Immediate Reimbursement in Bank Fraud Cases: Gross Negligence Does Not Justify Refusal (CJEU, Advocate General’s Opinion, 5 March 2026, Case C-70/25)

Court of Justice of the European Union, Opinion of the Advocate General, 5 March 2026, Case C-70/25

Nature and Scope of the Advocate General’s Opinion

Before going into the detail of the analysis, it is essential to clarify the nature of the document discussed here. The Opinion of the Advocate General is not a decision of the Court of Justice of the European Union. It is a reasoned legal opinion, drafted by an independent member of the Court, whose role is to assist the Court as to the interpretation of European Union law in a given case.

The Advocate General examines the questions referred, analyses the applicable texts, the relevant case law and the parties’ arguments, and then proposes to the Court the solution that seems to him most consistent with the law. However, his Opinion is not binding on the Court of Justice. The Court may follow it, depart from it in part, or even adopt an entirely different position.

In the present case, the Opinion delivered on 5 March 2026 proposes an interpretation that is particularly favourable to consumers who are victims of bank fraud. It will be necessary to await the Court’s final judgment to find out whether this reading will be confirmed, qualified or overturned.

The Legal Background: the European Payment Services Directive

Directive (EU) 2015/2366, known as the PSD2 Directive (the second Payment Services Directive), harmonises the rules applicable to payment transactions throughout the European Union. Its objective is twofold: on the one hand, it seeks to create an efficient and secure internal market for payments; on the other, it aims to guarantee a high level of consumer protection against the risks of fraud.

Recital 71 of that Directive clearly expresses the balance sought: “In the event of an unauthorised payment transaction, the payment service provider should immediately refund the amount of that transaction to the payer.” It nevertheless provides for a strict exception: if the provider has “reasonable grounds for suspecting fraud” on the part of the customer himself, and communicates those grounds to the competent authorities, it may suspend the reimbursement for the duration of an investigation.

Two articles are at the heart of the debate in this case: Article 73(1), which requires the bank to reimburse immediately, and Article 74(1), which defines the payer’s liability. The central question put to the Court: are these two provisions to be read together in such a way as to allow the bank to refuse immediate reimbursement if it considers that the customer has been grossly negligent?

The Case: a Phishing Victim Faces Her Bank’s Refusal

The case giving rise to this reference for a preliminary ruling originates in Poland. A customer (referred to under the pseudonym N.O.) of the bank PKO BP S.A. fell victim to a phishing scam that was thoroughly classic yet remarkably effective. While she was offering an item for sale on an online platform, she received a message from a purported buyer. The latter sent her a fraudulent link faithfully reproducing the interface of the sales platform, and then that of her bank.

Deceived by the authentic appearance of these pages, the customer entered her online banking login credentials. The fraudster, having obtained this data, immediately carried out an unauthorised payment transaction from her bank account. The very next day, the customer noticed the fraud and immediately reported it to both her bank and the police.

Despite the customer’s swift reaction, the bank refused to reimburse her. Its argument? The customer had allegedly committed gross negligence by disclosing her login details, thereby failing in her obligation to keep her payment instrument secure. According to the bank, this gross negligence justified refusing the immediate reimbursement provided for by the European directive.

Faced with this uncompromising stance, the customer brought proceedings before the Koszalin District Court (tribunal d’arrondissement de Koszalin) to claim reimbursement of the sum fraudulently debited: 3,000 Polish zlotys (approximately €705). It was in this context that the Polish judge decided to ask the Court of Justice of the European Union about the correct interpretation of the directive.

The Question Referred to the CJEU for a Preliminary Ruling

The Polish court put a precise question to the Court of Justice: “Are Article 73(1) and Article 74(1) of Directive 2015/2366, read together, to be understood as meaning that a payment service provider may refuse to immediately reimburse a payer the amount of an unauthorised payment transaction where the latter has suffered a loss relating to an unauthorised payment transaction because, through gross negligence, he failed to comply with the obligations laid down in Article 69?”

This question raises a fundamental issue: the relationship between the principle of immediate reimbursement and the customer liability regime. Two opposing readings clash:

The bank’s position: Article 74(1) of the Directive provides that the payer bears all the losses in the event of gross negligence. That provision would constitute an exception to the principle of immediate reimbursement set out in Article 73(1). Accordingly, if the bank establishes the customer’s gross negligence, it would be released from the obligation to reimburse immediately.

