October 23, 2026
A woman in Poland tries to sell an item online. The "buyer" sends a link to confirm the sale. It leads to a fake copy of her bank's login page. She enters her details, and about €700 leaves her account within minutes. The bank refuses to refund her, arguing she was grossly negligent with her credentials.
In a ruling on 15 October 2026 (Case C-70/25), the Court of Justice of the European Union told banks that this position is not available. Under the Payment Services Directive, a bank must refund an unauthorised payment promptly, even when it believes the customer was grossly negligent. This guide explains what the ruling means for issuing banks, why it makes refunds a cost you cannot argue your way out of, and how Fraudio's real-time payment fraud detection helps you stop phishing losses before they happen.
Fraudio's payment fraud detection scores every transaction in milliseconds, before it is approved or released, using networked data from across issuers, acquirers and payment facilitators. That is the control that matters most now: the payment that never leaves is the refund you never pay. It covers card payments and instant payments, and banks can test it on their own historical data before committing.
This article is general information, not legal advice. Check the ruling's effect on your refund process with your legal and compliance teams.
1. Phishing refunds at a glance
2. What the EU court ruled
3. Why the ruling changes the economics for issuing banks
4. How Fraudio stops phishing losses before the payment leaves
5. What a phishing-driven payment looks like to a bank
6. Five ways banks can reduce phishing refunds with Fraudio
7. How to evaluate a payment fraud detection tool
8. Everything you need to know about phishing refunds
9. FAQs
| Question | Short answer |
|---|---|
| Can a bank refuse a refund because the customer was careless? | Not as a reason to delay. The court said the bank must still refund promptly and can pursue the customer afterwards if it proves gross negligence or intent. |
| How fast must the refund be? | Without delay, and at the latest by the end of the working day after the bank records or learns of the transaction, if the customer reported it without undue delay. |
| Who has to prove negligence? | The bank. It cannot leave the customer to prove their case in court. |
| Is there an exception? | Yes. A bank can withhold a refund if it has reasonable grounds to suspect the customer committed fraud and reports those suspicions to the national authority. |
| Where can a bank act? | Before the payment leaves, with real-time scoring and proportionate friction, which is what Fraudio's payment fraud detection is built to do. |
The case, C-70/25, reached the Court of Justice of the European Union through a Polish court and was decided on 15 October 2026. As reported by EU Perspectives, the customer was selling an item on an online marketplace. A prospective buyer sent her a link, supposedly to confirm the sale. The link led to a fake website imitating her bank's online banking service. She entered her login details, and the scammer used them to transfer around €700 to his own account. She reported the transaction the next day.
The bank refused to refund her. Its argument was that she had been grossly negligent in protecting her security credentials. The court rejected the idea that this view entitles a bank to refuse an immediate refund.
The court's reasoning was that letting banks refuse refunds on their own negligence assessment would undermine immediate refunds and the high level of consumer protection the directive aims for. The legal framework is the Payment Services Directive (Directive (EU) 2015/2366).
Before this ruling, a bank could treat a phishing case as the customer's problem and decline the claim. Now it has to pay within a day and then try to recover the money. Recovering it means proving gross negligence, which takes time and effort and may not succeed. Many banks will simply absorb the cost.
The joint EBA and ECB report on payment fraud, published in December 2025, puts reported EEA payment fraud at €4.2 billion in 2024, up from €3.5 billion in 2023. Credit transfer losses reached €2.2 billion, up 16%. Fraud on EEA-issued cards reached about €1.3 billion, up 29%. The report says strong customer authentication remains effective against the fraud it was built for, but that new fraud types are rising, especially the manipulation of payers.
Phishing sits squarely in that category. The customer is tricked into handing over credentials, or into approving a payment, so the checks pass. For credit transfers, the report shows payment service users bore about 85% of total fraud losses in 2024, mostly from scams that tricked them into starting the payment. If refund rules shift more of those losses onto banks, a large share of that burden becomes the bank's.
More liability is on the way. Under the provisional agreement on the EU's Payment Services Regulation (PSR), reached in November 2025, payment providers are set to refund victims of bank-impersonation scams and fraud they should have blocked.
Instant payments settle in seconds. Unlike a card payment, there is generally no dispute process to pull the money back once it has gone. A phishing attack that ends in an instant transfer gives the bank a single chance to stop it: before it is released.
Fraudio's payment fraud detection scores each transaction in real time through an API, so the bank can act before the payment is approved or released. For phishing, that is the point where a refund can still be avoided. The score returns in milliseconds, and each transaction is classified on a traffic-light scale so teams can route it to approve, review, step-up or block.
Fraudio customers have reported an 8x return on investment, a 600% gain in fraud team efficiency and fraud caught three weeks earlier than with legacy tools. You can test the approach on your own historical data before committing, through a Proof of Results engagement with no commercial obligation.
Learn more about our approach on the payment fraud prevention page: www.fraudio.com/payment-fraud-prevention
Phishing itself happens outside the bank. What the bank sees is the account being used in a way the customer normally would not. The giveaway is usually a sequence, not one event.
| Step | What the bank sees | Signal |
|---|---|---|
| 1. Credentials captured | Nothing yet. The fake site is outside the bank. | None |
| 2. Login | A genuine login with correct credentials | New device, new location, unusual time |
| 3. Account changes | Contact details, limits or payees changed | Changes shortly after a new login |
| 4. New payee | A first-time beneficiary is added | Payee unknown to the customer's history |
| 5. Payment | A transfer out, often large or fast | Amount, speed and destination out of character |
Every step can look legitimate by itself. People change phones and pay new people. A system that checks each event alone sees nothing wrong. A system that scores the payment with the account's recent history in view sees a pattern that does not fit the customer.
