CJEU Judgment in Case C-70/25 (Tukowiecka): Refund First, Argue About Gross Negligence Later

A bank may not refuse an immediate refund of an unauthorised payment transaction merely because it believes the customer made it possible through gross negligence. That is the ruling of the Court of Justice of the European Union in its judgment of 15 October 2026 in case C-70/25 (Tukowiecka). The bank does, however, keep the right to claim its losses back from the customer in a second step, if it proves gross negligence on the customer’s part.

I. Facts and the question referred

The case concerned a customer of a Polish bank who fell victim to phishing while selling an item on an online marketplace. A person posing as the buyer sent her a fake link, supposedly to confirm the sale. The link led to a page deceptively similar to the bank’s website, where the customer entered her online banking login details.

Using those details, the fraudster transferred an amount equivalent to about EUR 700 (approx. PLN 3,000) from her account. The customer reported the transaction to the bank the following day. The bank refused a refund, taking the view that she had, through gross negligence, breached her obligation to keep her personalised security credentials safe.

The customer sued. The court asked the Court of Justice whether Article 73(1) read in conjunction with Article 74(1) of Directive (EU) 2015/2366 (PSD2) means that a payment service provider may refuse the payer an immediate refund of an unauthorised transaction where the payer incurred the loss through gross negligence in breaching the obligations laid down in Article 69 of the Directive.

II. The Court’s ruling

The Court answered that the bank may not refuse an immediate refund by relying on the customer’s gross negligence. In other words: the obligation to refund exists even where the bank considers the customer’s conduct grossly negligent.

1. The rule: in the case of an unauthorised transaction, the payment service provider is in principle obliged to refund its amount immediately, and in any event no later than by the end of the following business day after noting or being notified of the transaction (Article 73(1) PSD2). The condition is that the customer reports the transaction without undue delay, and no later than 13 months after the debit date (Article 71 PSD2).
2. The only exception: The bank may withhold the refund only where it has reasonable grounds for suspecting fraud committed by the payer and communicates those grounds in writing to the relevant national authority.
3. Gross negligence is not an exception: the fact that the customer – in the bank’s view – made the transaction possible by failing to protect their security credentials properly does not entitle the bank to refuse a refund. The victim of a third party’s fraud is not the same as a payer suspected of fraud.

III. Two stages: refund, then a possible claim by the bank

According to the Court, EU law makes it possible to separate the question of refunding an unauthorised transaction from the question of who ultimately bears the loss. This produces the following sequence:

1. Refund first: The bank restores the account to the state it would have been in had the unauthorised transaction not taken place, within the deadline in Article 73(1) PSD2.
2. A possible claim later: Where appropriate, the bank may claim its losses back from the customer if it proves that the customer, intentionally or through gross negligence, breached their obligations, in particular the obligation to keep their personalised security credentials safe (Article 74(1) PSD2). If the customer does not pay voluntarily, the bank must go to court.

The burden of proving gross negligence lies with the bank. This is not new – it already follows from Article 72(2) PSD2, under which the recorded use of a payment instrument is not in itself sufficient to prove gross negligence. What the judgment changes is the order: it is not the customer who has to sue the bank to get their money back, but the bank – if it wants to recover it – that has to prove the customer was at fault.

The Court based this on the purpose of the Directive, namely a high level of consumer protection. If the bank could refuse a refund up front, the obligation of immediate refund would be deprived of its effectiveness (effet utile), and the customer would have to bring proceedings themselves, bearing the costs and inconvenience involved.

IV. Practical consequences and limits of the judgment

Polish law: Articles 73 and 74 PSD2 are implemented in Poland by Article 46 of the Payment Services Act (ustawa o usługach płatniczych): paragraph 1 provides for the obligation to refund by the end of the following business day, and paragraph 3 for the payer’s full liability for transactions they brought about intentionally or through an intentional or grossly negligent breach of their obligations. After the judgment, a bank may not refuse to perform paragraph 1 merely because, in its view, the conditions of paragraph 3 are met.

Complaints: A refusal to refund based solely on an allegation of gross negligence is inconsistent with the interpretation of the law adopted by the Court of Justice. The judgment binds the court in Koszalin and, in practice, other national courts ruling in similar cases; it is they, not the CJEU, that decide individual disputes.

The customer’s liability remains: the judgment does not release customers from the duty of care. Whether entering details on a fake website amounted to gross negligence will, in the event of a dispute, be decided by a court in the specific case – not by the bank in a complaint procedure.

Legislative outlook: The judgment concerns PSD2. According to the Polish Bank Association (ZBP), the proposed Payment Services Regulation is to allow a departure from immediate refund where the bank has an objectively justified suspicion of the customer’s gross negligence. Once it is adopted, the assessment may therefore change. The ZBP also points out that most banks had already been adapting their practice to the expectations of the Polish Financial Supervision Authority (KNF) and the President of the Office of Competition and Consumer Protection (UOKiK).

Summary

The judgment in case C-70/25 settles the order: first the bank refunds the amount of the unauthorised transaction, and only then may it try to prove before a court that the customer was grossly negligent. The risk may still ultimately fall on the customer, but the bank cannot decide that unilaterally by refusing a refund.