On 15 October 2026 the Court of Justice of the European Union gave judgment in Case C-70/25, Tukowiecka, on what a payment service provider must do when a customer falls victim to an unauthorised payment made through phishing. According to the Court's press release (No 147/26), a provider cannot refuse to refund an unauthorised transaction immediately because it considers that the customer acted with gross negligence.
The judgment separates two legal questions: when the provider must reimburse the customer, and who must ultimately bear the loss. For banks, payment institutions and other payment service providers, the implications reach beyond reimbursement into fraud investigation, refund workflows, evidentiary standards, complaint handling and compliance controls.
The dispute: a phishing attack and a refused refund
The case arose from a phishing incident involving a customer of a Polish bank. According to the press release, a third party showed interest in an item she was selling on an online sales platform and sent her a fraudulent link, presented as coming from the platform and intended to confirm the sale. It led to a website spoofing her bank's, where she entered her online banking login details. The third party used them to transfer a sum equivalent to approximately EUR 700 to its own account. She notified the bank the next day. The bank refused reimbursement on the ground that she had failed to keep her personalised security credentials safe and had enabled the fraud through gross negligence.
As reported, the District Court (Sąd Rejonowy) in Koszalin referred a question to the CJEU on the relationship between Articles 73(1) and 74(1) of Directive (EU) 2015/2366, the second Payment Services Directive (PSD2): can alleged gross negligence justify refusing the immediate refund of an unauthorised transaction? According to the press release, the Court answered no.
Immediate reimbursement is a distinct legal obligation
Article 73(1) PSD2 is addressed to Member States: under it, the payer's payment service provider must refund the amount of an unauthorised payment transaction "immediately, and in any event no later than by the end of the following business day, after noting or being notified of the transaction". It contains one exception: where the provider "has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing".
The press release describes the obligation as applying provided the customer notifies the provider without undue delay (Article 71), and describes the single exception as reasonable grounds for suspecting fraud committed by the customer. That is the Court's reading; the statutory text quoted above does not name whose fraud. According to the press release, the Court held that a provider's view that the customer was grossly negligent does not displace the refund obligation. A customer deceived into disclosing security credentials may have failed to take the precautions PSD2 expects, but that possibility does not relieve the provider of its initial reimbursement obligation. An unresolved allegation of customer negligence is not a basis for withholding funds that Article 73 requires to be refunded. The obligation to refund arises before liability is finally determined.
Gross negligence remains relevant, but at a different stage
The judgment does not remove the customer's responsibility for protecting payment credentials. Article 69 PSD2 requires the payment service user to use a payment instrument in accordance with its terms and to "take all reasonable steps to keep its personalised security credentials safe". Under Article 74(1), the payer bears all losses from unauthorised transactions incurred by acting fraudulently or by failing to fulfil one or more Article 69 obligations "with intent or gross negligence".
On the press release's account, the Court preserved those provisions while separating them from the initial refund: the provider may afterwards seek reimbursement from the customer if it establishes that the losses resulted from the customer's intentional or grossly negligent failure to meet those obligations, and the burden of proving gross negligence lies on the provider. That allocation is in the Directive itself: under Article 72(2), the recorded use of a payment instrument is not in itself necessarily sufficient to prove fraud or gross negligence, and the provider "shall provide supporting evidence to prove fraud or gross negligence on part of the payment service user".
Allegations of carelessness, even where the transaction circumstances look suspicious, therefore cannot substitute for a properly established basis for recovery. The provider must be able to show the conduct relied on, its legal significance, and its link to the losses.
What the judgment does not establish
The ruling does not create an unconditional right to permanent reimbursement in every online-fraud case. Four limits matter.
- It concerns unauthorised transactions. Whether a payment was authorised is a separate question. It matters where a fraudster deceives a customer into initiating and authorising a transfer personally.
- The statutory exception stands. Reasonable grounds for suspecting fraud, communicated to the relevant national authority in writing, remain a basis for not refunding immediately.
- Recovery remains possible. Reimbursement does not prevent the provider from pursuing the customer later where the legal requirements for customer liability are established.
- Business users may be on different terms. Under Article 61(1) PSD2, where the payment service user is not a consumer, the parties may agree that Articles 72 and 74 do not apply in whole or in part.
