EU Refund-First Banking Rule: CJEU Rules That Banks Must Refund Fraud Victims Before Blaming Customers

Case: N.O. v PKO BP S.A. (Tukowiecka)
Case No.: C-70/25
Court: Court of Justice of the European Union (First Chamber)
Date of Judgment: 15 October 2026
ECLI: ECLI:EU:C:2026:852
Legislation: Directive (EU) 2015/2366 (PSD2)

Introduction: When a Bank Blames the Customer for Being Defrauded

There is something particularly distressing about discovering that money has disappeared from one’s bank account without authorisation. But for many victims of digital banking fraud, the financial loss is only the beginning of the problem.

The real difficulty often starts when the victim approaches the bank for reimbursement.

The bank investigates the transaction and discovers that the customer may have clicked a fraudulent link, disclosed an OTP, entered banking credentials on a fake website or responded to someone impersonating a bank official. The bank then takes the position that the customer failed to exercise reasonable care and must therefore bear the loss.

In some cases, the bank may go further and describe the customer’s conduct as gross negligence.

But there is a fundamental legal question here. Can a bank refuse to refund an unauthorised transaction immediately simply because it believes that the customer was grossly negligent?

The Court of Justice of the European Union (CJEU) has now answered this question in an important judgement delivered on 15 October 2026.

In N.O. v PKO BP S.A., Case C-70/25, the Court held that a payment service provider cannot refuse to refund an unauthorised payment transaction immediately merely because it considers that the customer made the transaction possible through gross negligence.

The judgement establishes an important distinction between the bank’s immediate obligation to refund an unauthorised transaction and its subsequent right to establish that the customer should ultimately bear the financial loss.

This distinction is the foundation of what may appropriately be described as the EU Refund-First Banking Rule.

The judgement does not make customers immune from liability. Nor does it prevent banks from investigating negligence or seeking reimbursement where the law permits.

What it prevents is something quite different: a bank cannot withhold an immediate statutory refund merely by accusing its customer of gross negligence.

That is a significant development in European banking and consumer protection law.

1. The Facts: A Phishing Attack That Cost a Customer Her Money

The dispute arose from a phishing incident involving a customer of PKO BP, a Polish banking institution.

The circumstances are familiar to anyone following the growing problem of online financial fraud.

The customer had advertised an item for sale on an online auction platform. An individual contacted her, expressed interest in purchasing the item and sent her a link, supposedly to confirm the sale.

There was nothing immediately suspicious about the communication.

However, the link did not take the customer to the genuine marketplace. Instead, it directed her to a fraudulent website designed to resemble her bank’s online banking portal.

Believing that she was accessing a legitimate banking website, she entered her online banking login details.

The fraudster obtained the information and subsequently managed to initiate a transfer from her account.

Approximately PLN 3,000, equivalent to around €705, was transferred to an account controlled by the fraudster.

The transaction was confirmed by the fraudster using an SMS confirmation code obtained from the customer through deception.

The following day, the customer realised what had happened. She immediately informed the bank and reported the incident to the police.

One would expect a banking institution to examine the complaint and apply the statutory protections governing unauthorised electronic transactions.

Instead, the bank refused reimbursement.

Its argument was that the customer had acted with gross negligence by failing to protect her banking credentials and allowing unauthorised persons to obtain access to them.

The bank maintained that this conduct relieved it of the obligation to refund the money.

The customer disagreed and approached the Polish District Court at Koszalin seeking recovery of the amount.

The dispute eventually reached the CJEU through a preliminary reference.

What began as a relatively small banking dispute raised a question of considerable importance for millions of European banking customers.

Can a bank decide for itself that a customer was grossly negligent and, on that basis alone, refuse an immediate refund?

2. The Legal Question Before the CJEU

The referring Polish court sought an interpretation of Articles 73(1) and 74(1) of Directive (EU) 2015/2366, commonly known as the Second Payment Services Directive (PSD2).

The question was essentially this:

Can a payment service provider refuse to refund immediately an unauthorised payment transaction where the customer made that transaction possible through gross negligence in failing to comply with the obligations imposed by Article 69?

The question required the Court to examine the relationship between three important provisions.

Article 69: Obligations of the Payment Service User

Customers must use payment instruments in accordance with the applicable terms and take reasonable steps to keep personalised security credentials safe.

