Phishing, gross negligence and the immediate refund obligation: the ECJ's ruling in Tukowiecka (C-70/25)

In its judgment delivered on 15 October 2026 (Case C-70/25, Tukowiecka), the European Court of Justice (ECJ) addressed a question of significant practical importance for payment service providers (PSPs) across the EU: can a PSP refuse to refund the payer the amount of an unauthorised payment transaction immediately on the basis that the payer, having fallen victim to a phishing attack, acted with gross negligence?

Answering this question in the negative, the ECJ confirmed that the immediate refund obligation under Directive (EU) 2015/2366 (PSD2) is subject to one exception only – namely where the payer's PSP has reasonable grounds for suspecting fraud and communicates those grounds in writing to the relevant national authority. The payer's gross negligence becomes relevant only at a later stage, when the provider, where appropriate, seeks reimbursement of its losses. 

I. Background

The dispute arose from a phishing scheme that will be familiar to many market participants. The applicant, a customer of the Polish bank PKO BP, had advertised an item for sale on an online auction platform. An unidentified perpetrator posing as a prospective buyer sent her a link that purported to confirm the sale but in fact led to a website spoofing her bank's online banking portal. By entering her login details there, the applicant enabled the perpetrator to transfer approximately EUR 705 to an account held by the perpetrator. The perpetrator authorised the transfer with an SMS confirmation code that had likewise been obtained from her by deceit. 

Although the applicant notified both the bank and the police on the following day, PKO BP refused to refund the amount, arguing that she had failed, with gross negligence, to safeguard her payment instrument diligently. In the bank's view, it was entitled to assess independently all the conditions of its liability and to refuse a refund once it had established such negligence.

The applicant brought an action before the District Court of Koszalin. That court observed that, in Polish practice, banks had not brought actions against consumers seeking reimbursement on the ground of gross negligence, whereas numerous consumers had sued banking institutions for refusing refunds. In its view, the application of exceptions to the right to a refund had effectively become the rule. The referring court therefore asked the ECJ whether Article 73(1) PSD2, read in conjunction with Article 74(1) PSD2, permits a PSP to refuse an immediate refund where the payer's loss results from a grossly negligent breach of the obligations under Article 69 PSD2.

II. Legal framework

PSD2 divides liability for unauthorised payment transactions between the PSP and the payer in two separate provisions. Under Article 73(1) PSD2, the payer's PSP must refund the amount of an unauthorised payment transaction immediately, and in any event no later than the end of the following business day, except where the payer's PSP has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing. Article 74(1) PSD2 applies "by way of derogation from Article 73". It provides that the payer may have to bear losses of up to EUR 50 resulting from the use of a lost or stolen payment instrument or from the misappropriation of a payment instrument. However, the payer bears all losses incurred by acting fraudulently or by failing, with intent or gross negligence, to fulfil one or more of the obligations under Article 69 PSD2. These obligations include, in particular, the obligation, as soon as the payer receives a payment instrument, to take all reasonable steps to keep the personalised security credentials safe.

This framework is complemented by Article 72(2) PSD2, under which the recorded use of a payment instrument is not in itself necessarily sufficient to prove fraud or gross negligence; the provider must instead "provide supporting evidence to prove fraud or gross negligence on part of the payment service user".

The crux of the case therefore lay in the relationship between Articles 73 and 74 PSD2. As the ECJ itself acknowledged, the wording of Article 74(1) PSD2 "does not make it possible to determine unequivocally the scope of the derogation provided for therein". It may be read either as limiting the immediate refund obligation itself, or as concerning only whether the refund is final, so that the provider must refund first and may only afterwards seek reimbursement from the payer.

III. Summary of the ECJ ruling

The ECJ adopted the latter interpretation, basing its reasoning on four principal strands:

1. Literal interpretation – only one exception: The wording of Article 73(1) PSD2 provides for an immediate refund, and in any event a refund no later than the end of the following business day after the provider notes or is notified of the transaction. It contains only one exception to this immediate refund obligation, namely where there is a reasonable suspicion of fraud, the grounds of which have been communicated in writing to the relevant national authority. Consequently, it provides for no exception where the provider suspects that the payer made the unauthorised transaction possible through gross negligence. 
2. Contextual interpretation – two stages of the refund procedure: Recital 71 PSD2 refers to the fraud exception, thereby supporting the interpretation that this is the only exception to the immediate refund obligation, while Article 72(2) PSD2 places the burden of proving gross negligence on the PSP. In the ECJ's view, the allocation of the burden of proof reflects the general scheme of the system established by Articles 73 and 74 PSD2, which consists in strengthening the protection afforded to the payer in the event of unauthorised payment transactions. The ECJ therefore concluded that these articles govern distinct aspects of the refund procedure: whereas Article 73 imposes an obligation to refund immediately, Article 74 "regulates the allocation of liability between that provider and the payer at a later stage".
3. Teleological interpretation – high level of consumer protection: PSD2 seeks to ensure a high level of consumer protection. Exempting the PSP from its immediate refund obligation because of the payer's gross negligence would not only deprive that obligation of its effectiveness; it would also require the payer "to take the initiative to assert his or her right, where appropriate, before the competent courts and to bear the resultant disadvantages, including the potential costs of the proceedings" – an allocation of risk that would be difficult to reconcile with that objective. 
4. Historical interpretation – a deliberate legislative choice: Neither Article 60 of the first Payment Services Directive (Directive 2007/64/EC) nor the Commission's initial PSD2 proposal provided for any express exception to the refund obligation. The fraud exception was introduced only during the legislative process, without Member States being permitted to introduce further exceptions.