The decision does not move every fraud loss permanently onto financial institutions. It clarifies the order in which the statutory obligations and liability mechanisms operate.
From legal interpretation to operational compliance
The challenge for payment service providers is not only understanding the judgment but making sure their procedures reflect the distinction the Court drew. A fraud process that suspends reimbursement whenever customer negligence is suspected may need reassessment, as may a procedure that folds authorisation, refund eligibility, customer negligence and final liability into one decision. Six areas deserve attention.
- Fraud classification and authorisation. Procedures should distinguish unauthorised transactions from payments the customer authorised under deception. The fraud risk may look similar; the reimbursement obligations need not be the same.
- Refund decisions and timelines. Workflows should reflect the statutory deadline, so that an allegation of gross negligence does not automatically delay payment. Systems should record when the provider noted or was notified of the transaction, the refund decision and when reimbursement occurred.
- Exceptions and escalation. Where a provider relies on the fraud-suspicion exception, the grounds should be documented and the written communication to the national authority completed. The exception should not become a general way of extending investigations.
- Evidence and recovery. Where gross negligence is alleged, providers need procedures for collecting, assessing and preserving the evidence Article 72(2) requires: authentication records, security notifications, customer communications and other relevant records, subject to the applicable evidential and data protection rules.
- Complaints and customer communications. Explanations to customers should separate the initial reimbursement from any later determination of liability, particularly where the provider seeks recovery or the customer disputes an allegation of gross negligence.
- Governance and monitoring. Compliance functions should consider whether policies, procedures, controls and monitoring reflect the Court's interpretation. Useful indicators include reimbursement timeliness, how often the exception is used, the documented grounds for withholding, and the outcomes of recovery.
These are practical implications of the judgment, not additional obligations created by the Court.
A broader lesson for regulatory governance
Identifying an obligation is not the same as implementing it correctly. Articles 69, 72, 73 and 74 PSD2 deal with related matters, but they cannot be collapsed into a single assessment of whether the customer behaved responsibly. They set distinct rules on security, evidence, reimbursement and the allocation of losses, and the relationship between them matters as much as their individual wording.
PSD2 is a directive, so its obligations reach providers through national implementing law, read in the light of the Court's interpretation. A static checklist noting an obligation to refund unauthorised transactions would not capture Tukowiecka. An effective programme also needs to know what triggers the obligation, how narrow the exception is, the order of the subsequent steps, and the evidence each decision requires.
What this means for regulatory intelligence
The judgment did not change the text of PSD2. The Court clarified how existing provisions are to be interpreted and applied, and that clarification may still require organisations to revisit established procedures and controls. Regulatory change management has to account for judicial interpretation of existing law, not only for amendments to it: identifying the development, linking it to the provisions it affects, determining which obligations and controls it touches, and supporting the organisation's assessment of what has to change.
Conclusion: reimbursement first, liability thereafter
Tukowiecka reinforces a principle of EU payment services law: the initial obligation to refund an unauthorised transaction is not displaced by an allegation that the customer was grossly negligent. Providers can still pursue recovery where customer liability is established, but that question is separate from the initial reimbursement. For financial institutions, the immediate priority is to check that fraud response, reimbursement controls and evidence processes reflect the distinction. For compliance professionals, the case is a reminder that compliance depends on knowing when obligations arise, how exceptions operate and what evidence justifies each decision, as well as what the law requires.
How Priventia approaches it
Priventia's governing principle is that every compliance conclusion should be explainable. Its method links the legal requirements that apply to an organisation to the controls that address them, the evidence behind those controls and the monitoring that keeps them current, with every step traceable to the provision it comes from. Payment services law is not yet part of Priventia's regulatory coverage; PSD2 has been added to its instrument register, and any coverage will be built on the same discipline.
Sources: Court of Justice of the European Union, Case C-70/25, Tukowiecka (a fictitious name given by the Court), judgment of 15 October 2026, as described in the Court's Press Release No 147/26, an unofficial document for media use (the full judgment was not available when this article was written); Directive (EU) 2015/2366, Official Journal L 337, 23 December 2015, Articles 69, 72, 73 and 74.