EU court: banks must refund fraud fast

What happened

The Court of Justice of the European Union (CJEU) ruled on 15 October 2026 that a bank cannot refuse to refund an unauthorised payment straight away just because it believes the customer was grossly negligent. The case, C-70/25, was referred by a Polish court. The ruling has been widely discussed in France this week, where "fraude" (fraud) was among the rising Google searches, and French outlets such as Économie Matin and the legal news site Le Monde du Droit have explained what it means for victims of bank fraud.

The case behind the ruling

According to Le Monde du Droit and a summary by the law firm Lewis Silkin, a customer of the Polish bank PKO BP was selling an item online when a fake buyer sent her a link to a page that imitated her bank's website. She entered her login details, and a transfer of about €700 left her account. She reported it the next day. The bank refused to pay her back, arguing that she had been grossly negligent by handing over her security details.

What the court decided

The court set out a two-step order. First, under the EU's second Payment Services Directive (PSD2), the bank must refund an unauthorised transaction immediately, and at the latest by the end of the next business day after it learns of it, provided the customer reported it without undue delay. Second, the bank may then try to recover the money from the customer, but only if it can prove intent or gross negligence, and the burden of proof is on the bank. The only ground for holding back the refund is a reasonable suspicion that the customer is committing fraud, and the bank must set out that suspicion in writing to the national authority. According to a commentary by the French lawyer Maude Hupin, an internal investigation is not a reason to delay.

What it does not cover

The ruling is about unauthorised payments, where the customer did not give consent. Lewis Silkin notes that it does not decide cases in which people are tricked into approving a wire transfer themselves, often called authorised push payment scams, although the firm expects the court's reasoning to be examined in those disputes too. The court also did not say whether the Polish customer was in fact negligent; it only fixed the order of the steps.

Why it matters for payments

Phishing is one of the most common ways people lose money from cards, bank accounts and money transfer apps. Économie Matin cites Banque de France figures putting payment fraud in France at €1.2 billion in 2024. For victims, the ruling makes the first step clearer: report quickly, and the provider should put the money back before arguing about who is to blame. For banks and payment firms, it means faster refund processes, and stronger evidence if they want to recover losses later. Économie Matin also notes that French law already required immediate refunds, but that the rule was sometimes worked around.

What to watch next

National courts and banks across the EU will now apply the ruling in their own disputes, and lawyers expect it to be cited in complaints about refused or delayed refunds. In the UK, whose rules have close counterparts to the provisions the court looked at, Lewis Silkin expects banks, payment institutions and e-money firms to study the decision as well. Whether you pay by card at home or send an international money transfer, the practical lesson is the same: report anything suspicious without delay.

What it means for Odix Pay users

The simplest protection is speed. If you see a card payment or a transfer you don't recognise, use the card controls in the app and contact Odix Pay support straight away through the in-app chat or at info@odixpay.com. Never share your login details or one-time codes with anyone, even someone who says they are calling from a bank. You can manage your Odix card and your money transfers in one app. Availability depends on your country, and fees are shown in the app. More stories in the Odix Pay newsroom.