EU Court: Gross Negligence Does Not Delay an Unauthorised Refund
A payment provider cannot postpone an unauthorised-payment refund merely because it believes the customer was grossly negligent. In its 15 October 2026 judgment in Tukowiecka, Case C-70/25, the Court of Justice of the European Union separated the initial refund from any later attempt to make the payer bear the loss.
That sequence matters, but its scope is narrower than a general promise that every scam loss must be repaid. The ruling concerns a transaction the payer says was unauthorised. It does not decide that every transfer made after deception was unauthorised, or that the customer in the Polish case ultimately bears no liability.
The refund decision comes first
Article 73(1) of the revised Payment Services Directive, PSD2, requires a provider to refund an unauthorised transaction immediately and no later than the end of the following business day after it notes or is notified of the transaction. The provider must also restore the debited account to the position it would have held without the transaction. The refund must not leave the account with a credit value date later than the original debit date.
The Court said Article 73 contains one exception to that immediate-refund duty. A provider may withhold the refund when it has reasonable grounds to suspect fraud by the payer and communicates those grounds in writing to the relevant national authority. An allegation that the payer was grossly negligent is not an additional exception.
The notification rules still matter. Article 71 generally requires the payer to notify the provider without undue delay after becoming aware of the transaction and no later than 13 months after the debit. Those notification time limits do not apply where the provider failed to supply or make available the required transaction information.
Gross negligence belongs in a later recovery decision
Article 74 addresses who ultimately bears the loss. A payer may be liable for all losses if the payer acted fraudulently or intentionally or with gross negligence failed to meet the obligations in Article 69, including protecting personalised security credentials and reporting loss, theft, misappropriation or unauthorised use without undue delay.
The Court held that this allocation does not let the provider hold up the Article 73 refund. The provider must make the refund when the conditions for it are met, then may pursue reimbursement from the payer if it can establish the Article 74 grounds. This keeps the immediate-refund mechanism effective while preserving a route to recover money where the evidence supports fraud or gross negligence.
The burden is material. Under Article 72(2), the recorded use of a payment instrument is not, by itself, necessarily enough to prove that the payer authorised the transaction or acted fraudulently or with gross negligence. The provider must produce supporting evidence.
Article 74 also contains protections that can change the final allocation. If the payer’s provider does not require strong customer authentication, the payer does not bear financial losses unless the payer acted fraudulently. A refund and a later liability assessment therefore require more than a label on the incident. The judgment does not establish that this customer was grossly negligent or decide every authentication issue in her case.
What happened in the Polish case
The dispute arose after a customer selling an item online followed a link sent by a supposed buyer. The link opened a false version of her bank’s website. She entered credentials and, after further deception, supplied an SMS confirmation code. A fraudster then transferred PLN 3,000 from her account.
She noticed the transfer the next day and notified both the bank and the police. The bank refused to refund her, arguing that she had acted with gross negligence. The Polish court hearing her claim asked the CJEU whether that allegation could justify refusing the immediate refund.
The CJEU answered the interpretation question. It did not determine the remaining facts or the customer’s final liability. The Polish court must apply the ruling when it resolves the dispute.
What payment providers should change
EU payment providers should test their case handling against a two-stage workflow:
- Classify the transaction. Record the evidence relevant to whether the payment was authorised and whether the payer gave timely notice. Avoid treating the word “scam” as a complete legal classification.
- Run the Article 73 clock. If the transaction is unauthorised and the notification conditions are met, refund within the required period unless there are reasonable grounds to suspect payer fraud and those grounds are reported in writing to the relevant authority.
- Open a separate liability review. Preserve authentication, device, communication and customer-service records. Assess any Article 74 recovery claim separately and document the evidence said to establish fraud or gross negligence.
- Separate customer communications. Explain the refund decision and any later recovery claim as distinct decisions, with their own legal grounds, evidence and challenge routes.
Policies that automatically reject a refund when staff see credential sharing, a confirmation code or a phishing link need review. Those facts may be relevant to a later gross-negligence case, but the judgment says they do not create a new reason to delay the initial refund.
Where the ruling stops
The case interprets PSD2 for an EU national court. It does not decide whether every scam-induced payment is unauthorised, prescribe the result of every gross-negligence claim or settle procedural rules for a provider’s later recovery action. Providers should map the ruling to applicable national law, regulator guidance and dispute procedures before changing customer-facing wording.
Business accounts also need their contracts checked. Article 61 allows a non-consumer user and provider to agree that certain provisions, including Articles 72 and 74, do not apply in whole or in part, and to agree different Article 71 notification periods. That list does not include Article 73. The consumer dispute should not be presented as an identical set of contractual rights for every corporate account. National rules may also treat microenterprises as consumers.
