TSUE separates the quick recovery of an unauthorized payment from the subsequent dispute over losses

TSUE delivers its judgment on October 15, 2026 in case C-70/25 concerning unauthorized phishing transactions. The Tribunal points out that the bank's mere assessment of the customer's gross negligence does not allow it to refuse the immediate refund of the amount. In the described case, the client provides her login details via a fake link, and the third party transfers approximately EUR 700.

As a rule, the refund is to be made no later than the end of the next business day after receiving information about the operation, provided that the customer reports it without undue delay. The exception concerns reasonable suspicion of fraud by the customer himself and written notification to the competent authority.

The judgment distinguishes this obligation from ultimate liability for the loss. The supplier may later claim its coverage by the customer if he proves a breach of duty intentionally or as a result of gross negligence. Therefore, this does not mean that any refunded amount will be retained unconditionally. TSUE interprets EU law, while a specific dispute is resolved by a national court.