: Legal Help for Victims).

The banking sector’s reply, and Article 56 of the PSR

The Polish Bank Association, the ZBP, answered the same day with a statement headed, in translation, “No surprise after the CJEU judgment”. The sector, it said, had for some time been adjusting its refund practice to the expectations of the financial supervisor and the consumer authority; the Court merely confirmed the direction of travel. The fourth point of the statement is the interesting one: the draft PSR, it noted, permits a bank to withhold the immediate refund where it has objectively justified grounds to suspect the customer’s gross negligence. What the Court had just denied the banks under PSD2, in other words, had already been negotiated for the future.

So it has. Article 56 of the compromise text of 17 April 2026 (Council document 8221/26) keeps the immediate refund but allows the provider to suspend it where it has objectively justified reasons to suspect that the payer failed, intentionally or with gross negligence, to meet the security obligations attached to the payment instrument and the credentials, and tells the payer so in writing. The provider then has fifteen business days either to refund or to justify its refusal and point the customer to the bodies that can hear a complaint; the burden of proof stays with the provider. That is how Katarzyna Urbańska, head of the ZBP’s legal department, described the provision in an interview with a banking monthly in April, and it is how EFRI, a European association of fraud victims, reads it; after the judgment EFRI asked Parliament and Council to bring Article 56 into line with the Court before the text is adopted.

The calendar matters. Political agreement on the PSR was reached on 27 November 2025, the Council made the final compromise texts public on 23 April 2026 and endorsed by the European Parliament’s economic affairs committee on 5 May. Formal adoption and publication in the Official Journal are expected around the turn of 2026 and 2027, and the regulation applies twenty-one months after it enters into force, which points to 2028. These are expectations, not law, and they have slipped before.

Four consequences follow. The standard set in C-70/25 is the law of the Union today and, if the calendar holds, will remain so for roughly two years. The PSR will not simply restore the old practice: a bank will not be able to refuse by silence, it will face a fifteen-day clock, a duty to give written reasons and to name the complaint bodies, and in any lawsuit it will still have to prove gross negligence. The argument will therefore move from whether a bank may withhold a refund to what counts as an objectively justified reason, and that phrase will be read in the light of a judgment that has already said what the system is for. And one observation that is mine rather than the Court’s: fifteen business days is precisely the statutory deadline for answering a payment services complaint in Poland (Article 15a of the Payment Services Act). The PSR thus largely legalises the model the consumer authority spent four years dismantling, the refund as the outcome of the complaint procedure rather than its starting point, albeit on stricter conditions and under a case law that does not yet exist.

Read through the interests of the institutions involved, the episode compresses to a sentence. The sector lost in Luxembourg a battle it had already won in Brussels. “No surprise” was, in that light, exactly the right headline.

How the British did it

Britain, no longer bound by the directive, kept its architecture. Regulation 76 of the Payment Services Regulations 2017 requires the refund of an unauthorised payment by the end of the next business day, with the same single exception for suspected fraud. Where the British went further is the territory the Union has left alone. Since 7 October 2024, banks must reimburse victims of authorised push payment fraud, transfers the victim made herself under deception, for domestic payments through the Faster Payments and CHAPS systems: up to 85,000 pounds per case, with an excess of at most 100 pounds, the cost split equally between the sending and the receiving bank, ordinarily within five business days and in every case by the thirty-fifth business day. The exceptions are fraud by the customer and gross negligence, defined by reference to a “consumer standard of caution”, but the burden of proving it lies on the bank, and it cannot be invoked against vulnerable customers at all. The British regulator (the Payment Systems Regulator, which shares the acronym PSR with the EU regulation) started from the premise that the bank has the tools to stop the fraud and should therefore carry the risk. The PSR adopts that premise only where the fraudster pretends to be the bank.

