The Court of Justice of the European Union (CJEU) has ruled that a bank must refund money lost to fraud even where the customer was grossly negligent, and only then work out who should bear the loss. The ruling came in a case involving a Polish woman who was defrauded through phishing.
Payment service providers must refund unauthorised transactions without delay. The refund is due at the latest by the end of the working day after the day the bank recorded the transaction or learned of it, provided the customer reported it without undue delay. The court made clear that the bank must always refund the money immediately.
HOW THE POLISH PHISHING CASE UNFOLDED
The customer of a Polish bank was targeted by a third party who posed as a buyer on a sales platform. The fraudster sent her a link imitating her bank's website.
Having been taken in, she entered her login details on the fake site. This allowed the fraudster to retrieve them and make an unauthorised payment from her account.
The bank refused to refund the amount, taking the view that she had been grossly negligent in disclosing her bank details. The dispute reached the CJEU after a Polish court asked it to clarify the rules.
LIMITED GROUNDS TO WITHHOLD A REFUND
A bank may withhold the money only if it has reasonable grounds to suspect that the customer herself committed fraud and reports those suspicions to the relevant national authority. Gross negligence alone does not meet that test.
If the bank proves that the customer caused the loss through intentional conduct or gross negligence, it can subsequently seek compensation from her. That step comes after the refund has been paid.
BURDEN OF PROOF RESTS WITH THE BANK
The burden of proof lies entirely on the bank, which must bring the evidence of the customer's negligence. A bank that suspects negligence therefore has to refund first and make its case afterwards.
CUSTOMERS FACE A REPORTING DEADLINE
The Advocate General noted that, under Directive 2015/2366, a payer must inform the bank of an unauthorised transaction without undue delay and at the latest within 13 months of the debit. That aspect was not relevant in the present case.