Online scam: does the bank have to reimburse you if you provided your bank details?

Ms. T. had put an item up for sale on an online platform. To settle the transaction, a fake buyer sent him a link that was supposed to confirm the sale and appeared to come from the platform. This link actually led to a fake site mimicking that of Ms T's bank. She entered her online bank credentials there. Armed with these elements, the fake buyer was able to transfer approximately €700 (PLN 3,000) from Ms T.'s account to her own account, after having retrieved the SMS confirmation code from the fake platform.

The client reported the fraud to her bank and the police the next day. The perpetrator of this fraud has not been identified.

The institution refused to reimburse Ms T., considering that, by providing her bank details, she had committed ‘gross negligence’ and ‘failed in her duty to keep the payment instrument in question diligently’.

Ms T. took the matter to the Polish courts and asked to be reimbursed as a result of this unauthorized operation. The District Court questioned the Court of Justice of the European Union (CJEU).

Does the bank have to pay it back immediately?

Public Service replies:

The Polish court asked the CJEU whether the bank could refuse to repay a transaction not authorized by the client, on the grounds that it was the client who had committed gross negligence.

Directive (UE) 2015/2366, the so-called revised Payment Services Directive or PSD2, contains two texts that will be invoked by the CJEU in this case. Article 73 requires the bank to repay the amount of an unauthorized transaction as soon as it becomes aware of it, at the latest by the end of the following working day. The client's gross negligence is not included as a ground for refusal.

Article 74 shall apply in a second stage. It allows the bank to ask the customer to bear the loss, but it does not exempt the bank from repaying first. There is only one exception. The bank may refuse to reimburse in the event of a serious suspicion of fraud on the part of its client, and on condition that it communicates these reasons in writing to the competent national authority. The bank therefore bears the burden of proof. Outside of this exception, she must repay, then she can take legal action against her client. It is up to them to demonstrate gross negligence.

Note that the judgment of 15 October 2026 of the CJEU It does not, however, comment on transfers that the victim could order himself, under pressure from a false adviser, for example. These so-called « authorized » frauds remain outside its scope.

In this case, the European court ruled that the bank must immediately reimburse the client. Once repaid, she can nevertheless be sued by her bank, which must then prove gross negligence before a judge.

The ECJ ruled that the gross negligence of the customer does not allow the bank to defer the repayment of an unauthorized transaction.