CJEU rules on refunds for unauthorized payments

On 15 October 2026 the Court of Justice delivered its judgment in Case C-70/25, Tukowiecka on a question that has been lingering for many years now: can a bank refuse to refund immediately a victim of an unauthorized payment transaction, on the ground that the victim was grossly negligent? The Polish referring court asked the Court to interpret Articles 73(1) and 74(1) of PSD2. The Court's answer is unambiguous: a payment service provider cannot invoke the payer's gross negligence as a ground to withhold the immediate refund that Article 73(1) PSD2 requires. Gross negligence only becomes relevant at a later and separate stage, when the PSP can seek to recover its losses from the payer through legal remedies. 

The facts of the case 

The applicant held a current account with a Polish bank. She fell victim to a classic phishing scheme: a fraudster expressed interest in an item she had listed on an online auction platform and sent her a link designed to look like a sale confirmation from that platform. However, the link actually led to a website spoofing her bank's own site, where she entered her online banking credentials. Using those credentials, the fraudster transferred PLN 3,000 (roughly EUR 705) out of her account, authorizing the transfer with an SMS confirmation code that the fraudster had also obtained from her through the same deception. 

The applicant discovered the fraud the next day and immediately notified both her bank and the police. The perpetrator was never identified and the bank refused to refund the amount, arguing that her loss resulted from her own gross negligence in failing to safeguard her payment instrument and personalized security credentials. 

As also noted by the referring court, this is part of a systemic pattern: banks essentially never sue consumers for reimbursement on grounds of gross negligence. Instead, they routinely refuse the immediate refund themselves and leave it to the consumer to sue for it. The referring court saw this as a pattern inverting the burden that PSD2 was meant to place on the professional party. 

What does the PSD2 say? 

PSD2 allocates the risk of unauthorized transactions between the payment service provider and the payer across two distinct provisions. 

First, article 73(1) obliges the payer's provider to refund the amount of an unauthorized transaction immediately, and in any event by the end of the following business day, once it has noted or been notified of the unauthorized transaction. This obligation knows only one express exception: where the provider has reasonable grounds to suspect fraud and communicates those grounds in writing to the relevant national authority. Gross negligence is not in scope for this provision and can, therefore, not offer a ground to refuse this immediate refund. 

Second, article 74(1) addresses a different question, namely how losses are ultimately allocated. Its first two subparagraphs cap the payer's liability at EUR 50 for losses from a lost, stolen or misappropriated instrument – subject to a carve-out where the loss was undetectable to the payer. Its third subparagraph removes that cap and makes the payer bear the full loss if the payer acted fraudulently or breached the obligations of Article 69 PSD2 (to use the instrument properly and to notify loss or theft without undue delay) with intent or gross negligence. Article 72(2) PSD2 places the burden of proving that fraud or gross negligence squarely on the provider. As a result, payers can, ultimately, bear the entire loss if they acted with gross negligence. 

The question referred 

The Polish court stayed the proceedings and referred a single question: whether Articles 73(1) and 74(1) PSD2, read together, mean that a payment service provider cannot refuse to refund immediately to a payer the amount of an unauthorized payment transaction on the ground that that payer made that transaction possible through gross negligence, in breach of his or her obligations under Article 69 PSD2. 

As a result, the question is essentially whether Article 74(1) can operate as an exception to Article 73(1) itself, or whether it is separate mechanism that only applies after the refund has already been made. 

The CJEU’s reasoning 

The Court applied its standard interpretive sequence, and, where useful, legislative history (citing Merck, 292/82, and Veracash, C-665/23). 

On the wording, the Court reasoned that Article 73(1) lists exactly one exception to the immediate refund obligation: suspected fraud reported to the competent authority. Gross negligence under Article 69 is nowhere mentioned in this article. Reading a second, unwritten exception into Article 73(1) via Article 74(1) would, therefore, not sit well with a provision that is already exhaustive. 

On context, the Court drew on three signals. First, recital 71 frames the fraud-suspicion exception as the only carve-out from immediate refund. Second, article 72(2) places the burden of proving gross negligence on the provider – which only makes sense as part of a later contestation, since the payer cannot be expected to disprove negligence before ever receiving the refund the directive promises. And structurally, Article 73 and Article 74 answer different questions at different points in time: Article 73 governs the immediate refund and then Article 74 governs the allocation of liability once that has happened, including a provider's subsequent claim against the payer. 

