ECJ confirms that PSPs must refund unauthorised payments before trying to reclaim in cases of gross negligence

The European Court of Justice has ruled on the requirement for payment service providers (PSPs), including banks, to refund unauthorised transactions. Confirming the Opinion of Advocate General Rantos, the Court holds that the Payment Services Directive (PSD2) requires the PSP to refund immediately the amount of the unauthorised transaction, unless it has reasonable grounds for suspecting fraud. If the PSP subsequently establishes that the customer failed with gross negligence to meet its obligations as a payment service user, the PSP may then seek reimbursement from that person, including by taking legal action.

In N.O. v PKO BP S.A. (Case C‑70/25), a retail customer of a Polish bank was the victim of a phishing attack after advertising an item for sale online. She was tricked into entering her online banking login details on a spoofed website that the fraudster used to transfer the equivalent of €705 from her account. The next day, having realised what had happened, shenotified the bank and the police. The bank refused to refund the amount on the ground that the customer had, through gross negligence, failed to safeguard her payment credentials. The Polish court asked the ECJ to consider whether a PSP can refuse to refund a payer immediately where the payer’s own gross negligence contributes to an unauthorised transaction.

Article 73 PSD2 says that PSPs should refund the amount of the unauthorised payment transaction immediately and in any event no later than by the end of the following business day, unless the PSP has reasonable grounds for suspecting fraud. Article 74 provides a derogation from Article 73 such that the payer bears losses relating to unauthorised payment transactions incurred where they fail to meet their obligations as a payment service user with intent or gross negligence. Those obligations for payment service users are under Article 69 and include keeping personalised security credentials safe.

The Court notes that it is not possible to determine unequivocally whether the derogation in Article 74 affects the immediate refund obligation in Article 73 or whether it concerns only the definitive nature of the refund, meaning that the PSP must refund first and may only subsequently seek reimbursement from the payer. The Court has adopted the latter interpretation, holding that it is consistent with PSD2’s objective of ensuring a high level of consumer protection.

Following this decision, EU banks and other PSPs will need to reassess how they reimburse customers after unauthorised transactions. The only exception to making a refund immediately remains suspected fraud, which can be difficult to establish within the one-business-day window. Firms will also need to consider their appetite for using the court system to reclaim refunds where they consider customers to have acted with gross negligence. Separately, firms should bear in mind that the regime is going to be replaced by the Payment Services Regulation and so these internal processes may need to be revisited again in the next couple of years.