ECJ: Banks must initially reimburse phishing losses

The European Court of Justice (ECJ) has strengthened bank customers’ rights in a ruling involving a classic phishing scam targeting a Polish bank customer. Under the ruling, payment service providers must initially reimburse losses from unauthorized payments, regardless of who is at fault (Case No. C-70/25) – and do so without delay, no later than the end of the business day after they are notified.

In this case, a fraudster directed a bank customer to a website resembling her bank’s login page while she was making an online sale. She entered her login credentials there, and the fraudsters immediately used them to make a transfer. The bank refused to reimburse the loss of around €700, arguing that the customer had acted with gross negligence.

Separate reimbursement from liability

The ECJ, asked for guidance by a Polish court, has now clarified that EU law requires the bank to reimburse the loss without delay. “Under EU law, the question of reimbursing the amount of an unauthorized payment transaction can be separated from the question of who ultimately bears the losses associated with such a transaction”, the ECJ said Thursday.

The bank must therefore reimburse the loss first and can only then try to shift liability to the customer. The bank or payment service provider must prove that the customer acted intentionally or with gross negligence.

EU law — specifically the Payment Services Directive — provides for only one exception, according to the ECJ: when the bank has reasonable grounds to suspect that the customer is acting fraudulently and reports this to the authorities.

Consumer advocates say customers in Germany are increasingly having to fight with their financial institutions when phishing scams occur. “The legislature must act now to turn the legal right to reimbursement into a reality”, said Ramona Pop, head of the Federation of German Consumer Organizations (Verbraucherzentrale Bundesverband, vzbv).

Will the Payment Services Regulation help?

The EU wants to address the problem in its new Payment Services Regulation (PSR). Bank customers are supposed to find it easier to assert their claims in cases of fraud. Banks are also supposed to take the specific circumstances of individual cases into greater account. The EU institutions have already agreed on the regulation, but the PSR has not yet entered into force. Critics doubt that it will do much to help consumers.

Experience in Germany shows that banks invoke gross negligence and use it as grounds to refuse reimbursement for phishing losses. But as fraudsters grow more sophisticated, even experienced users find it harder to recognize phishing attacks.

That recognition has recently been reflected in several court rulings in which judges have held banks accountable. In a case against Apobank, Berlin II Regional Court also pointed to the bank’s inadequate fraud prevention. That, too, is an area the EU wants to address with the PSR.

(vbr)