The scenario is almost always the same. Someone is selling a bike or a pushchair online, a “buyer” gets in touch and sends a link the seller is supposed to use to “receive the payment”. The link leads to a page that looks exactly like their online banking. They enter their login details, then the code from a text message, and within minutes several thousand or tens of thousands of crowns have left the account. The next day they call the bank and are told: you bear the loss yourself, because you gave away your details through gross negligence.
Anyone who got that answer had to chase the money on their own. On 15 October 2026, however, the Court of Justice of the European Union ruled that a bank may not act this way. It must refund an unauthorised payment immediately. Whether the customer was grossly negligent can be dealt with only afterwards, and it is the bank that has to prove it.
We look at what the case was about, what exactly the Court said, how it affects the Czech Payments Act, what the judgment does not cover and how to use it in a complaint to your bank.
¶ What the Polish case was about
The judgment of 15 October 2026 in Case C-70/25 (to which the Court gave the fictitious name Tukowiecka) was delivered by the First Chamber of the Court of Justice on a reference from the District Court in Koszalin, Poland. A customer of a Polish bank was selling an item on an online auction platform. A supposed buyer sent her a link that looked like a confirmation of the sale. It took her to a fake website of her bank, where she entered her login details. The fraudster then transferred 3,000 zlotys, about EUR 705, from her account and confirmed the payment with an SMS code he had tricked out of her (paragraph 15).
The customer discovered the fraud the next day and immediately reported it to both the bank and the police (paragraph 16). The bank refused to refund the money. In its view, she had breached her obligation to safeguard the payment instrument through gross negligence (paragraph 17). In court, the bank argued that it could assess gross negligence itself and, if it established it, did not have to refund anything (paragraph 20).
In its request for a preliminary ruling, the Polish court described how banks treat the exceptions to the refund obligation as the rule, leaving customers to go to court (paragraph 24). It therefore asked whether a bank may refuse an immediate refund by pointing to the customer's gross negligence.
¶ What the Court of Justice said
The answer is unequivocal: it may not. According to the operative part of the judgment, a payment service provider cannot refuse to refund immediately to a payer the amount of an unauthorised payment transaction on the ground that the payer made that transaction possible through gross negligence (paragraph 52 and the operative part).
The Court got there by its usual route: the wording, context, purpose and history of the directive.
Wording. Article 73(1) of Directive 2015/2366 requires the bank to refund the amount of an unauthorised payment immediately, and in any event no later than by the end of the following business day. It allows only one exception: the bank has reasonable grounds for suspecting fraud and communicates those grounds in writing to the relevant authority (paragraphs 31 and 33). The directive has no exception for a suspicion that the customer was grossly negligent (paragraph 34).
Context. Article 73 says that the money is refunded immediately. Article 74 says who ultimately bears the loss. According to the Court, these are two stages: first the immediate refund, then, where appropriate, the allocation of liability (paragraph 42). The burden of proof fits this scheme: it is the bank that must prove the customer's gross negligence (Article 72(2) of the directive, paragraph 40).
Purpose. If the bank could refuse the refund from the outset, the obligation to refund immediately would lose its point, and the customer would have to enforce the right in court and bear the costs of the proceedings. According to the Court, that is difficult to reconcile with the aim of ensuring a high level of consumer protection (paragraph 45).
History. The earlier directive of 2007 had no exception to the immediate refund at all. The EU legislature added the exception for reasonable suspicion of fraud only during the adoption of the new directive, and it did not allow the Member States to maintain or introduce different rules (paragraphs 48 and 49).
One more detail is of interest for the Czech Republic. The Czech government submitted written observations in the case and, together with the Italian government, argued that this interpretation circumvents out-of-court dispute resolution. The Court rejected the argument. Out-of-court dispute resolution, which in the Czech Republic is provided by the Financial Arbitrator (finanční arbitr), covers all disputes arising from payment services. It therefore cannot be seen as a stage at which the customer's gross negligence has to be assessed before the bank refunds the money (paragraphs 50 and 51).
The bank does not lose its claims, though. Once it has refunded the money, it can ask the customer to make good the loss if it proves that the customer caused it through gross negligence (paragraph 46).