The customer’s position: Article 73(1) lists the exceptions to immediate reimbursement exhaustively and restrictively: only the existence of “reasonable grounds for suspecting fraud” by the customer, reported to the authorities, allows the reimbursement to be suspended. Gross negligence does not appear on that list. Consequently, the bank must reimburse immediately, leaving it free to bring proceedings against the customer afterwards to obtain repayment if it demonstrates her negligence.

The Principle of Immediate Reimbursement: a Strict Rule

The Advocate General begins his analysis with an in-depth examination of the wording of Article 73(1) of the Directive. That provision requires Member States to ensure that “in the case of an unauthorised payment transaction, the payer’s payment service provider refunds the payer the amount of the unauthorised payment transaction immediately after noting or being notified of the transaction, and in any event no later than by the end of the following business day“.

The term “immediately” is accompanied by a mandatory deadline: one business day at most. This wording reflects the European legislature’s intention to establish a rapid and effective protection mechanism for consumers who are victims of fraud. Reimbursement is neither optional nor deferred: it must take place without delay.

The Exception: Serious Suspicion of Fraud by the Customer

Article 73(1) provides for a single explicit exception to this obligation: “where the payer’s payment service provider has reasonable grounds for suspecting fraud and communicates those grounds in writing to the relevant national authority”. This exception rests on two strict, cumulative conditions:

• Substantive condition: The existence of “reasonable grounds” (a strong presumption) for suspecting that the unauthorised transaction results from fraudulent conduct by the user himself. This is not a mere suspicion, but suspicions based on objective and serious evidence.
• Formal condition: The communication in writing of those grounds to the competent national authority. This formality ensures external scrutiny of the bank’s decision and prevents abuse.

The Advocate General stresses that this exception targets situations where the customer himself is the perpetrator or an accomplice of the fraud. It does not cover cases where the customer, although a victim, has shown negligence in protecting his data.

Gross Negligence Is Not an Exception

A textual analysis of Article 73(1) shows that it provides for no exception other than the one relating to suspected fraud by the customer. Gross negligence, even if established, does not appear in it. According to the Advocate General, “at first sight, on a literal interpretation of Article 73(1) of Directive 2015/2366, […] by expressly stating derogations from the obligation to immediately refund the amount of an unauthorised transaction, that provision does not allow the list of derogations to be extended to other situations not provided for therein”.

This interpretation is all the more convincing because the European legislature expressly amended this provision when adopting Directive 2015/2366. The former 2007 directive provided for no exception to immediate reimbursement. By introducing the exception relating to suspected fraud, the legislature showed its intention to delimit precisely the situations in which reimbursement may be suspended. Had it wished to include gross negligence, it would have done so explicitly.

The Allocation of Liability: Two Distinct Stages

The analysis continues with an examination of Article 74(1) of the Directive, which governs the payer’s liability. That text, entitled “Payer’s liability for unauthorised payment transactions”, opens with the phrase: “By way of derogation from Article 73”. This wording might suggest that it is an exception to immediate reimbursement.

Yet the Advocate General proposes a different reading. In his view, Article 74 does not concern the conditions of immediate reimbursement, but the subsequent allocation of liability between the customer and the bank. It determines who will, in fine, have to bear the cost of the fraud.

Stage 1: Mandatory Immediate Reimbursement

In the first stage, as soon as the bank is informed of an unauthorised transaction, it should reimburse the customer without delay (by the following business day at the latest), except in the sole case where it has reasonable grounds for suspecting fraud by the customer and informs the authorities.

This immediate reimbursement would in no way prejudge final liability. It would be a measure of provisional protection for the consumer, intended to prevent him from suffering prolonged financial harm while the circumstances of the fraud are investigated.

Stage 2: the Subsequent Allocation of Liability

In the second stage, after the reimbursement, the question of final liability would arise. This is where Article 74(1) of the Directive comes into play. That text distinguishes three situations:

(a) Limited liability of the payer (general case): The payer bears a maximum loss of €50 where a lost, stolen or misappropriated payment instrument is used, unless he acted fraudulently or the loss results from acts attributable to the bank.

(b) Unlimited liability for fraud or intent: The payer bears all the losses if he acted fraudulently or intentionally failed to fulfil his obligations.

(c) Unlimited liability for gross negligence: The payer also bears all the losses if he failed to fulfil his obligations “through gross negligence”. It is this scenario that is at issue in the case.

The Advocate General considers that Article 74 “does not concern the immediate reimbursement of the amount of an unauthorised payment transaction, but focuses on the allocation of liability between the payer and the payment service provider, in order to determine who is to be held liable subsequently, in the course of the proceedings, and, as a consequence, bear the losses caused by such transactions.”

