EU Court: Banks Must Refund Unauthorised Payments Immediately

The Court of Justice of the European Union (EU) ruled in mid-October, in case No. C-70/25, that a bank or other payment service provider must refund an unauthorised payment immediately, or by the end of the next business day after the payment is detected. The ruling affects bank customers across the EU, because it clarifies how far banks may refuse compensation in fraud cases.

What the ruling says

There is a single exception: the bank has reasonable grounds to suspect fraud by the customer and has reported this to a national authority. A bank's belief that the customer was grossly negligent and failed to protect security data does not allow it to refuse a refund. After refunding, the bank may demand compensation from the customer, but it must itself prove that the customer intentionally or through gross negligence failed to meet their obligations.

Background of the case

The case originated in Poland. A customer of a commercial bank, who was selling an item on an online platform, received a link from a fraudster supposedly to confirm the sale. It led to a fake bank website where the customer entered internet banking login details. The fraudster then transferred about 700 euros to a third party's account. The customer reported it to the bank the next day, but the bank refused a refund, citing gross negligence. The customer went to court.

Impact in Latvia

The Bank of Latvia notes that the ruling does not analyse the criteria for gross negligence, but deals with the refund obligation and the allocation of the burden of proof. In Latvia, the requirements of the Payment Services Directive (PSD2) are transposed into the Law on Payment Services and Electronic Money. The Bank of Latvia is assessing the ruling's impact on regulation and supervisory practice.

Edgars Pastars, adviser at the Finance Latvia Association and partner at Cobalt Latvija, explains that banks do not have to cover all money lost to fraud. He distinguishes cases where a fraudster accesses the account from those where a customer, influenced by a fraudster, approves the transfer themselves; in the latter, the bank's duty to compensate does not arise automatically.

Upcoming changes

The new Payment Services Regulation and PSD3 will replace PSD2 and will fully affect consumers around the end of 2028. They provide for refunds where a customer falls victim to spoofing fraud or where the new account-and-name matching check failed.