Article 73: Liability of the Payment Service Provider

Where an unauthorised payment transaction occurs, the bank must ordinarily refund the amount immediately and, in any event, no later than the end of the following business day after noting or being notified of the transaction.

Article 74: Liability of the Payer

Under specified circumstances, the customer may ultimately bear the losses resulting from an unauthorised transaction, including where the customer has acted fraudulently or failed to fulfil Article 69 obligations intentionally or through gross negligence.

Understanding the Relationship Between the Three Provisions

PSD2 Provision	Subject	Legal Requirement
Article 69	Customer obligations	Customers must use payment instruments properly and protect their personalised security credentials.
Article 73	Bank’s liability	The bank must ordinarily refund an unauthorised transaction immediately, subject to the statutory exception.
Article 74	Customer’s liability	The customer may ultimately bear the loss in specified circumstances involving fraud or intentional or grossly negligent conduct.

The apparent difficulty was that Article 74 recognises customer liability, while Article 73 imposes an immediate refund obligation.

The bank argued that these provisions should be read together in a manner that allowed it to refuse reimbursement where gross negligence was established.

The CJEU rejected that interpretation.

Its reasoning is important because it explains why the immediate obligation to refund cannot be confused with the final determination of who must ultimately bear the loss.

3. The Court’s Interpretation of Article 73: Immediate Refund Is the General Rule

Article 73(1) of PSD2 is the starting point of the judgement.

It provides that where an unauthorised payment transaction occurs, the payer’s payment service provider must refund the amount immediately.

The refund must, in any event, take place no later than the end of the following business day after the provider becomes aware of the transaction or receives notification from the customer.

Where applicable, the payment account must also be restored to the position it would have occupied had the unauthorised transaction never taken place.

The provision is important for another reason.

It expressly identifies an exception to the immediate refund obligation.

A payment service provider may withhold the immediate refund where it has reasonable grounds for suspecting fraud and communicates those grounds in writing to the relevant national authority.

The question was whether alleged gross negligence could constitute another exception.

The Court examined the wording of Article 73(1) and reached a clear conclusion.

There is no separate exception allowing a bank to refuse immediate reimbursement merely because it suspects that the customer acted with gross negligence.

In paragraph 33, the Court emphasised that Article 73(1) provides for only one exception to the immediate refund obligation.

In paragraph 34, it concluded that the provision does not create an exception where the customer is suspected of having made the unauthorised transaction possible through gross negligence.

This is the central legal foundation of the EU Refund-First Banking Rule.

A bank cannot add an exception to a statutory provision simply because it considers that the customer deserves to bear the loss.

If the legislature has prescribed an immediate refund obligation and identified the circumstances in which that obligation may be suspended, the bank must operate within those boundaries.

4. Article 74: Does Gross Negligence Still Matter?

Yes. And this is where the judgement requires careful reading.

The CJEU has not abolished customer liability under Article 74.

The provision recognises that a payer may ultimately be required to bear the losses relating to unauthorised payment transactions where the payer has acted fraudulently or failed intentionally or through gross negligence to comply with the obligations under Article 69.

Those obligations include taking reasonable steps to keep personalised security credentials safe.

Therefore, a customer who deliberately discloses banking credentials or behaves with sufficiently serious carelessness may still face financial consequences.

Two Separate Legal Stages

However, the Court distinguished between two separate legal stages.

• The first: The immediate restoration of the customer’s account.
• The second: The ultimate allocation of financial responsibility.

These are not the same thing.

Article 73 deals with the immediate refund.

Article 74 deals with the circumstances in which the customer may ultimately be required to bear the loss.

The Court explained this distinction in paragraphs 38 and 42.

It recognised that the provisions govern different aspects of the reimbursement process.

The payment service provider must first comply with its immediate refund obligation. It may subsequently pursue reimbursement from the customer where the conditions under Article 74 are established.

This interpretation preserves both provisions.

It gives effect to the immediate protection guaranteed by Article 73 without rendering the customer’s liability under Article 74 meaningless.

In other words, the CJEU did not say that gross negligence is irrelevant. It said that gross negligence cannot automatically be used to defeat the immediate refund obligation.

That distinction is the real substance of the judgment.

5. The Burden of Proof: A Bank Cannot Simply Assert Gross Negligence

One of the most important aspects of the judgment concerns the burden of proof.