¶ How this affects Czech law
In the Czech Republic the directive is implemented by Act No. 370/2017 Coll., on Payments. Section 181(1) requires the bank to put an unauthorised payment right without delay, and no later than by the end of the following business day after it became aware of the payment or the payer notified it. The bank either restores the account to the state it would have been in had the amount not been debited, or refunds the amount, any charges paid and the lost interest. The time limit does not start to run as long as the bank has reason to believe that the payer acted fraudulently and notifies the supervisory authority of this in writing, giving its reasons (Section 181(3)). This corresponds to the only exception the Court of Justice recognised.
The problem lies in Section 181(4). Under it, the refund obligation does not apply if the loss from the unauthorised payment transaction is borne by the payer. And the payer bears the loss in full if they caused it fraudulently or by breaching their obligations intentionally or through gross negligence; those obligations include taking all reasonable steps to protect their personalised security credentials (Section 182(1)(b) and Section 165(a)). A bank can build a refusal on the combination of these two provisions: in its view you bear the loss, so it refunds nothing. That is exactly what the Polish bank did, and the Court of Justice rejected it.
The directive does not apply directly between a bank and its customer. But the Court of Justice has long required national courts to interpret national law, so far as possible, in the light of the wording and purpose of the directive. In doing so, they may not go against the clear wording of the statute (Grand Chamber judgment of 24 January 2012, Case C-282/10, Dominguez, paragraphs 24, 25 and 42).
In our view, Section 181(4) can bear that interpretation. Whether the payer bears the loss is not settled by the bank saying so in its reply to a complaint. It is a question the bank has to prove, and it is decided by the Financial Arbitrator or a court. Until that happens, subsection 1 applies and the money is refunded. That is precisely the order the Court of Justice requires. Moreover, in this respect the directive is a full harmonisation measure: a Member State may not keep a rule that would widen the exceptions to the immediate refund (Article 107(1) of the directive, paragraph 49 of the judgment). Reading Section 181(4) as allowing the bank to withhold the refund on its own say-so would turn it into exactly that kind of rule.
Two more provisions are worth noting. The payer bears no loss at all if they did not act fraudulently and the bank did not require strong customer authentication for the payment where the law requires it (Section 182(3)(c)). And with business customers the bank may agree to depart from the rules on who bears the loss (Sections 182 to 185), but not from the obligation to put an unauthorised payment right under Section 181 (Section 128(6)). It may, however, agree with them on a shorter period for notifying an unauthorised payment (Section 188(1)), so a business should check the period in its framework contract.
¶ What the judgment does not cover
The judgment helps only with an unauthorised payment, meaning one you did not consent to (Section 156(1) of the Payments Act). In the Polish case, the fraudster made the transfer himself, using the details and the code he had tricked out of the customer. Nobody there disputed that the payment was unauthorised (paragraph 2), and the Court of Justice did not address the point. Yet that is exactly what a dispute can turn on, especially when the customer gave away an SMS code or confirmed something in the banking app. The bank's record that your payment instrument was used may not be enough on its own to prove consent (Article 72(2) of the directive). What matters is who made the payment and what you consented to.
Nor does the judgment say that the customer's negligence plays no role. Once it has refunded the money, the bank can claim it back if it proves gross negligence (paragraph 46). If you were not grossly negligent, your share of the loss is capped at the equivalent of EUR 50 (Section 182(1)(a)). For payments made only after you reported the misuse, you bear nothing, even if you had been negligent before (Section 182(3)(a)).
Nothing changes, either, about the need to report fraud to the bank quickly. You can claim rectification only if you notify the bank of the unauthorised payment without undue delay after learning of it, and no later than 13 months after the money was debited (Section 188(1)). The bank can object that the notice was late, and the court will then reject the claim (Section 188(4)). The Polish customer reported the fraud the very next day, as soon as she discovered it.
¶ How to use the judgment in a complaint
Call the bank as soon as you discover the fraud, have your online banking access and cards blocked, and say expressly that you did not make the payment and did not consent to it. On request, the bank must give you proof that you reported the misuse (Section 166(1)(d)). Ask for it.
Then send a written complaint. Describe what happened, factually and truthfully, when you discovered the fraud and when you reported it. Ask for a refund under Section 181(1) of the Payments Act and refer expressly to the judgment of the Court of Justice in Case C-70/25, paragraph 52. Do not get drawn into whether you were negligent; that is for the bank to prove.
