Summary

• The judgment concerns the immediate refund obligation for unauthorised transactions under PSD2.
• Suspected gross negligence does not itself allow a payment provider to postpone reimbursement.
• Providers may subsequently seek recovery where the necessary grounds for customer liability are established.

European banks cannot delay reimbursing an unauthorised payment merely because they believe the customer was grossly negligent, the Court of Justice of the European Union has ruled, separating the obligation to refund disputed transactions from the subsequent determination of who must ultimately bear the loss.

The judgment, delivered on 15 October in case C-70/25, Tukowiecka, concerns the interpretation of the EU’s second Payment Services Directive, known as PSD2. It confirms that a payment service provider must initially refund an unauthorised transaction under the applicable statutory conditions, even where it suspects that the account holder failed to protect their security credentials.

Providers retain the ability to recover losses from customers whose intentional misconduct or gross negligence is subsequently established. However, the Court rejected an approach under which the provider could make its initial reimbursement obligation conditional on resolving that separate question of liability.

The proceedings originated in Poland after a woman advertising an item for sale received a link from someone claiming to be interested in purchasing it. The link led to a fraudulent website resembling her bank’s online service, where she entered her banking credentials. A third party subsequently used those details to transfer approximately €700 from her account.

After the woman reported the unauthorised transaction, the bank refused reimbursement, arguing that she had acted with gross negligence by providing her credentials through the fraudulent website. The Polish court considering her case asked whether that alleged negligence could justify withholding the immediate refund required by EU payment legislation.

Under Article 73 of PSD2, a payment provider must generally reimburse an unauthorised payment immediately and no later than the end of the following business day after becoming aware of it. A defined exception applies where the provider has reasonable grounds to suspect fraud by the payer and communicates those grounds to the relevant national authority.

Refunding the money and assigning responsibility

The Court’s interpretation preserves the distinction between the timing of reimbursement and the eventual allocation of liability. It means that a provider cannot normally withhold funds while investigating whether an account holder’s behaviour amounts to gross negligence, although it may pursue a separate recovery claim when the relevant legal conditions are met.

That sequence affects the practical balance between financial institutions and their customers. Where a payment is genuinely unauthorised, the account holder may otherwise lose access to funds for an extended period while the provider investigates its own reasons for refusing repayment.

Moving the liability assessment into a subsequent process does not eliminate the duties imposed on payment users. Customers must still comply with security obligations, take reasonable precautions with personalised credentials and report suspicious activity when they become aware of it.

Nor does it mean that every transaction associated with a scam qualifies for the same treatment. A transfer initiated by a criminal using stolen credentials raises different questions from one in which a customer personally instructs their bank to send money after being deceived. The judgment concerns unauthorised transactions, not a universal reimbursement guarantee for all types of payment fraud.

For banks and other payment service providers, the ruling places greater emphasis on the accuracy of transaction classification and the evidence retained during fraud investigations. A system may record that valid credentials were used, but that information does not automatically establish that the account holder authorised the transaction or was grossly negligent.

The distinction can become difficult when criminals use phishing pages, intercepted authentication messages or other methods that exploit legitimate security procedures. Banks need to establish who initiated the transfer, what the customer actually did and whether those actions satisfy the legal threshold for liability.

Automated fraud systems may identify suspicious behaviour or assign risk scores to a disputed transaction, but those outputs must fit within the statutory reimbursement process. An automated indication of possible customer carelessness cannot by itself settle the separate legal questions of authorisation and gross negligence.

The judgment also affects how customer service, payment operations and financial crime teams coordinate investigations. A provider may need to process a refund promptly while preserving evidence for a subsequent recovery action, rather than treating the initial complaint as an opportunity to resolve every possible issue of responsibility.

Implications for Europe’s payment services market

PSD2 operates across the EU payments market, where banks, electronic money institutions and other providers increasingly rely on digital identity checks, transaction monitoring and automated payment systems. The ruling clarifies an obligation that must be reflected in the procedures used to handle unauthorised payment complaints.

As payment fraud becomes more technically complex, the evidence needed to establish customer conduct may involve device information, transaction logs, authentication events and communications associated with the scam. Those records may help determine liability, but gathering them cannot ordinarily override the requirement for immediate reimbursement.

The legal framework is also being reconsidered through EU proposals for a third Payment Services Directive and a new Payment Services Regulation. The eventual reforms may change parts of the wider payments regime, although the Court’s judgment concerns the existing legislation and should not be treated as a determination of provisions that have yet to be adopted.

The decision leaves providers with a continuing right to establish and pursue qualifying customer liability. What it prevents is using an unresolved allegation of gross negligence as a reason to withhold the refund that the legislation otherwise requires.