What changes now for customers, banks and pending cases

For a customer whose account has been emptied, the sequence is now clear, and speed is most of it. The transaction should be reported at once, through a channel that leaves a record, and access to the account blocked. Article 44 of the Polish act requires notification without undue delay; the thirteen-month limit in the same article is an outer boundary, not an allowance, and in Veracash, decided on 1 August 2025 under the 2007 directive, whose notification rule PSD2 repeats, the Court held that a customer who delays the notification intentionally or through gross negligence can lose the right to a refund even inside those thirteen months, transaction by transaction. The police should be told, because a criminal complaint serves the pursuit of the money on the receiving account. The refund should be demanded under Article 46(1) with an express reference to C-70/25; a refusal that relies on gross negligence alone now contradicts an interpretation binding on every national court. If the bank still refuses, a formal complaint follows, to be answered within fifteen business days (thirty-five in particularly complex cases, under Article 15a of the Payment Services Act); an unanswered complaint is deemed accepted, which, under a Supreme Court resolution of 13 June 2018 (III CZP 113/17), does not end the dispute but shifts the burden of proof onto the bank; after that come the Financial Ombudsman and the court. Evidence should be kept, including the link, the screenshots, the text messages with codes and their exact wording, because, as the Supreme Court showed, that is what decides the question of negligence. The customer should not wait: Polish case law is unsettled on the limitation period for refund claims, and some courts have considered the two-year period the Civil Code applies to claims arising from a bank account, so the shortest reading is the safe one. And a warning the firm repeats to every victim at first contact: after the fraud come the “law firms” and “recovery agencies”, sometimes under the letterhead of EU institutions, offering to get the money back for an advance fee. That is the recovery scam, the second wave (Recovery scams: secondary fraud against the victims of crypto fraud, in Polish). If the bank refunds and later sues, the customer should remember that the bank must prove gross negligence and that a correctly entered code is not that proof; it must also show that the breach caused the loss, and it cannot pass on transactions made after notification or executed without strong customer authentication unless the customer acted intentionally (Article 46(4) and (4a)).

For the banks, a lawsuit over 3,000 zlotys will rarely pay for itself, and three strategies are predictable: refund without pursuit in small cases; selective litigation in large, well-documented ones, where a customer ignored explicit warnings or handed over codes repeatedly; and more money spent on prevention. Polish banks have already begun to delay the posting of unusual transfers, the so-called cooling period, to confirm new payees and to apply limits. One hypothesis is worth watching. Some banks may reach more often for the one exception the Court left standing, the suspicion of fraud reported to the prosecutor. That, however, is an accusation that the customer committed a crime, and Polish law requires justified and duly documented grounds for it. Used as a routine way of postponing refunds, it would be an easy target for the consumer authority and the courts.

For cases already in the system, the judgment applies at once. A preliminary ruling explains what the provision has meant since it was enacted, so it binds the courts in pending disputes and supports claims over earlier refusals, subject to three limits: the transaction must have been reported in time, the claim must not be time-barred, and the ruling does not automatically reopen final judgments. The customers of the four banks covered by September’s decisions of the consumer authority can expect their rejected complaints to be reconsidered on the terms set in the decisions, which is a review, not a promise of a refund; the four-year proceedings that ended in those decisions concerned Alior Bank, mBank, BNP Paribas Bank Polska and Bank Millennium, with mBank alone reviewing more than 20,000 complaints, by its managing director’s count, including those filed after 15 November 2022, and ten further proceedings still open (UOKiK press release of 7 September 2026). Everyone else should file a new complaint citing C-70/25 and, if refused, go to the Ombudsman or to court. The bank that lost in Luxembourg told the press the day before the judgment that it already applied the Advocate General’s approach and that its systems detect over 95 per cent of attacks; it did not say since when, or whether it would revisit the complaints it had rejected.

The sequence is the substance

The judgment in C-70/25 does not decide who is right about gross negligence. It decides who must start the argument and who goes without the money while it lasts. That is a larger thing than it sounds, because in disputes over a few thousand zlotys the duty to file a claim settles the outcome more often than the rules on fault ever do. The Court moved the cost of uncertainty from the weaker party to the stronger: from the consumer to the institution that holds the logs, runs the systems and employs the lawyers.

Three questions stay open. The meaning of gross negligence will now be shaped in cases the banks bring, on better evidence than the old refusal letters contained. The boundary between an unauthorised transaction and one authorised under manipulation remains where it was: the Court was silent, the PSR answers only for impersonation of the bank, and the civil law still treats the victim of a perfect script as a payer who wished to pay. And Article 56 of the PSR may, in 2028, hand the first move back to the banks, on terms harder than the ones they have just lost.

For the victim the practical lesson is a single question, to be settled in the first conversation with a lawyer: did the thief order the transfer, or did you? Everything that follows depends on the answer.

Skarbiec Law Firm represents victims in disputes with banks over unauthorised transactions and in investment and internet fraud cases (Investment Fraud: Legal Help for Victims). The firm’s public warnings site documents fraud schemes and the psychology behind them (ostrzezenia-publiczne.pl/en).