Theft of money from a bank account and the duty to refund an unauthorised transaction: a landmark CJEU judgment

Under Article 73(1) of the Directive, a payment service provider is generally required to refund the amount of an unauthorised transaction immediately and, in any event, no later than the end of the following business day after becoming aware of the transaction or receiving the relevant notification. Article 74(1) of the Directive, in turn, governs the payer’s liability for losses arising from unauthorised transactions. The payer may bear full liability for such losses if they result from fraudulent conduct or an intentional or grossly negligent breach of the obligations laid down in the Directive.

As the Court noted, banks had adopted the practice of applying these provisions together: if a bank considered that the customer had been grossly negligent in fulfilling their obligations when making the transaction, it refused to refund the funds, relying on the customer’s liability for the resulting loss. In light of the above provisions, the Court held that the bank should first refund the amount involved in the unauthorised transaction and then determine whether there are legal grounds for holding the customer liable.

The allocation of the burden of proof is an important element of the system protecting payers. Under Article 72(2) of the Directive, the mere fact that the use of a payment instrument has been recorded is not sufficient to establish that the transaction was authorised or that the payer acted fraudulently or intentionally or with gross negligence failed to fulfil their obligations. The payment service provider bears the burden of proving the circumstances that justify holding the payer liable.

In practice, this requires an individual assessment of the circumstances of the particular event, including how the perpetrator acted, the manipulation method used and the customer’s conduct. The mere fact that online fraud has occurred does not determine the payer’s liability.

In its judgment, the CJEU pointed out that Article 73(1) of the Directive provides for an exception to the duty to refund funds immediately. This concerns a situation in which the payment service provider has reasonable grounds for suspecting fraud and communicates those grounds in writing to the competent national authority.

The judgment may provide an important argument in disputes with banks that have refused to refund funds lost through an unauthorised transaction on the grounds of the customer’s gross negligence. The Court confirmed that the duty to refund funds and the subsequent assessment of the payer’s liability are separate legal issues. Consequently, the customer’s potential liability cannot, in itself, justify refusing an immediate refund. The judgment does not release the payer from liability for intentional or grossly negligent breaches of their obligations.

We also recommend exercising particular caution when using online banking, especially when sharing authentication details, opening unfamiliar links and approving payment transactions.

Call Us

+48 42 207 66 66

Email Us

kancelaria@krs-adwokaci.pl

Contact Details and Directions →