If the bank does not refund the money by the end of the following business day and relies on Section 181(4), paragraphs 33, 34, 42 and 49 of the judgment give you a strong argument, before the Financial Arbitrator if you are a consumer and before a court if you are a business (Section 3(2) of Act No. 229/2002 Coll., on the Financial Arbitrator). What to do in the first hours, what evidence to keep and how proceedings before the Financial Arbitrator work is described in our article A Fraudster Emptied My Bank Account. What to Do in the First Hours and When the Bank Must Refund the Money.
¶ At a glance
| Question | Answer | Provision |
|---|---|---|
| By when must the bank refund an unauthorised payment? | Without delay, no later than by the end of the following business day after becoming aware of it or being notified of it | Section 181(1) of the Payments Act; Article 73(1) of Directive 2015/2366 |
| May the bank refuse a refund because of the customer's gross negligence? | No, it must refund the money first | Court of Justice judgment C-70/25, paragraph 52 and operative part |
| What is the only exception to the immediate refund? | Reasonable suspicion of fraud by the customer, communicated in writing to the relevant authority | Article 73(1) of the directive; paragraph 33 of the judgment; Section 181(3) of the Payments Act |
| Who has to prove gross negligence? | The bank | Article 72(2) of Directive 2015/2366; judgment C-70/25, paragraph 40 |
| May Czech law widen the exceptions to the immediate refund? | No, the directive allows no departures in this respect | Article 107(1) of the directive; paragraph 49 of the judgment |
| Did the Court decide when a payment is unauthorised? | No, nobody disputed it in the Polish case | Judgment C-70/25, paragraph 2; Section 156(1) of the Payments Act |
Has your bank refused to refund your money, citing gross negligence? We will go through your complaint and the bank's reply, assess whether the payment was unauthorised and prepare a letter before action, an application to the Financial Arbitrator or a court claim. We handle disputes with banks as part of our dispute resolution practice. Get in touch.
¶ Conclusion
Judgment C-70/25 mainly changes the order of things. A customer whom the bank accused of gross negligence used to have to argue with it and wait for the money. Now the bank must refund an unauthorised payment by the end of the following business day and can pursue the dispute over negligence only afterwards, with the burden of proof on its side. If it refuses, relying on Section 181(4), a consumer has a strong argument before the Financial Arbitrator and a business before a court. For the customer, the lesson is simple: report the fraud at once and cite the judgment expressly in the complaint.
¶ Sources
- Act No. 370/2017 Coll., on Payments, Sections 128(6), 156, 165, 166, 181, 182 and 188 (as in force from 1 October 2025).
- Act No. 229/2002 Coll., on the Financial Arbitrator, Section 3(2) (as in force from 15 February 2025).
- Act No. 89/2012 Coll., the Civil Code, Section 629(1).
- Directive (EU) 2015/2366 of the European Parliament and of the Council on payment services in the internal market, Articles 69, 72, 73, 74 and 107.
- Judgment of the Court of Justice (First Chamber) of 15 October 2026, Case C-70/25, Tukowiecka.
- Judgment of the Court of Justice (Grand Chamber) of 24 January 2012, Case C-282/10, Dominguez.
¶ Frequently asked questions
Does my bank have to refund the money if I gave my login details to a fraudster?
For an unauthorised payment, yes, and without delay, no later than by the end of the following business day (Section 181(1) of the Payments Act). In its judgment of 15 October 2026 in Case C-70/25, the Court of Justice of the EU ruled that the bank cannot refuse the refund merely because it accuses you of gross negligence.
Can the bank ask for the money back later?
It can, if it proves that you caused the loss intentionally or through gross negligence, for example by failing to protect your security credentials (Section 182(1)(b) of the Payments Act). The burden of proof lies with the bank.
Does judgment C-70/25 also cover a payment I sent myself on the instructions of a fake bank employee?
No. The judgment concerns unauthorised payments. A payment you consented to is authorised (Section 156(1) of the Payments Act), even if you made it because you were deceived.
Does judgment C-70/25 apply in the Czech Republic when Section 181(4) of the Payments Act says something different?
The judgment interprets Directive 2015/2366, which the Payments Act implements, and the courts must interpret the Czech statute in line with the directive as far as possible. In our view, Section 181(4) therefore applies only once the bank proves the customer's gross negligence, not when it merely alleges it.
Did the Court of Justice decide when a payment made after phishing is unauthorised?
No. In the Polish case nobody disputed that the customer had not authorised the payment, and the Court did not address the point. Even so, the bank's record that a payment instrument was used may not be enough on its own to prove authorisation (Article 72(2) of Directive 2015/2366).