Gross Negligence by Fraud Victims Does Not Exempt Banks from Immediate Reimbursement Obligations

Banks and other payment service providers are required to immediately refund — or, at the latest, by the end of the following business day — amounts lost by victims of online fraud, such as phishing, even where they consider that the customer acted with gross negligence. This was established by the Court of Justice of the European Union (CJEU) in a judgment delivered on 15 October, in response to a request from a Polish court, the interpretation of which is equally binding on courts in the other Member States.

“The fact that a payment service provider considers that the customer made the unauthorised transaction possible through gross negligence — in particular, by failing to take the necessary measures to protect their personalised security credentials — does not entitle it to refuse immediate reimbursement,” the Luxembourg-based Court ruled, clarifying the interpretation of Directive (EU) 2015/2366 of the European Parliament and of the Council on payment services.

The CJEU’s ruling arose from a case involving a customer of a Polish bank who fell victim to a phishing scam after advertising an item for sale on an online marketplace. An individual posing as a prospective buyer sent the seller a fraudulent link, purportedly originating from the platform and intended to confirm the sale. The seller clicked on the link and was redirected to a webpage designed to replicate her bank’s website, where she entered her online banking credentials. Using those credentials, the fraudster managed to transfer approximately 700 euros from the woman’s account to an account under his control.

The following day, the customer reported the fraudulent transaction to the police and her bank. However, the bank refused to reimburse the 700 euros, arguing that she had failed to protect her security credentials through gross negligence. The customer subsequently brought proceedings before a Polish court, which, faced with uncertainty as to the applicable interpretation of EU law, referred the matter to the CJEU for a preliminary ruling.

Adopting an approach aimed at ensuring a “high level of consumer protection”, the CJEU concluded that gross negligence does not release a payment service provider from its obligation to provide immediate reimbursement. The Court held that EU law distinguishes between the obligation to reimburse an unauthorised transaction and the question of who must ultimately bear the resulting losses. Accordingly, at a subsequent stage, the bank may seek to recover the reimbursed amount from the customer if it proves that the customer acted with gross negligence.

The CJEU recognises only one exception to the obligation of immediate reimbursement: where the payment service provider has reasonable grounds to suspect fraud committed by the customer and communicates those grounds in writing to the competent national authority.

“This ruling reverses the roles,” says lawyer

“Banking institutions will need to revise their procedures,” comments Porto-based lawyer Sara Peixoto, explaining that “until now, individuals who experienced situations such as the one described in the CJEU judgment and whose reimbursement requests were refused were forced to bring legal proceedings.”

“This ruling reverses the roles: the money must be refunded and, if the bank considers that the customer acted with gross negligence, it is the bank that must take action and provide the necessary evidence,” explains the lawyer at Dower Law Firm.

In cases of fraud, she advises victims to file a police report, notify their bank immediately and request reimbursement in writing, keeping records of all communications.

“If the bank refuses reimbursement solely on the grounds that you were careless, you should be aware that you have grounds to challenge that refusal,” she states.

Nevertheless, she stresses the importance of remaining vigilant when receiving links via text messages and never entering banking credentials on websites accessed through such links.

“The fact that the bank is required to reimburse the customer does not prevent it from subsequently pursuing a claim against that customer,” she adds.

The question...

The judgment of the Court of Justice of the European Union (CJEU) followed a question referred by the Polish court under the judicial cooperation mechanism known as the preliminary ruling procedure.

This procedure allows courts of EU Member States to request a ruling from the CJEU on the interpretation of EU law or the validity of an act of the European Union.

... And the answer

The CJEU does not itself determine the national dispute that gave rise to the request for a preliminary ruling. It is for the referring national court to decide the case in accordance with the interpretation provided by the CJEU.

That interpretation is equally binding on all national courts faced with a similar question of EU law.