On the objectives, PSD2 exists – per Article 1(2)(b) and recital 6 – to fix the respective rights and obligations of users and providers while ensuring a high level of consumer protection (citing DenizBank, C-287/19, and Eurobank Bulgaria, C-409/22). Allowing providers to withhold the refund on a self-assessed finding of gross negligence would flip that protection on its head. It would force the party that PSD2 set out to protect to litigate for money that should already be in their account, while the professional party keeps the funds and the procedural advantage. 

On the legislative history, the predecessor Article 60 of Directive 2007/64 had no exception at all. The EU legislature added the fraud-suspicion exception deliberately during the negotiation of PSD2, and paired it with the full harmonization clause in Article 107(1) – which prevents Member States from adding further exceptions in their national implementation. Finally, the Court dismissed the Czech and Italian governments' argument that this reading sidesteps the ADR mechanism under Article 102(1) PSD2, noting that ADR under that article covers the whole of Titles III and IV, not merely Article 73 disputes. Therefore, it cannot be recast as a mandatory gatekeeper for assessing Article 69 compliance. 

The Court’s ruling 

The Court ruled that Articles 73(1) and 74(1) PSD2 must be interpreted as meaning that a payment service provider cannot refuse to refund a payer immediately for an unauthorized transaction on the ground that the payer made the transaction possible through gross negligence, in breach of Article 69. 

The Court affirms that this is a two-stage process. First, the provider must refund the payer immediately, by the end of the next business day at the latest, subject only to the fraud-suspicion exception of Article 73(1). Second, if the provider believes the payer was grossly negligent, it remains free to pursue reimbursement from the payer afterwards, under Article 74(1), through ordinary legal remedies, bearing the burden of proving that gross negligence under Article 72(2). What a provider cannot do is conflate those two stages by unilaterally deciding, before paying anything, that the payer was at fault due to negligence. 

What does this mean in practice? 

Because Article 107(1) PSD2 is a full harmonization clause, this ruling is not confined to Poland. It settles the interpretation of Article 73(1) for every Member State, including Belgium, which transposed PSD2 in near-identical terms. Belgian payment service providers that have been following a practice similar to the Polish bank – refusing immediate refunds on a self-assessed finding of gross negligence and waiting to be sued – are now squarely on the wrong side of the Court's reading of Article 73(1). 

The judgment reaffirms where the litigation burden and the proof burden fall. A provider that suspects gross negligence must still refund first, and if it wants to recover the money it must bring its own claim and discharge the Article 72(2) burden of proving fraud or gross negligence itself, rather than relying on the payer's inertia to let a refusal stand unchallenged. For client-facing terms and conditions, internal fraud-handling procedures and complaint-handling workflows, this means that any clause or practice that frames gross negligence as a ground for withholding the initial refund needs to be revisited. And this is not only because it is contrary to EU law, but because the burden of proof plainly sits with the provider from the outset. 

However, while this is certainly an important ruling, its practical relevance will remain limited in time. The text of PSR – as approved in the trilogue procedure – adds an exemption to the immediate refund obligation: where the payer’s payment service provider has objectively justified reasons for suspecting that the payer failed with intent or gross negligence to fulfil one or more of its obligations, and communicates those grounds to the payer in writing. As a result, once PSR becomes applicable – which will likely be in 2028 – the payment service provider will become able to reject the immediate refund on grounds of suspected gross negligence. 

Unfortunately, this makes the case a bit of a hollow victory: the question only got settled more than 10 years after the adoption of PSD2 – and an equal time of malpractice by payment service providers in this matter – and only shortly before a new framework will change the situation again to what it actually already was in practice. 

Therefore, a more important question to settle for the future is on what the threshold for an unauthorized transaction is. A recent decision of the Enterprise Court of Antwerp of 9 October 2026 decided that a transaction is authorized once a payer has consented to its execution, regardless of whether the payer was misled on the nature of the transaction. There would only be an unauthorized transaction when a fraudster steals the payer’s credentials – e.g. via a fake banking website – and then initiates transactions itself, as in that case the payer has not initiated anything. However, if the payer is directed to its banking app or a digital wallet to confirm the transaction and performs this confirmation itself, the transaction is considered as an authorized transaction. Subsequently, the framework on liability for unauthorized transactions does not even come into play. This is an important distinction that affects a lot of fraud cases: the payer is led to authenticate an ostensibly correct transaction that actually turns out to be fraudulent. Regardless of the fraudulent nature of the transaction, it should then not be considered as an unauthorized transaction, thus leaving the payer without recourse against the payment service provider. 

These two cases demonstrate how the fraud question is a lot more substantial than just the matter of refunding unauthorized transactions. There is a clear need for more tangible measures to combat and prevent fraud as the liability question under the payment services framework alone is insufficient to adequately protect the payer against fraud or to support the payer in handling cases of fraud.