The Court of Justice of the European Union (CJEU) provided clarification: a bank must reimburse a customer for funds debited without authorisation during a phishing attack, even if the person disclosed login details to the fraudsters.
How the phishing attack took place
The attack began during the sale of an item through an online platform, when a prospective buyer sent a link supposedly to confirm the transaction. The link led to a forged bank page where the woman entered her internet banking login details.
Those details allowed the fraudster to gain access to the account and transfer about 700 euros.
Bank reaction and initial court proceedings
The customer reported the unauthorised debit to the bank the next day, but the bank refused to reimburse the loss. The financial institution considered that the woman had enabled the theft through gross negligence by failing to protect her login details.
The woman brought the case before a Polish court, which referred the question to the Court of Justice of the European Union for interpretation in order to determine whether a bank may withhold reimbursement on the basis of suspected customer negligence.
CJEU ruling on immediate reimbursement
The Court ruled that a bank cannot refuse immediate refund solely because it suspects customer negligence. Under EU rules, the financial institution must reimburse the amount of an unauthorised transaction immediately after being notified of it, and no later than the end of the next business day from the moment it became aware of the debit.
A customer is obliged to notify the bank of the fraud “without undue delay.” The only exception is that the bank may refrain from immediately returning the funds if it has reasonable grounds to suspect that the customer themselves committed the fraud and has notified the competent national authority of that suspicion.
Liability for losses and burden of proof on negligence
The Court’s decision does not in principle absolve the customer from possible liability for the loss. After reimbursing the customer, the bank may seek compensation if it proves that the customer intentionally or through gross negligence breached their obligations to protect security credentials.
The Court emphasised that it is the bank that must prove the customer’s gross negligence or intent, not the other way around. The dispute between the customer and the bank must be decided by the Polish court taking this clarification into account, which also serves as guidance for other national courts.
