A bank cannot refuse an immediate refund of money lost through an unauthorised payment transaction solely because it alleges gross negligence on the customer's part. This follows from the judgment of the Court of Justice of the European Union of 15 October 2026 in Case C-70/25 (Tukowiecka).
The judgment followed a request for a preliminary ruling from the District Court in Koszalin. It is significant for victims of phishing, theft of online banking credentials and other fraud resulting in unauthorised transfers.
In particular, it may also be relevant to customers whose refund requests were refused before 15 October 2026.
What was the case before the CJEU about?
The case concerned a customer of a Polish bank who advertised an item for sale on an online marketplace.
A person posing as an interested buyer sent her a link supposedly intended to confirm the sale. In fact, it led to a fake website resembling the bank's site.
The customer entered her online banking credentials. The fraudster used them to transfer money from her account.
A dispute arose over the bank's liability for the unauthorised transaction and the significance of the customer's conduct, which was alleged to amount to gross negligence.
The District Court in Koszalin asked the CJEU to interpret the PSD2 Directive, in particular whether an allegation of gross negligence allows a bank to refuse an immediate refund.
What did the CJEU rule on 15 October 2026?
The Court made clear that a customer's gross negligence does not release the payment service provider from its obligation to refund the amount of an unauthorised transaction immediately.
As a rule, the bank should first refund the money and then, if there are grounds, pursue the customer for the loss caused by their gross negligence.
The Court thus distinguished two legal issues:
- The obligation to refund the amount of the unauthorised transaction without delay.
- Ultimate liability for the loss that the bank may attribute to the customer.
The judgment does not mean a customer can never be liable for gross negligence. It means that the allegation alone does not justify withholding the statutory refund.
What was the position before the CJEU judgment, and what is it afterwards?
The judgment of 15 October 2026 did not change the wording of the legislation. It resolved an important issue concerning its interpretation and application by banks.
What was the position before the judgment?
Article 46(1) of the Polish Payment Services Act already required an immediate refund of the amount of an unauthorised transaction, generally no later than the end of the next business day.
In practice, however, some banks refused refunds on the grounds of the customer's gross negligence.
This included situations where an account holder clicked a fraudulent link, entered credentials on a website controlled by fraudsters, disclosed an authorisation code or failed to recognise a message impersonating the bank.
Banks relied on breaches of duties concerning the security of payment instruments.
As a result, a customer refused a refund often had to pursue the claim in court. The dispute over liability could continue for months or even years.
It should be emphasised, however, that this was not the uniform practice of all banks and courts. The duty of immediate reimbursement already followed from the existing legislation.
What did the CJEU judgment change?
The Court established that a bank cannot make its immediate refund obligation conditional on first deciding whether the customer was grossly negligent.
If the statutory conditions for a refund are met, the bank should comply within the prescribed period.
Only afterwards, if it establishes grounds for the customer's liability, may it bring the appropriate claim.
This significantly affects the practical allocation of the burden of pursuing claims.
Previously, a bank's refusal often forced the victim to sue for repayment. Under the CJEU's interpretation, the bank cannot withhold the funds solely on the basis of its own allegation of the customer's gross negligence.
The main differences
| Issue | Earlier practice of some banks | Principle confirmed by the CJEU |
|---|---|---|
| Refund | Refusal based on alleged gross negligence | The allegation alone does not justify refusal |
| Refund deadline | The customer often waited until the dispute ended | Generally by the end of the next business day |
| Assessment of the customer's conduct | Sometimes used to withhold the refund | May justify a subsequent claim by the bank |
| Court proceedings | The customer often sued the bank | The bank may pursue the customer's liability after refunding |
| Ultimate liability | Dependent on the circumstances | Still dependent on the circumstances |
How long does the bank have to refund the money?
Under Article 46(1) of the Polish Act of 19 August 2011 on Payment Services, the bank should refund the unauthorised transaction immediately, no later than the end of the business day following the day it becomes aware of the transaction or receives the relevant notification.
The bank should also restore the account to the position it would have been in had the unauthorised transaction not taken place.
The Act provides specified exceptions. One concerns a bank having reasonable, duly documented grounds to suspect fraud and informing the relevant law-enforcement authorities in writing.
Suspicion of fraud by the customer must not, however, be equated with a mere allegation of carelessness or gross negligence.
May the bank rely on the customer's gross negligence?
Yes. The CJEU judgment does not remove the customer's liability for breaching obligations under payment services legislation.
However, not every careless act amounts to gross negligence.
The assessment must consider the circumstances of the incident, including the fraudsters' methods, the information disclosed, the bank's messages and the customer's conduct.
Under Article 45(2) of the Payment Services Act, showing that recorded use of a payment instrument occurred is not by itself sufficient to prove authorisation or gross negligence.
