A fresh opinion from the Court of Justice of the EU could materially shift the scam-loss battlefield across Europe. In Case C-70/25 (Tukowiecka), Advocate General Athanasios Rantos proposes that a bank must immediately refund an unauthorised payment once notified—even if the bank believes the customer acted with gross negligence. The bank’s remedy comes after the refund: pursue reimbursement through a separate claim.
Key Findings
- Immediate refund is the rule: PSD2 requires banks to reimburse unauthorised transactions “as a first step.”
- Gross negligence is not a “refund blocker”: banks cannot refuse reimbursement upfront by alleging the user breached security duties.
- Only narrow exception flagged: if the bank has good reason to suspect payer fraud, it must report that suspicion to the competent national authority.
- Refund is not final: after refunding, the bank may seek to shift losses back to the customer if it can prove intentional breach or gross negligence (and may need to sue if the customer refuses).
- Case context: phishing via a sales platform link led to stolen credentials and an unauthorised payment; the Polish bank refused to refund; District Court in Koszalin asked the CJEU to interpret PSD2.
Short Analysis
This dispute sits at the heart of PSD2’s consumer-protection design: unauthorised payments are meant to be reversed quickly to prevent victims from financing fraud losses while banks and merchants argue fault. Rantos’ reading of Directive (EU) 2015/2366 (PSD2) treats “immediate reimbursement” as a hard requirement, leaving no room for national carve-outs that effectively turn refund duties into a negligence trial at the complaint desk.
Operationally, the opinion pushes banks toward a two-step model:
- Refund fast (unless there is a documented fraud suspicion reported to authorities), then
- Litigate or recover later if gross negligence is provable.
For compliance teams, the implication is blunt: the “customer was careless” narrative may remain relevant—but not at the refund stage. Expect pressure on banks to tighten real-time fraud detection, strong customer authentication controls, and post-incident evidence collection (device/IP telemetry, authentication logs, social-engineering indicators) to support any later recovery action.
Important: Advocate General opinions are not binding; the CJEU will deliberate and issue judgment later. Still, these opinions often preview the direction of travel—and the compliance risk for banks that default to “deny first” practices may rise sharply if the Court follows Rantos.
Meta Data
- Title tag: CJEU AG Rantos: Banks Must Refund Unauthorised Payments Immediately Under PSD2
- Meta description: In Case C-70/25 (Tukowiecka), CJEU Advocate General Rantos says banks must refund unauthorised transactions immediately—even where customers were grossly negligent—then pursue recovery separately.
- Keywords: PSD2, unauthorised transaction, phishing, bank liability, CJEU, Advocate General Rantos, PKO BP, Koszalin
- Pub date: 2026-03-10
- Author: FinTelegram Compliance Desk
- Tags: PSD2, Banking, Fraud, Phishing, Consumer Protection, CJEU
- Canonical URL: (set by editor)
Image Alt Text
Dark forensic compliance graphic: EU court building silhouette with a “REFUND IMMEDIATELY” stamp over a bank app showing an unauthorised transfer, plus a second layer reading “RECOVER LATER (if gross negligence proven)” and PSD2 article markers.
Call for Information
Have you been denied reimbursement after a phishing scam, APP fraud, SIM-swap, or “authorised push payment” manipulation—especially where a bank blamed “gross negligence”? FinTelegram is gathering EU-wide case patterns. Submit documents, timelines, and bank correspondence securely via Whistle42.com.