The ECJ therefore concluded that Articles 73(1) and 74(1) PSD2 must be interpreted as meaning that a PSP "cannot refuse to refund immediately to a payer the amount of an unauthorised payment transaction on the ground that that payer made that transaction possible through gross negligence, in breach of his or her obligations under Article 69".

IV. Impact of the ECJ ruling

The judgment has important implications for PSPs across the EU, establishing a clear "refund first, argue later" principle for unauthorised payment transactions. Outside the narrow fraud exception – which requires reasonable grounds for suspecting fraud and a written communication of those grounds to the relevant national authority – providers can no longer withhold refunds by invoking the payer's gross negligence. This applies even in typical phishing scenarios in which the payer has disclosed login details and confirmation codes. The burden of initiating proceedings, bearing the costs of litigation and proving gross negligence thus shifts to the provider, which must pursue any reimbursement claim against the payer at a later stage.

Specifically, in Germany, the ECJ's ruling directly calls into question settled case law of the Federal Court of Justice (Bundesgerichtshof – BGH). Under section 675u sentence 2 of the German Civil Code (Bürgerliches Gesetzbuch – BGB), in transposition of Article 73 PSD2, a PSP is required to immediately refund an unauthorised payment transaction. In the past, the BGH held that a bank could refuse this immediate refund by invoking the principle of good faith under section 242 BGB, specifically the objection of “dolo agit” (BGH, judgment of 17 November 2020, XI ZR 294/19). Under that doctrine, if the bank had an alleged damages claim against the customer for gross negligence under section 675v(3) BGB, it was entitled to withhold the refund at the outset rather than paying first and reclaiming later. The BGH ruling was reflected in countless other lower court rulings in Germany.

The ECJ's ruling appears to render this German practice untenable. Because Article 73(1) PSD2 is fully harmonised and establishes only one single exception to the immediate refund obligation, namely, reasonable grounds to suspect fraud communicated in writing to the relevant national authority, national doctrines of good faith arguably cannot be deployed to create an unwritten exception for gross negligence. This view is already gaining immediate traction before German courts: in case 17 U 143/24, the Frankfurt Higher Regional Court recently indicated that the dolo agit defence is no longer available in light of the ECJ's two-stage framework.

In practice, this shifts the burden of initiating proceedings, advancing court fees, and bearing the interim recovery and credit risk (including customer insolvency) entirely to the PSP.

For market participants, the key operational challenge will be adapting refund and complaint-handling processes accordingly. Providers that have previously relied on gross negligence as a basis for refusing refunds will need to revisit these practices and ensure that refunds are processed immediately, while evidence required under Article 72(2) PSD2 is preserved to support any subsequent reimbursement claim. At the same time, the judgment will focus scrutiny on the fraud exception under Article 73(1) PSD2. Invoking this exception requires not only reasonable grounds to suspect fraud by the payer, but also a formal written notification to the relevant national authority. Given the tight deadline, no later than the end of the following business day, and the regulatory sensitivity of reporting customer fraud, this reporting mechanism may, however, not serve as a routine operational workaround for gross negligence disputes. 

Further, while the direct reimbursement obligation under Article 73(1) PSD2 applies exclusively to the payer's PSP, the ruling has secondary ramifications across the broader payment chain. Because the payer's PSP must refund immediately and its subsequent recovery against the customer may prove difficult or uneconomic, payer-side PSPs will face heightened financial incentives to seek recourse from other entities involved in the payment chain where possible. In particular, payer PSPs may increasingly pursue statutory recourse claims under Article 92 PSD2 against payee-side PSPs or intermediary institutions. Potential allegations may include deficiencies in KYC/AML controls or deficiencies in account verification and payee-matching processes. In litigation, payee-side PSPs must consequently prepare for an increased use of third-party notices (Streitverkündungen) by payer banks seeking to prepare recourse actions in stage-two proceedings. Payment service providers should therefore assess their exposure depending on whether they act as the payer's PSP, an intermediary, or the payee's PSP.

We would be pleased to discuss the implications of the ruling in more detail.