CJEU confirms immediate refund of unauthorised payments, even in case of gross negligence

On 15 October 2026, the Court of Justice of the European Union (CJEU) delivered its judgment in Case C-70/25, Tukowiecka, clarifying that payment service providers must generally refund unauthorised payment transactions immediately, even where they consider that the customer acted with gross negligence. However, providers may subsequently seek reimbursement from customers for losses resulting from their intentional or grossly negligent conduct. 

Background

The case concerned a customer (the “Applicant”) of a Polish bank who fell victim to a phishing attack while selling an item through an online platform. After following a fraudulent link to a website impersonating the Applicant’s bank and entering her online banking credentials, approximately EUR 700 was transferred from her account by an unauthorised third party. The transaction was authorized by the perpetrator of the fraud by means of a confirmation code sent by SMS and obtained from the Applicant. The Applicant notified the bank and the police the next day, but the bank refused to refund, claiming she had been grossly negligent in safeguarding her payment instrument.

The referring court asked the CJEU, in essence, whether Article 73(1) and Article 74(1) of Directive 2015/2366 (“PSD2”) allow a payment service provider to refuse to refund immediately an unauthorised payment transaction on the ground that the payer made it possible through gross negligence, in breach of Article 69 of that directive.

The Decision

The CJEU held that a payer’s gross negligence cannot justify refusing an immediate refund. Under Article 73(1) of the PSD2, providers must generally refund unauthorised payments immediately and, in any event, by the end of the business day following the day on which they noted or were notified of the transaction. Pursuant to Article 71(1) of the PSD2, the payer must notify the provider without undue delay after discovering the transaction and, generally, within 13 months of the debit date.

The Court found that the only exception under Article 73(1) of the PSD2 applies where the payment service provider has reasonable grounds to suspect fraud by the customer and communicates those grounds to the relevant national authority in writing within the time available for the refund. The Court emphasises that suspected gross negligence, including failure to safeguard personalised security credentials, does not fall within the exception.

The Court distinguished the immediate refund obligation from the subsequent allocation of liability under Article 74(1) of the PSD2. Providers may seek reimbursement through the available legal remedies where the losses resulted from the payer’s intentional or grossly negligent breach of Article 69 obligations. The Court further noted that, under Article 72(2) of the PSD2, the provider bears the burden of proving gross negligence. Article 72(2) also states that the recorded use of a payment instrument is not, by itself, necessarily sufficient to establish that the payer authorized the transaction or acted with gross negligence.

The Court’s interpretation supports PSD2’s objective of ensuring a high level of consumer protection, clarifying that payers should not have to initiate proceedings and bear the associated costs to obtain an immediate refund.

Practical implications

Payment service providers should ensure that their procedures distinguish between the immediate refund obligation and the subsequent allocation of liability and may also consider incorporating an initial notice informing consumers of any intended recovery proceedings and advising consumers to keep the refunded amount available pending resolution of the claim. A payer’s gross negligence in enabling an unauthorised payment transaction does not, in itself, justify withholding an immediate refund. Subject to the notification requirements under Article 71 and the exception for suspected fraud by the payer under Article 73(1) PSD2, the provider must refund the amount within the prescribed timeframe. It may subsequently seek reimbursement through the available legal remedies where the losses resulted from the payer’s intentional or grossly negligent breach of Article 69.

For our earlier analysis of the Advocate General’s opinion, please see our previous article here.

For further information on the impact of the decision and how to mitigate risks arising from PSD2, contact your CMS client partner or the CMS experts who contributed to this article.

This article was co-authored by Barnabás Czakó-Somogyi.