Banks frequently rely on the fact that a transaction was authenticated using the customer’s credentials.

The argument is often that because the correct credentials or authentication method were used, the customer must have authorised the transaction or failed to protect the account.

PSD2 does not permit such a simplistic approach.

Article 72(2) provides that the mere recorded use of a payment instrument is not necessarily sufficient to establish that a transaction was authorised by the payer or that the payer acted fraudulently or with intent or gross negligence.

The payment service provider must provide supporting evidence to establish fraud or gross negligence.

The CJEU specifically addressed this provision in paragraphs 40 and 41.

The Court observed that placing the burden of proof on the payment service provider is consistent with the broader consumer protection framework established by PSD2.

Why the Burden of Proof Matters in Practice

This has considerable practical significance.

Consider a customer who receives a convincing telephone call from someone impersonating a bank official.

The caller may know the customer’s name, account details and recent transactions. The customer is then persuaded to disclose information or follow instructions that appear genuine.

The bank cannot simply point to the successful authentication of the transaction and conclude that the customer must have been grossly negligent.

It must establish the relevant facts through supporting evidence.

The nature of the fraud, the circumstances in which the credentials were obtained and the customer’s actual conduct may all become relevant.

Gross negligence is a legal conclusion. It is not established merely because a fraudulent transaction was successfully executed.

The judgment therefore reinforces an important evidentiary principle: the bank must prove the grounds on which it seeks to impose financial responsibility on the customer.

6. Why the Court Rejected the Bank’s Interpretation: Consumer Protection Must Have Practical Meaning

The CJEU did not approach the dispute as a purely technical exercise in interpreting two statutory provisions.

It also examined the purpose of PSD2.

One of the Directive’s objectives, reflected in Recital 6, is to ensure a high level of consumer protection throughout the European Union.

The Court considered what would happen if banks were permitted to refuse immediate reimbursement whenever they alleged gross negligence.

The consequences would be significant.

A customer would lose money through an unauthorised transaction and then have to challenge the bank’s decision before receiving the refund.

The customer might have to:

• Approach a lawyer.
• Initiate proceedings.
• Pay court fees.
• Collect evidence.
• Contest the bank’s assessment.

In practical terms, the statutory right to immediate reimbursement would become dependent on the customer’s ability and willingness to litigate.

The referring Polish court had drawn attention to this problem.

In paragraphs 23 to 26, it observed that banks were frequently refusing refunds and that consumers were consequently being forced to approach courts to enforce their rights.

The national court was concerned that exceptions intended to protect banks against genuinely fraudulent claims were becoming routine grounds for refusing reimbursement.

The CJEU took this concern seriously.

In paragraph 45, it explained that allowing a bank to avoid immediate reimbursement on the ground of alleged gross negligence would undermine the effectiveness of Article 73 and place consumers at a procedural disadvantage.

The Court’s reasoning is particularly persuasive because it recognises the realities of modern banking.

A consumer generally does not possess the technical resources or investigative capabilities of a financial institution.

The law must therefore provide meaningful protection rather than merely create a theoretical right that the customer must spend considerable time and money enforcing.

7. The Bank’s Right to Recover Money Is Not Lost

An important clarification is necessary.

The judgment does not mean that a bank must permanently absorb every loss resulting from an unauthorised transaction.

Paragraph 46 expressly recognises that a payment service provider may subsequently claim reimbursement from the customer where the conditions of Article 74(1) are satisfied.

Suppose a bank refunds a customer following an unauthorised transaction.

During a subsequent investigation, the bank obtains evidence establishing that the customer deliberately disclosed security credentials or acted with gross negligence in breach of Article 69.

The bank is not prevented from pursuing a legally sustainable recovery claim.

However, it must establish the customer’s liability through the appropriate legal process.

The distinction is therefore between the immediate refund and the ultimate financial responsibility.

The CJEU has not removed the bank’s recovery rights.

It has clarified when those rights may be asserted.

This is an important distinction for both consumers and financial institutions.

The EU Refund-First Banking Rule is not a rule of unconditional compensation. It is a rule governing the sequence in which the relevant legal obligations operate.

8. The Exception: What Happens When the Bank Suspects Fraud by the Customer?

The judgment also makes it necessary to distinguish between gross negligence and fraud committed by the payer.

