Online fraud: bank must immediately reimburse customer, even in cases of negligence

Brussels –Anyone who is defrauded by an unauthorised transaction is entitled to have their money refunded immediately, without waiting to find out who is at fault. This has been established by the Court of Justice of the European Union, which, in a judgment, clarified the obligations of payment service providers in the event of fraud.

The case originated in Poland. A customer was selling an item on an online platform when a self-proclaimed buyer sent her a link, presented as originating from the platform, to confirm the sale. The link led to a website that mimicked her bank’s, where the woman entered her online banking login details. The fraudster used these to transfer around 700 euros to an account in his name. The customer reported the incident to the bank the following day. Still, the bank refused to refund the money, arguing that she had, through gross negligence, enabled the transaction by failing to fulfil her obligation to safeguard her login details. The woman took her case to a Polish court, which asked the Court of Justice whether the bank must refund the sum immediately, even if it considers the customer grossly negligent. The answer is yes.

The general rule, the Court explains, is that the refund must be made immediately, at the latest by the end of the first working day following the day on which the bank became aware of the transaction, provided that the customer notifies the bank without delay. There is only one exception: where the bank has “reasonable grounds to suspect fraud committed by the customer” and reports this in writing to the competent national authority. Suspicion of gross negligence is not sufficient to justify a refusal.

The judges distinguish between two aspects. The first is reimbursement of the amount, which must occur immediately. The second is the question of who should ultimately bear the loss. At a later stage, the bank may ask the customer to reimburse the loss, but only if it can prove that it resulted from wilful misconduct or gross negligence, in particular from a failure to protect login credentials. The burden of proof lies with the bank.

This interpretation, the Court observes, serves the objective of ensuring “a high level of consumer protection”. If banks were able to refuse reimbursement outright on the grounds of gross negligence, the obligation to pay immediately would lose its effectiveness, and it would be the customer who would have to initiate proceedings to assert their right, “with the costs and inconvenience that this may entail.”