Tukowiecka Ruling: EU Banks Face a Reimburse Now, Discuss Later Reality

The EU Court of Justice’s Tukowiecka ruling has fundamentally upended the operational and legal playbook for European banks by requiring the immediate reimbursement of unauthorized transactions and shifting the burden of proving gross negligence from consumers to banks. For banking professionals, this requires retiring standard refusal templates and accelerating the shift to robust real-time transaction monitoring, as anticipated by the upcoming Payment Services Regulation (PSR).

The ruling marks a major shift in how EU banks handle scams. Breaking down the ruling can be challenging, so we’ve done it for you through a legal lens.

Key Takeaways

• In its Tukowiecka ruling, the EU Court of Justice ruled that banks must reimburse unauthorized transactions by the next business day, leaving gross negligence claims to be resolved afterward.
• The burden of proof rests with payment service providers to prove customer gross negligence or fraud through legal action, rather than denying refunds upfront.
• Standard refusal letters based on customer error or successful strong customer authentication must be retired in favor of post-reimbursement investigation procedures.
• Upcoming Payment Services Regulation (PSR) rules will grant a 15-day investigation window but introduce strict real-time monitoring requirements across all transactions.
• Financial institutions must shift to advanced real-time transaction monitoring and pre-execution fraud prevention to reduce unrecoverable fraud losses.

How a Phishing Scam Triggered a Landmark EU Court Ruling on Scam Liability

How did the scam liability landscape in the EU shift? It started with a click on a website.

A person in Poland put up something for sale on an online marketplace. Apparently, a keen buyer had found the listing and sent a link to confirm the sale. The seller clicked the link and was directed to a page that looked exactly like her bank’s. So she logged in. However, it was not her bank, and the fraudster used those details to move PLN 3,000 (about €700) to an account of his own, confirming the transfer with an SMS code as part of this “payment flow”. The next morning “the penny dropped”; she called her bank, PKO BP, and the police. Alas, the fraudster was never identified.

The bank considered the seller had been grossly negligent with her security credentials, so the loss was hers to absorb. She sued in the District Court (Sąd Rejonowy) in Koszalin, Poland. That court decided to ask the Court of Justice in Luxembourg a question that banks across the European Union had long answered for themselves: may a payment service provider refuse an immediate refund of an unauthorized transaction because, in its view, the payer made the transaction possible through gross negligence?

On 15 October, 2026, the Court of Justice said no (Case C-70/25, Tukowiecka, ECLI:EU:C:2026:852). The message is clear: banks must reimburse immediately. If the provider has reasons to believe the payment was due to the payer’s gross negligence, the bank must initiate litigation to recover the reimbursed funds.

What does the Court of the European Union’s Decision mean for banks’ fraud liability? 

This dispute turns on two provisions of the second Payment Services Directive (Directive (EU) 2015/2366, known as PSD2). The first, Article 73(1), states the provider’s obligation:

“Member States shall ensure that, without prejudice to Article 71, in the case of an unauthorized payment transaction, the payer’s payment service provider refunds the payer the amount of the unauthorized payment transaction immediately, and in any event no later than by the end of the following business day, after noting or being notified of the transaction, except where the payer’s payment service provider has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing.” 

The second, Article 74(1), states the payer’s liability: up to €50 in the ordinary case, and all losses where the payer acted fraudulently or failed, with intent or gross negligence, to meet the obligations in Article 69, including keeping personalized security credentials safe. Many banks read this as releasing them from the responsibility to refund as soon as the payer’s gross negligence is established (or invoked). In fact, at first glance, it seems odd to oblige a bank to hand over money it will be entitled to recover.

The First Chamber (Judge-Rapporteur Bošnjak) of the Court of Justice, following Advocate General Athanasios Rantos’ Opinion from March, took a different view.¹

According to the Court, article 73(1) contains only one exception to immediate refund: a reasonable suspicion of fraud communicated in writing to the national authority. It contains no exceptions for gross negligence (paras 33 and 34). Fraud here means the payer’s fraud, as recital 71 confirms (para 39). This means banks can refuse an immediate refund only in that circumstance.