Article 73(1) contains an express exception where the payment service provider has reasonable grounds for suspecting fraud and communicates those grounds in writing to the competent national authority.

This exception remains available.

However, the bank must satisfy the statutory requirements.

A customer’s failure to recognise a phishing website is not automatically evidence of fraud.

Nor is the disclosure of an OTP, by itself, proof that the customer intended to deceive the bank.

There is a difference between being deceived by a fraudster and participating in a fraudulent scheme.

The distinction is legally significant.

A bank cannot simply reclassify customer negligence as suspected fraud to avoid the refund obligation.

The exception must be supported by reasonable grounds and the required written communication to the relevant authority.

This safeguard allows banks to investigate genuinely suspicious claims without making ordinary fraud victims bear the consequences of a preliminary allegation.

9. Does the Judgment Cover Every Form of Digital Banking Fraud?

No. The scope of the decision must be understood carefully.

The case concerned an unauthorised payment transaction.

That distinction is important because digital fraud can occur in several different ways.

A. Phishing and Credential Theft

A fraudster obtains the customer’s login credentials through a fake website and initiates a payment without the customer’s authorisation.

This is the type of situation at the centre of the judgment.

B. OTP Disclosure

A customer may be persuaded to disclose an OTP or confirmation code.

The legal consequences depend on the circumstances, including whether the resulting payment was authorised by the customer.

The mere use of an OTP does not automatically settle the question of authorisation.

C. Authorised Push Payment Fraud

In some cases, a fraudster convinces a customer to personally initiate a transfer.

For example, the fraudster impersonates a police officer or bank employee and persuades the customer to move money into a so-called safe account.

This is commonly described as Authorised Push Payment (APP) fraud.

The CJEU did not decide the broader question of reimbursement in all such cases.

Where the customer has personally initiated and authorised the transfer, the legal analysis may be different.

D. Social Engineering

Social engineering involves manipulating individuals into disclosing confidential information or performing financial transactions.

It can result in either authorised or unauthorised transactions, depending on the actual circumstances.

The legal character of the transaction must therefore be examined before applying the refund rule.

10. The EU Refund-First Banking Rule and Indian Banking Law: A Comparison Worth Examining

Although the judgment interprets European legislation, its reasoning deserves attention in India.

India has experienced a remarkable expansion of digital banking.

UPI, internet banking, mobile applications and electronic payment systems have made financial transactions faster and more accessible.

Unfortunately, the same expansion has also created opportunities for increasingly sophisticated financial fraud.

Customers regularly encounter fake customer care numbers, fraudulent KYC messages, phishing links, impersonation calls, remote-access applications and OTP-related scams.

One recurring issue in Indian banking disputes is the question of customer negligence.

Banks sometimes argue that where a customer has disclosed confidential credentials, the customer must bear the loss.

The Reserve Bank of India has already established a regulatory framework dealing with unauthorised electronic banking transactions.

The relevant instrument is the RBI circular dated 6 July 2017:

Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions

The circular provides a framework for determining when customers enjoy zero liability, when limited liability applies and when customers may bear the financial consequences of negligence.

However, the Indian framework differs in important respects from the European approach.

A. Zero Liability Under RBI Directions

The RBI framework recognises zero liability in specified situations.

These include:

• Contributory fraud, negligence or deficiency on the part of the bank, irrespective of whether the transaction was reported.
• Third-party breaches where neither the bank nor the customer is responsible, provided the customer reports the transaction within three working days of receiving the bank’s communication.

The reporting requirement is important.

Customers should not delay reporting an unauthorised transaction.

B. Limited Liability

Where a customer reports an unauthorised transaction within four to seven working days, limited liability may apply in certain third-party breach situations.

The applicable limits depend on the type of account and the relevant RBI conditions.

C. Where the Customer Is Negligent

The RBI circular expressly addresses customer negligence, including sharing payment credentials.

Where the loss occurs because of customer negligence, the customer bears the loss until the unauthorised transaction is reported to the bank.

Any loss occurring after the customer reports the transaction is borne by the bank.

This is an important feature of the Indian framework.

D. Shadow Credit

The RBI circular also requires banks to provide shadow reversal or credit in applicable zero-liability and limited-liability cases within ten working days of notification.

The customer’s entitlement and the bank’s obligations must be examined in accordance with the specific provisions of the circular.

