Banks Must Refund Phishing Victims by the Next Business Day Even When They Claim Negligence, EU Court Rules

A bank cannot refuse to refund a phishing victim straight away just because it believes the customer was careless with their login details. That is the ruling the Court of Justice of the European Union handed down on 15 October in Case C-70/25, and it applies in Portugal, whose payment law comes from the same EU directive. ECO brought the judgment to Portuguese readers this morning.

The bank must pay first. Only afterwards can it try to recover the money, and only if it proves the customer acted with negligência grosseira (gross negligence).

What the court decided

According to the judgment, a Polish woman selling an item online received a link that appeared to confirm the sale. It led to a fake copy of her bank's website, where she typed in her banking details. The fraudster moved 3,000 zlotys (about 705 euros) out of her account, using an SMS confirmation code also obtained from her by deceit. Her bank, PKO BP, refused to refund her, arguing she had been grossly negligent.

The court disagreed. Under the EU payment services directive, a bank must refund an unauthorised payment immediately, and no later than the end of the next business day. There is only one exception: where the bank has reasonable grounds to suspect fraud by the customer and reports them in writing to the authorities. Suspected carelessness is not on that list.

Refusing at the outset, the court said, would strip the immediate refund of its purpose and force customers to sue, at their own cost. As the court's press release notes, its reading binds national courts facing a similar question.

What Portuguese law already says

Portugal wrote the directive into national law through Decreto-Lei 91/2018, the payment services and electronic money regime. Its five amendments since 2018 left the fraud-victim articles untouched. The current consolidated text provides:

• Refund deadline: article 114 requires your bank to refund an unauthorised payment by the end of the first business day after it learns of it, unless it suspects fraud by you and reports that in writing to the judicial authorities.
• Interest if it stalls: a bank that holds back the refund without such a report owes late-payment interest at the legal rate plus 10 percentage points.
• Burden of proof: under article 113, a login or code recorded on the bank's system is not enough on its own to prove you authorised the payment or were grossly negligent.
• Your share: article 115 caps liability at 50 euros for payments made with a lost, stolen or misappropriated payment instrument before you report it. Gross negligence lifts the cap to the account balance or credit limit. If the bank did not require strong authentication, you bear nothing unless you acted fraudulently.

What it means for you

If money leaves your account without your authorisation, tell your bank as soon as you notice. Article 112 sets an outer limit of 13 months from the date of the debit, as the Banco de Portugal also tells cardholders. Ask for proof that you reported it: under article 111, the bank must give you the means to prove that for 18 months.

If the bank refuses or delays your refund by claiming you were careless, complain through the electronic complaints book (Livro de Reclamações) or directly to the Banco de Portugal. Unrecovered fraud losses are already among the most common bank complaints, as DECO's figures showed in October.

The ruling does not mean every victim keeps the money: a bank that can prove gross negligence can still claim the loss back afterwards.