Article 74 refers to the final allocation of the loss. That’s where gross negligence matters. Article 72(2) puts the burden of proving gross negligence on the provider (paras 40 to 42). As the court explained, letting the provider refuse on its own assessment would strip the refund of its useful effect and force the consumer to go to court, at her own cost, to obtain the refund (para 45). 

Does the Court of Justice’s ruling mean gross negligence is now irrelevant?

It’s important to note that the Court of Justice’s ruling has not rendered gross negligence irrelevant. However, its relevance has clearly diminished. 

Article 74(1) still determines who ultimately bears the loss. The provider remains free to claim the refunded amount from a payer who was grossly negligent in breaching Article 69, which establishes a duty to use the payment instrument in accordance with its terms and to notify without undue delay upon becoming aware of the loss, theft, misappropriation or unauthorized use of the payment instrument (para 46).

What the provider may no longer do is make that claim by refusing reimbursement. The Court’s press release stresses that the refund is a separate question from who ultimately bears the loss,² and places the burden of proving gross negligence on the provider. That last point is not new. Article 72(2) already says that the recorded use of a payment instrument is not in itself necessarily sufficient to prove gross negligence, and that the provider must produce supporting evidence.

Does the EU Court of Justice’s Ruling Define What ‘Gross Negligence’ is?

In this case, the Court did not specify what constitutes gross negligence. Whether typing one’s login and an SMS code into a convincing copy of the bank’s page clears that bar is left to national courts, case by case. 

Gross negligence is a qualified form of fault, the disregard of what anyone would see, and falling for a well-made phishing page may not qualify as gross negligence.  The bank must now win this argument as claimants in court, not simply mention it in a refusal letter.

The judgment’s most relevant gap is the route to recovery. If the bank’s terms let it re-debit the account, or set off its claim against the balance, once it has satisfied itself of the customer’s negligence, the refund becomes a loan of a few days, and we are back where we started. 

Advocate General Rantos was explicit that, if the customer will not pay back, the bank must sue. The Court spoke more generally of the legal means available for the purpose. I think the reasoning in paragraph 45 answers the question anyway: a unilateral re-debit puts the burden of starting the dispute back on the consumer, which is exactly what the Court refused to allow, and a contractual clause to that effect would also have to survive Directive 93/13 (unfair contract terms).

One door stays open. The fraud exception survives, and a bank that wants time can still report reasonable grounds to suspect fraud to the national authority. Nonetheless, I doubt it will become the new refusal letter. Fraud means the payer’s fraud, so the bank would be telling a supervisor, in writing, that its own customer committed a crime, and doing so routinely can have unpleasant effects.

What does the EU Court of Justice Ruling mean for banks?

Operationally, the change is simple to state. Timely notification of an unauthorized transaction must trigger a refund by the end of the next business day, and the triage that follows shifts from “refund or refuse” to “refund, then decide whether to pursue”. Retire complaint templates that refuse on the ground of gross negligence alone today. So should any internal policy that treats a successful strong customer authentication as the end of the inquiry.

The economics change more than the procedure. Before Tukowiecka, the customer had to start the litigation; now the bank does. The referring court made the point forcefully: it had seen many actions by consumers against banks that refused to refund, and not one action by a bank against a consumer to recover a refund on grounds of gross negligence (paras 23 and 24). For a claim of €700, few banks will sue. In low-value cases, the refund will, in practice, be final.

One can discuss whether this mechanism dulls customers’ vigilance. I don’t think any consumer, given the choice, would like the hassle, anguish, and inconvenience of being subjected to fraud.

Every euro of fraud that now stays on the bank’s books raises the value of stopping it before execution: transaction monitoring, delays on new payees. Prevention was always the better business case. It is now also the better legal one. The costs of fraud increase.

What does the EU Court of Justice Ruling mean for consumers?

For consumers, the practical advice is to act swiftly. Customers must tell the bank at once, through a channel that leaves a record, and have the instrument blocked. Article 71(1) sets an absolute limit of 13 months from the debit, but the duty is to notify without undue delay. Then, if banks want to comply with the law, consumers should expect to get the money back by the end of the next business day. 