E. The Important Difference Between India and Europe

The European approach interpreted in Case C-70/25 separates immediate reimbursement from the subsequent determination of customer liability.

Under PSD2, alleged gross negligence does not independently justify withholding the immediate refund.

The RBI framework, by contrast, contains its own liability allocation rules and permits the customer to bear losses until reporting where the loss is attributable to customer negligence.

The two systems therefore cannot be treated as identical.

The CJEU judgment is not binding on Indian banks or Indian courts.

Nevertheless, it offers a valuable comparative perspective.

It raises an important question for Indian banking regulation: should the distinction between immediate restoration of funds and the subsequent determination of customer liability receive greater attention in India’s digital banking protection framework?

That is a question worth examining as digital fraud becomes more sophisticated.

11. A New Development: Could the Proposed EU Payment Services Regulation Change the Refund-First Position?

There is another development that makes this judgment particularly interesting.

The European Union has been working on a major reform of its payment services framework through the proposed Payment Services Regulation (PSR) and Third Payment Services Directive (PSD3).

The reform is intended to strengthen consumer protection, improve fraud prevention and modernise the regulation of electronic payments.

Importantly, the Council of the European Union adopted its position at first reading on the proposed Payment Services Regulation on 29 October 2026.

The legislative process has therefore progressed beyond the initial proposal.

The Proposed Change Concerning Unauthorised Payment Transactions

The Council’s text contains a significant change concerning unauthorised payment transactions.

Under the proposed approach, a payment service provider may be able to conduct an investigation before refunding a customer where it has objectively justified reasons to suspect that the transaction resulted from the payer’s intentional or grossly negligent failure to comply with security obligations, or from fraudulent conduct.

The 15-Business-Day Investigation Process

However, the proposal also contains procedural safeguards.

The payment service provider must, within 15 business days after noting or being notified of the transaction, either:

• Refund the amount to the payer; or
• Provide reasons and supporting evidence for refusing the refund, together with information about the bodies to which the payer may refer the dispute.

The proposed framework also requires the provider to give the customer an opportunity to submit relevant information and evidence before reaching a conclusion that the customer acted fraudulently or with gross negligence.

This is particularly important.

The proposed framework does not simply give banks unrestricted power to reject claims.

It seeks to establish a more structured investigation process, with an opportunity for the customer to present their case.

Distinguishing Negligence from Gross Negligence

It also addresses the distinction between negligence and gross negligence, recognising that gross negligence must involve a significant degree of carelessness rather than an ordinary failure to exercise caution.

The Council’s text specifically identifies the complexity and sophistication of fraud as relevant circumstances when assessing alleged gross negligence.

The Legal Status of the Proposed Regulation

However, a necessary qualification must be made.

The Council’s adoption of its first-reading position does not, by itself, make the proposed Regulation applicable law.

The European Parliament’s legislative role and the remaining formal steps must be completed before the new framework becomes applicable.

Consequently, the CJEU’s interpretation of the existing PSD2 framework must be distinguished from the proposed future regime.

This development may eventually alter the way banks handle reimbursement claims.

For now, the judgment in Case C-70/25 remains an important interpretation of the existing PSD2 provisions.

12. What This Judgment Means for Banks and Their Customers

The decision has practical implications for financial institutions.

A bank cannot treat every successful phishing attack as proof of customer negligence.

Nor can it assume that the use of correct authentication credentials establishes that the customer authorised the transaction.

Article 72(2) requires supporting evidence.

Banks must distinguish between authentication, authorisation and customer liability.

These are related, but they are not interchangeable legal concepts.

What the Judgment Means for Customers

For customers, the judgment provides an important clarification.

Where an unauthorised transaction occurs, a bank cannot simply refuse immediate reimbursement because it believes that the customer was grossly negligent.

However, customers should continue to observe the applicable reporting requirements.

Article 71 requires notification without undue delay after becoming aware of an unauthorised transaction and imposes an outer time limit of 13 months from the debit date.

A person who discovers fraudulent activity should therefore act immediately.

Practical Steps to Take After an Unauthorised Banking Transaction

The following practical steps are advisable:

1. Notify the bank through its official fraud reporting channel.
2. Request immediate blocking of compromised payment instruments or credentials.
3. Preserve SMS alerts, emails, screenshots and transaction references.
4. Obtain written acknowledgement of the complaint.
5. Report the incident to the appropriate police or cybercrime authority.
6. Request reimbursement under the applicable legal framework.
7. Challenge a refusal that relies solely on an allegation of gross negligence.