Thus, on this reading proposed by the Advocate General, Article 73 and Article 74 would govern two distinct procedural stages. The first would require immediate and provisional reimbursement. The second would organise the final settlement of the dispute, which could lead, if the bank manages to demonstrate the customer’s gross negligence, to an obligation of repayment on the latter.

The Customer’s Obligations and Gross Negligence

To fully understand what is at stake, it is worth recalling the obligations that rest on the customer and the consequences of breaching them.

Obligations under Article 69 of the Directive

Article 69 of the Directive, entitled “Obligations of the payment service user in relation to payment instruments and personalised security credentials”, imposes two main types of obligation on the customer:

(a) Use of the payment instrument in accordance with its terms: The customer must use the payment instrument (bank card, login credentials, etc.) in accordance with the terms governing its issue and use. Those terms must be objective, non-discriminatory and proportionate.

(b) Security measures and notification: The customer must take all “reasonable steps” to keep his personalised security credentials (codes, passwords, etc.) safe. In addition, as soon as he becomes aware of the loss, theft, misappropriation or any unauthorised use of his payment instrument, he must notify his provider “without undue delay”.

A breach of these obligations may be of varying degrees of seriousness: simple negligence, gross negligence, or intent (or even fraud). Only the last two degrees (gross negligence and intent/fraud) result in unlimited liability of the customer under Article 74(1).

Burden of Proof: the Bank Must Establish the Fault

Article 72(2) of the Directive lays down an essential rule on evidence: “Where a payment service user denies having authorised an executed payment transaction, the use of a payment instrument recorded by the payment service provider […] shall not, in itself, necessarily be sufficient to prove either that the payment transaction was authorised by the payer or that the payer acted fraudulently or failed with intent or gross negligence to fulfil one or more of the obligations under Article 69.”

In other words, the mere technical traceability of the transaction (for example, a record of the use of the login credentials) is not enough to reverse the burden of proof. It is for the bank to provide probative evidence demonstrating the customer’s fraud or gross negligence. This rule is intended to protect the consumer, who is generally in a position of informational and evidentiary inferiority vis-à-vis the financial institution.

The Objectives of Consumer Protection

The Advocate General devotes a significant part of his analysis to examining the objectives pursued by Directive 2015/2366. This teleological examination supports the interpretation he proposes.

Full Harmonisation at European Level

Article 107 of the Directive provides for full (or “maximum”) harmonisation in the areas it covers, including the liability regime for unauthorised transactions. Member States may therefore not adopt national provisions that are stricter or more lenient than those laid down by the European text. This harmonisation aims to guarantee a uniform level of protection throughout the Union and to avoid distortions of competition.

Consequently, banks could not rely on contractual clauses or national provisions that would restrict the obligation of immediate reimbursement beyond the exceptions expressly provided for in Article 73(1) of the Directive. Any derogation to the consumer’s detriment would be prohibited, unless expressly authorised by the European text.

Shifting the Procedural Burden onto the Bank

One of the major arguments developed by the Advocate General relates to the objective of rebalancing the procedural position between the consumer and the bank. Before the adoption of Directive 2015/2366, a widespread practice among banking institutions was to systematically refuse reimbursement by invoking the customer’s fault, forcing the latter to go to court to obtain redress.

This situation placed the consumer at a twofold disadvantage: on the one hand, he immediately suffered the financial loss caused by the fraud; on the other, he had to bear the costs, delays and uncertainties of legal proceedings. The Advocate General considers that “it is precisely to prevent such practices that the Union legislature, by amending Article 73(1) of Directive 2015/2366, intended to strengthen consumer protection.”

By requiring immediate reimbursement, the Directive would shift the burden of bringing legal proceedings from the consumer to the bank. It would henceforth be for the latter, a professional with substantial legal and technical resources, to commence proceedings if it considers that the customer has committed a gross fault justifying repayment of the sums reimbursed. This procedural reversal would be an essential guarantee of effective consumer protection.

The Practical Consequences if the Court Follows the Opinion

For Fraud Victims

If the Court of Justice follows the Advocate General’s Opinion in its final judgment, the consequences for victims of bank fraud would be considerable and positive:

Systematic and swift reimbursement: As soon as the unauthorised transaction is reported, the bank would have to reimburse by the following business day, without being able to invoke possible negligence on the customer’s part to defer or refuse payment. The customer would immediately recover the lost funds.

No litigation to bring (unless of an unlawful refusal): The customer would no longer have to go to court to obtain reimbursement. If he nevertheless had to do so (because the bank unlawfully refuses), he would be in a very strong procedural position, since the Directive would clearly impose that obligation.