The payment decision has to happen inside the authorisation or release window. Scoring that returns in under 100 milliseconds can sit in the payment flow without slowing legitimate customers down. For instant payments this is the only intervention point, so a score that arrives after release is too late. Fraudio returns each score in milliseconds through an API, so the decision can be made before the payment is approved or released.
A transfer should be scored against what has just happened on the account: a new device, a changed phone number, a new payee. The same €2,000 payment from a settled account and from an account that changed three details an hour earlier are two different risks. Monitoring that is native to the transaction stream, rather than bolted on from a separate system, sees these links. Fraudio profiles accounts over time, tracking inflows, outflows, velocity, counterparties and device and IP signals, and scores each payment with that history in view.
Not every risky payment should be blocked. A middle score can trigger step-up authentication, a confirmation call or a short hold, so genuine customers get through and scammers stall. A customer being coached by a fraudster on the phone will often fail a confirmation question that the real account holder would answer easily. With Fraudio, each transaction lands on a traffic-light scale, and banks set their own thresholds for approve, review, step-up or block.
A phishing campaign rarely hits one bank. The same fake pages, mule accounts and payment patterns appear across institutions. A model trained on a wider pool of data can recognise a pattern that has already been seen elsewhere, before your own customers lose money to it. Fraudio's models are trained on networked datasets covering billions of transactions, pooled across issuers, acquirers and payment facilitators, so a pattern seen at one institution helps protect the others.
The ruling puts the burden of proof on the bank. If you ever need to show gross negligence, or reasonable grounds to suspect customer fraud, you need records: which signals fired, what the score was, what action was taken and when. Explainable scores and stored case data turn an argument into evidence. Fraudio gives every transaction a score and a classification, which gives your team a consistent record of how each payment was assessed.
1. Speed. Ask for the response time under load, and check it fits your authorisation and instant payment windows.
2. Account context. Confirm the model scores the payment with recent account events in view, not only the payment fields.
3. Intervention options. Look for step-up, hold and review actions, not only approve or decline.
4. Explainability and records. Check that you can see why a payment was flagged and keep the data for disputes.
5. Coverage. Phishing losses often end as instant transfers or card payments. A tool that sees more rails catches more.
6. Test on your data. Ask the vendor to score your historical transactions and report both the catch rate and the false positive rate.
| Topic | Key point |
|---|---|
| The ruling | Banks must refund unauthorised payments promptly, even if they suspect gross negligence |
| Deadline | By the end of the working day after the bank records or learns of the transaction |
| Recovery | Possible only if the bank proves intent or gross negligence |
| Burden of proof | On the bank |
| Exception | Reasonable suspicion of customer fraud, reported to the national authority |
| Data point | EEA payment fraud €4.2 billion in 2024, with credit transfer losses up 16% |
| Best control | Stop the payment before it leaves with real-time scoring and proportionate friction |
Fraudio scores every payment in real time, uses networked data to spot patterns seen elsewhere, and gives banks the control to hold risky payments instead of refunding them later. It is built for issuing banks, issuing processors and payment companies, and goes live in days to weeks with usage-based pricing and no setup fees.
Talk to our team about stopping phishing losses before they become refunds: www.fraudio.com/contact-us
Under the EU court's ruling, a bank must refund an unauthorised payment promptly, even if it believes the customer was grossly negligent. The refund is due without delay and at the latest by the end of the next working day, if the customer reported the payment without undue delay. The bank can pursue the customer later if it proves intent or gross negligence.
A bank can withhold a refund only if it has reasonable grounds to suspect the customer committed fraud and it reports that suspicion to the relevant national authority. A view that the customer was careless is not enough. Banks should take legal advice on how this applies in their jurisdiction.
The bank pays the refund first. It can then seek compensation from the customer, but only if it proves that the customer acted intentionally or with gross negligence, and the bank carries the burden of proof. In practice, recovery is uncertain, so preventing the payment is the safer route.
Banks can prevent phishing losses by scoring every payment in real time with the account's recent activity in view, applying step-up checks to risky payments and holding the highest-risk ones. Early warning from network-wide data and a clear evidence trail help as well. Detection has to work before an instant payment is released. Fraudio's payment fraud detection is built for this: real-time scoring, rules and AI together, and network-wide data.
Strong customer authentication stops many attacks, but it does not stop phishing that tricks the customer into entering credentials or approving a payment. The EBA and ECB report that SCA remains effective, but that manipulation of payers is a growing risk. Transaction-level detection covers the gap.
Fraudio's payment fraud detection scores each transaction in real time before it is approved or released, and classifies it so the bank can approve, review, step up or block. Rules trigger first and AI analyses behind them, trained on networked data from issuers, acquirers and payment facilitators. Fewer phishing payments leave the account, so fewer refunds are owed. Integration takes 3 to 14 days.
Instant payments settle in seconds and generally cannot be recalled the way a card payment can be disputed. The decision therefore has to be made before release. Scoring that returns in milliseconds lets the bank act without slowing genuine payments.
Implementation ranges from under two weeks to over a year, depending on the vendor. Fraudio integrates in 3 to 14 days and offers a Proof of Results test on your historical data, so banks can compare results with their current setup before they commit.
How about trying our solution and experiencing the next generation for yourself?