The precise remedies will depend on the applicable national law and the facts of the case.

13. The Wider Legal Principle: Consumer Protection Cannot Depend on the Bank’s Preliminary Opinion

The judgment raises an issue that goes beyond the interpretation of payment services legislation.

Modern banking depends heavily on digital infrastructure.

Banks provide the payment systems, authentication mechanisms, security protocols and technological environment through which customers access their money.

Customers rely on these systems.

Of course, customers also have responsibilities. They must take reasonable precautions and protect their security credentials.

But the existence of customer responsibilities does not mean that every fraudulent transaction should automatically be treated as the customer’s fault.

The Difference Between Ordinary Negligence and Gross Negligence

There is a difference between an ordinary mistake, a failure to exercise reasonable care and gross negligence.

There is also a difference between a customer who has been deceived and one who deliberately participates in fraud.

These distinctions must be established through evidence.

Why Consumer Protection Must Have Practical Value

The CJEU’s judgment recognises that consumer protection must have practical value.

A statutory right to immediate reimbursement becomes ineffective if a bank can routinely avoid it by making an allegation that the customer must then spend time and money contesting.

The Court has therefore insisted on a separation between the bank’s immediate obligation and the subsequent determination of liability.

In my view, this is the most persuasive aspect of the judgment.

It does not unfairly favour customers at the expense of banks.

It requires both parties to operate within the legal framework established by the legislature.

14. The Final Legal Position: Refund First, Determine Liability Afterwards

The judgment in N.O. v PKO BP S.A. clarifies the relationship between Articles 72, 73 and 74 of PSD2.

Its principal conclusions may be summarised as follows:

1. First, an unauthorised payment transaction ordinarily triggers an immediate refund obligation.
2. Second, the refund must generally be completed no later than the end of the following business day after the provider notes or is notified of the transaction, subject to the statutory requirements.
3. Third, suspected gross negligence by the customer is not an independent exception to immediate reimbursement.
4. Fourth, the exception concerning reasonable grounds for suspecting fraud by the payer remains available, provided the required written communication is made to the competent national authority.
5. Fifth, the payment service provider bears the burden of providing supporting evidence of fraud or gross negligence under Article 72(2).
6. Sixth, the bank may subsequently seek reimbursement where the customer’s liability is established under Article 74.

These propositions explain why the expression EU Refund-First Banking Rule is an appropriate description of the judgment.

However, it must not be understood as an absolute right to compensation in every form of digital fraud.

The ruling concerns unauthorised payment transactions under the existing PSD2 framework and preserves the statutory exceptions and subsequent recovery rights.

Also Read: Received an IBC Demand Notice? You Have 10 Days. Here’s How to Stop Insolvency Proceedings

Conclusion: A Bank Cannot Blame the Victim Before Honouring Its Statutory Obligation

The importance of this judgment lies not merely in the amount of money involved.

Approximately €705 was at the centre of the original dispute. Yet the legal question has consequences for millions of consumers who use electronic payment systems every day.

Digital fraud has become increasingly sophisticated. Fraudsters can imitate bank websites, manipulate caller identification, impersonate officials and exploit the trust that customers place in financial institutions.

It is unrealistic to assume that every person who falls victim to such deception has necessarily acted with gross negligence.

At the same time, customers cannot be absolved of every responsibility to protect their credentials.

The law must strike a fair balance.

The CJEU has achieved this by distinguishing the immediate refund obligation from the subsequent allocation of financial liability.

A bank remains entitled to establish that a customer acted fraudulently or with gross negligence and to pursue recovery where the law permits.

But it cannot simply withhold the immediate refund because it has reached a preliminary conclusion that the customer was careless.

That is the real significance of the EU Refund-First Banking Rule.

A consumer who suffers an unauthorised banking transaction should not automatically be forced into litigation merely to obtain the immediate protection that the law has already provided.

The Principle Emerging From This Judgment

The principle emerging from this judgment is straightforward:

• Refund the unauthorised transaction in accordance with the law.
• Investigate the customer’s conduct separately.
• Establish liability through evidence, not assumption.

That is a sensible approach to consumer protection in an increasingly digital banking environment.