Limited risk of having to repay: It is true that the bank could subsequently bring an action for repayment if it demonstrates gross negligence. But in that scenario, it would be the one to commence the proceedings, bear the costs and carry the burden of proof. In practice, many banks would probably forgo such an action where the amount at stake is modest or where the evidence of gross negligence is uncertain.

Enhanced protection against sophisticated fraud: Phishing and social engineering techniques are becoming increasingly elaborate. It would often be difficult for the bank to characterise “gross negligence” where the customer was deceived by a particularly credible fraudulent scheme.

For Banks

For banking institutions, this interpretation, if confirmed by the Court, would entail new constraints:

Immediate cash obligation: Banks would have to systematically provision for the reimbursement of unauthorised transactions reported by their customers, failing which they would breach the Directive. In some cases this could represent significant amounts, particularly in the event of mass fraud.

Need for swift investigations: To rely on the exception relating to suspected fraud by the customer (and thereby defer reimbursement), the bank would have to quickly gather objective evidence and communicate it to the authorities. The one-business-day deadline would leave very little time to carry out an in-depth investigation.

Bringing actions for repayment: If the bank wishes to recover the sums reimbursed in the event of the customer’s gross negligence, it would have to bring legal proceedings, with the costs and uncertainties that entails. This could prove a deterrent for small amounts.

Strengthened prevention: Faced with this new situation, banks would be encouraged to invest more in fraud prevention (strong authentication systems, real-time alerts, behavioural detection) and in informing customers about the risks.

Distinction from Earlier Case Law (the Veracash Case)

The Advocate General takes care to distinguish the present case from earlier case law that might appear contradictory: the Veracash judgment of 1 August 2025. In that case, the Court had held that the payment service provider’s obligation to immediately reimburse the amount of an unauthorised transaction was “subject to the exceptions provided for” by the Directive, in particular those relating to the payer’s liability in the event of gross negligence.

However, the Advocate General stresses that the Veracash case concerned a very different situation: the customer had failed to inform the bank, within the prescribed time limits, of the existence of the unauthorised transaction. Yet Article 71 of the Directive expressly provides that the right to reimbursement is conditional on notification “without undue delay” of the disputed transaction. That case therefore involved a breach of a precondition for exercising the right to reimbursement.

In the present case, by contrast, it is not disputed that the customer informed her bank immediately upon discovering the fraud (the next day). The question concerns exclusively whether the bank may refuse reimbursement by invoking prior negligence by the customer (disclosure of the login credentials). The two situations would therefore not be comparable.

The Advocate General concludes that “if Article 60(1) of Directive 2007/64 provided for no exception to the obligation to immediately refund an unauthorised payment transaction, the Union legislature considered it necessary to amend that provision by introducing in Article 73(1) of Directive 2015/2366 an express exception to the obligation of immediate reimbursement, limited to the situation where the payment service provider has reasonable grounds for suspecting fraud.”

Conclusion: a Solid Argument Awaiting Confirmation

At the end of his meticulous analysis, the Advocate General proposes that the Court of Justice answer that Article 73(1) and Article 74(1) of Directive 2015/2366 “preclude a payment service provider from refusing to immediately reimburse the payer the amount of an unauthorised payment transaction on the ground that the payer has suffered a loss relating to that payment transaction because, through gross negligence, he failed to comply with the obligations incumbent on him under Article 69 of that directive.”

This proposed interpretation would mark a major reversal of traditional banking practice. It would assert forcefully that the customer’s gross negligence, even if established, would not release the bank from its obligation to reimburse immediately. That obligation would be subject to a single exception: serious suspicion of fraud by the customer himself, reported to the authorities.

However, it should be recalled that, at this stage, these are only the Opinion of the Advocate General. Although the argument developed is particularly well supported and convincing, it is not binding on the Court of Justice. The final judgment, expected in the coming months, may confirm, qualify or set aside this analysis.

This case perfectly illustrates the tension between, on the one hand, the need to protect consumers effectively in the complex and risky world of electronic payments and, on the other, the concern to make users accountable by encouraging them to comply with security rules. The Advocate General proposes to decide resolutely in favour of the former concern, considering that consumer protection requires immediate and unconditional reimbursement, leaving the bank free to recover the sums later if it demonstrates gross fault.

It now remains to await the final judgment of the Court of Justice, which will be scrutinised closely by all players in the banking sector and by the millions of European consumers who use online payment services every day. That judgment will determine whether the argument put forward by the Advocate General will be enshrined as a rule of law binding on all Member States of the Union.

FAQ