A refusal that rests on gross negligence alone is, after Tukowiecka, an illegal refusal. The next steps are a written complaint, which the provider must answer within 15 business days (Article 101(2)), and then the out-of-court body or the courts.

Vigilance and careful record-keeping are now critical. Keep as much evidence as possible: the link, screenshots of the fake page, and above all the exact wording of every SMS. If the bank decides to sue, gross negligence may hinge on details like whether the message told the customer what (s)he was actually authorizing.

It is very important to have in mind that the judgment concerns unauthorized transactions, where the fraudster gives the order. It does not seem to apply to authorized push payment fraud, where the victim is manipulated into authorizing the transaction. For example, if a customer is deceived by a fake bank clerk or a fake police officer, or orders the transfer herself, PSD2 treats that payment as authorized, and Article 73 does not apply.

The distinction may be hard to make in practice (e.g., a code obtained by deception lets a fraudster complete strong customer authentication in the victim’s name). The agreed text of the forthcoming PSR mentions that (recital 79) and states that a transaction initiated by a third party using fraudulently obtained credentials is not authorized (recital 69b).⁴

Will the Tukowiecka decision survive the Payment Services Regulation?

Probably not in this form. PSD2 is to be replaced by the PSR, which carries the conduct rules, and a third directive, which keeps licensing. The EU Parliament and Council reached political agreement on November 27, 2025, and the Council’s General Secretariat put the final compromise text to the Permanent Representatives for confirmation on April 17, 2026 (Council document 8221/26).⁴ As of November 2026, the Regulation has not reached the Official Journal.

The compromise text keeps the immediate refund but adds some leeway. Where the provider suspects, on objectively justified reasons, that the unauthorized transaction resulted from the payer’s intentional or grossly negligent failure to keep the instrument and credentials safe, or from the payer’s fraud, it may investigate before refunding. Within 15 business days, it must either refund or give the payer the reasons and supporting evidence for refusing, together with the bodies to which the payer may turn. 

Although this 15-business-day window gives banks breathing room, gathering sufficient evidence to meet the heavy burden of establishing gross negligence within three weeks remains a significant operational hurdle.

Only a refusal based on the payer’s fraud must be reported to the national authority. The operative rule sits in Article 56 of the compromise text, complemented by recital 77.

Under the current text of the PSR, before concluding that the payer was grossly negligent, the provider must invite them, proactively and unambiguously, to provide their account and must consider it (recital 76c). Recorded authentication, even if strong, is not sufficient evidence of gross negligence on its own (recital 76a). A refusal must include reasons and evidence, and a consumer deceived by someone spoofing her own bank gains a refund right even for a transfer she authorized, subject to conditions that include a police report (recital 80a).

Beyond specific reimbursement rules for unauthorized transactions, the current text of the PSR significantly expands operational requirements through Article 83. It mandates monitoring across the entire payment journey, covering both outbound transfers before execution and inbound credits before funds are available, so in many cases real-time monitoring with millisecond decisions will be needed.

Crucially, Article 83(1a) shifts liability to control compliance. If a customer incurs financial damage, the payer’s bank must refund the transaction unless it can prove that both the sending and receiving institutions performed the required monitoring, or in case the customer acted fraudulently. This decouples liability from specific fraud classifications and makes real-time, provable monitoring a strict prerequisite to avoiding loss.

Until the PSR applies, the rule in the EU is now crystal clear: for unauthorized transactions, banks must reimburse first and discuss later. It is therefore even more essential to work with an experienced partner to avoid fraud or scam losses in the first place and prevent legal battles where no one wins. After all, once fraud happens, scammers are at large, and the consumers and the bank shouldn’t be fighting.

Additional Resources

• Blog: 7 ATO Attacks Stopped in Under 30 Minutes
• Report: Feedzai Fraud Readiness Index 2026
• eBook: Grow Digital Banking. Reduce Fraud.
• Solution: Fraud Prevention Solutions