Facing an Unauthorised Bank Transaction? Know Your Legal Rights Before Accepting the Bank’s Decision.

A bank’s refusal to refund money lost through an unauthorised electronic transaction does not necessarily mean that you have no legal remedy.

The recent CJEU ruling on the EU Refund-First Banking Rule highlights an important principle: a bank cannot simply shift responsibility to a customer without examining the evidence and following the applicable legal framework.

Whether your money has been lost through online banking fraud, phishing, identity theft, unauthorised card transactions or disputed digital payments, understanding your legal rights is the first step towards protecting your interests.

Before accepting a bank’s rejection, consider obtaining independent legal advice. The circumstances of the transaction, the bank’s security procedures, the evidence available and the applicable regulations can make a significant difference to your case.

Speak to an Experienced Advocate

Adv. Tarun Choudhury

Supreme Court Advocate | 25+ Years of Legal Experience

For legal guidance concerning banking disputes, unauthorised electronic transactions, online financial fraud and consumer protection remedies, you may get in touch for a professional assessment of your matter.

• 📞 Call: 9650499965
• 💬 WhatsApp: 8851978611
• ✉️ Email: admin@legalserviceindia.com

Legal Service India — Serving the legal community and the public since 2000.

Do not assume that a bank’s decision is the final word. Understand your rights, examine your remedies and take informed legal action.

Frequently Asked Questions

1. What Is the EU Refund-First Banking Rule?

The EU Refund-First Banking Rule refers to the principle clarified by the Court of Justice of the European Union (CJEU) in N.O. v PKO BP S.A., Case C-70/25.

Under Article 73 of the Payment Services Directive 2 (PSD2), a bank must generally refund an unauthorised payment transaction immediately and no later than the end of the following business day after becoming aware of it or receiving notification.

A bank cannot refuse this initial refund merely by alleging that the customer acted with gross negligence. The legal position remains subject to the specific fraud exception under Article 73.

2. Can a Bank Refuse to Refund Money Lost Through Online Banking Fraud by Alleging Customer Negligence?

Not merely on that ground under the interpretation clarified by the CJEU.

In its judgment dated 15 October 2026, the Court held that an allegation of gross negligence does not, by itself, permit a bank to bypass the immediate refund obligation under Article 73 PSD2.

However, this does not mean that the customer is automatically free from liability. Under Article 74, the bank may subsequently seek to establish that the customer committed fraud or intentionally or grossly negligently breached the relevant security obligations.

3. Does the EU Refund-First Banking Rule Apply to Phishing and Social Engineering Fraud?

The judgment concerned an unauthorised payment transaction involving phishing and deception.

The Court clarified the relationship between the immediate refund obligation under Article 73 and the allocation of liability under Article 74 PSD2.

However, whether a particular transaction qualifies as unauthorised depends on its facts and the applicable legal provisions.

The ruling should not be treated as an automatic refund guarantee for every authorised payment made by a customer who was deceived through social engineering.

4. Who Has the Burden of Proving That a Customer Authorised a Fraudulent Bank Transaction?

Under Article 72(2) PSD2, where a customer denies authorising a payment transaction, the payment service provider must provide evidence that the transaction was authenticated, accurately recorded and entered in its accounts.

Importantly, the mere recorded use of a payment instrument is not necessarily sufficient to prove that the customer authorised the transaction or acted fraudulently or with gross negligence.

The bank must provide supporting evidence.

This requirement is an important safeguard for victims of unauthorised electronic banking transactions.

5. Does the EU Refund-First Banking Rule Apply to Banking Fraud Cases in India?

No. The CJEU judgment interprets the EU’s Payment Services Directive 2 (PSD2) and is not binding on Indian banks or courts.

In India, unauthorised electronic banking transactions are principally governed by the Reserve Bank of India’s customer protection framework, including its circular dated 6 July 2017 on limiting customer liability.

Nevertheless, the EU Refund-First Banking Rule offers an important comparative perspective on consumer protection, bank accountability and the burden of proving unauthorised transactions.

Judgment Citation and Legal Authorities

Primary Judicial Authority

N.O. v PKO BP S.A. (Tukowiecka), Case C-70/25, Judgment of the Court (First Chamber), 15 October 2026, ECLI:EU:C:2026:852.

Relevant Paragraphs of the Judgment

Judgment Paragraphs	Legal Issue
Paragraphs 28–34	Interpretation of Article 73 and the immediate refund obligation.
Paragraphs 35–38	Relationship between Articles 73 and 74.
Paragraphs 40–42	Burden of proof and distinction between immediate refund and subsequent liability.
Paragraphs 43–47	Consumer protection objectives and subsequent recovery.
Paragraphs 48–50	Legislative history and alternative dispute resolution.
Paragraph 52	Final ruling.

Relevant Legislation

• Directive (EU) 2015/2366 (PSD2), Articles 69, 71, 72, 73, 74, 102 and 107.
• Proposed Payment Services Regulation, Council position at first reading, 29 October 2026.
• Proposed Third Payment Services Directive (PSD3).
• RBI Circular dated 6 July 2017, Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions.

Primary Sources for Publication

The following official sources should accompany the article:

• Original CJEU judgment: CJEU Judgment – Case C-70/25
• Official CJEU press release No. 147/2026: CJEU Press Release
• Council’s first-reading position on the proposed PSR: EU Council – Payment Services Regulation
• RBI customer protection circular: RBI Circular – Unauthorised Electronic Banking Transactions

Key Takeaways: EU Refund-First Banking Rule

The following key takeaways summarise the important legal principles established by the Court of Justice of the European Union (CJEU) in N.O. v PKO BP S.A., Case C-70/25, decided on 15 October 2026.

Key Legal Principle	Explanation
Banks must refund unauthorised transactions promptly	Under Article 73(1) of the Payment Services Directive 2 (PSD2), a bank must generally refund an unauthorised payment immediately and, at the latest, by the end of the following business day after becoming aware of it or receiving notification.
Alleged gross negligence is not a ground for withholding the initial refund	A bank cannot refuse an immediate refund merely because it alleges that the customer was careless or grossly negligent in protecting banking credentials.
Refund first, recovery later	The CJEU distinguished the bank’s immediate refund obligation under Article 73 from the subsequent allocation of financial liability under Article 74. A bank may pursue recovery later if it establishes the customer’s fraud or intentional or grossly negligent breach of security obligations.
The bank carries the burden of proof	Under Article 72(2) PSD2, merely showing that a payment instrument or security credentials were used does not necessarily prove that the customer authorised the transaction or acted fraudulently or with gross negligence. The payment service provider must produce supporting evidence.
The fraud exception is narrow	A bank may rely on the express exception in Article 73(1) where it has reasonable grounds to suspect fraud committed by the payer and communicates those grounds in writing to the competent national authority. Mere suspicion of customer negligence is not enough.
The judgment arose from a phishing incident	The case involved a customer who was deceived into entering banking credentials on a fraudulent website. The bank refused reimbursement on the ground of gross negligence. The CJEU clarified that such an allegation cannot independently defeat the immediate refund obligation.
The Court did not declare the customer free from liability	Whether the customer was actually grossly negligent remained a matter for the national court. The judgment determines the sequence of refund and possible recovery, not the ultimate factual outcome of every dispute.
The ruling does not automatically cover every form of online fraud	It concerns unauthorised payment transactions under PSD2. It should not be treated as a blanket refund guarantee for authorised payments made by customers who have been deceived, including every form of authorised push payment fraud.
The EU ruling does not directly govern Indian banks	The CJEU interpreted EU law. Indian electronic banking disputes remain governed by the applicable Indian legal and regulatory framework, including the Reserve Bank of India’s 6 July 2017 customer protection circular. The judgment may nevertheless provide a useful comparative perspective.
Future EU legislation may change the position	The Council’s first-reading position on the proposed Payment Services Regulation contemplates a more detailed process for investigating suspected customer fraud or gross negligence before refund. However, that legislative position should not be confused with the PSD2 rules interpreted by the Court or treated as law already in force.

The Central Legal Principle

The EU Refund-First Banking Rule separates the obligation to refund an unauthorised transaction from the question of who ultimately bears the financial loss.

A bank cannot avoid its immediate refund obligation merely by alleging customer gross negligence; it must follow the statutory process and establish any subsequent claim for recovery through evidence.

Important Links

• Lawyers in India
• Copyright Registration in India
• Caveat Filing in Supreme Court of India
• Mutual Consent Divorce in Delhi/NCR : WhatsApp 9650499965