The payment service provider bears the burden of proving the circumstances establishing the customer's liability.
A transfer made by a fraudster without the account holder's consent must also be distinguished from one personally authorised by the customer, even if induced by fraud. Not every case of fraudulently obtaining money is an unauthorised transaction within the meaning of the Act.
Example: fraudsters steal PLN 30,000 from an account
A customer receives a text message containing a link to a website impersonating their bank.
After opening the site, the customer enters their credentials. The fraudster gains access and transfers PLN 30,000 without consent.
The customer promptly tells the bank they did not authorise the transaction.
Before the CJEU judgment, the bank might in practice refuse a refund, taking the view that the customer was grossly negligent. The victim then had to pursue the claim, often in court.
In light of the CJEU judgment, unless a statutory exception applies, the bank should immediately refund PLN 30,000 and cannot refuse solely on the grounds of alleged gross negligence.
If the bank subsequently establishes grounds for the customer's liability, it may pursue the appropriate claim.
Can the customer claim late-payment interest?
Yes. If the bank fails to perform its due refund obligation within the statutory period, the customer may generally claim statutory late-payment interest.
The legal basis is Article 481 §§ 1 and 2 of the Polish Civil Code in conjunction with Article 46(1) of the Payment Services Act.
Interest may be payable from the day after the refund deadline until actual payment.
For example, if the customer reports an unauthorised transfer on Monday and the statutory refund deadline expires on Tuesday, late-payment interest may accrue from Wednesday.
In every case, the notification date, the date the claim became due and any statutory exceptions must be correctly established.
The CJEU judgment does not introduce a separate interest rate or mean that interest starts accruing only on 15 October 2026.
The bank refused a refund before 15 October 2026: what can be done?
The CJEU judgment may be relevant not only to new cases but also to disputes arising before it was delivered.
Several situations must, however, be distinguished.
1. The bank rejected the complaint, but no court claim was brought
The bank's position should be reviewed, particularly if its refusal was based on alleged gross negligence.
A demand for payment may be sent, relying on Article 46 of the Payment Services Act and the CJEU's interpretation.
Limitation and compliance with statutory transaction-notification deadlines must also be checked.
2. Proceedings against the bank are pending
The CJEU judgment may provide an important legal argument in court.
In particular, consideration should be given to relying on the Court's interpretation of the immediate-refund rules.
Its relevance nevertheless depends on the subject matter, legal basis of the claim, facts and stage of proceedings.
3. The case ended with a final judgment
The situation is more complicated.
The CJEU judgment does not automatically reopen concluded civil proceedings.
Any further action requires individual analysis of the final decision, procedural rules and possible extraordinary remedies.
It should not be assumed that every earlier decision unfavourable to the customer can now be overturned.
What should you do after discovering an unauthorised transfer?
Anyone noticing an unauthorised transaction should first notify the bank immediately and secure access to the account.
Keep records, including the transaction history, notification confirmations, correspondence with the bank, messages received and any other material potentially relevant as evidence.
If the bank refuses a refund, possible steps include a written demand for payment, assistance from the Polish Financial Ombudsman and court proceedings.
Compliance with Article 44 of the Payment Services Act is also important. It requires notification without undue delay and generally sets a maximum of 13 months from the account being debited, subject to statutory exceptions.
Why is the CJEU judgment so important?
The significance of the judgment of 15 October 2026 extends beyond the individual dispute between a Polish customer and her bank.
The Court clearly stated that the immediate refund obligation and the customer's liability for gross negligence are separate issues.
In practice, this strengthens protection for victims of unauthorised payment transactions.
Previously, a bank's refusal often left the customer without the lost funds throughout the complaint process and court proceedings.
The CJEU's interpretation confirms that the bank should first comply with its refund obligation and only then pursue any liability of the customer.
This does not release account holders from security obligations, but limits the bank's ability to shift the consequences of an unauthorised transaction unilaterally onto the customer.
Legal assistance in disputes with banks
If a bank has refused to refund money lost through an unauthorised transfer, its position should be analysed in light of the latest CJEU case law.
Barbara Kardynia Law Office provides assistance in civil matters, including monetary claims and disputes with financial institutions.
Assistance may include reviewing banking documentation, assessing claims, preparing a demand for payment, calculating interest and representation in court.
Barbara Kardynia, Advocate
Barbara Kardynia Law Office
Telephone: +48 795 674 344
Email: b_kardynia@icloud.com
Website: https://adwokatkardynia.pl/en/
Legislation and case law
- Judgment of the Court of Justice of the European Union of 15 October 2026, C-70/25, Tukowiecka.
- Directive (EU) 2015/2366 of the European Parliament and of the Council (PSD2), particularly Articles 69 and 72–74.
- Polish Act of 19 August 2011 on Payment Services, particularly Articles 42, 44, 45 and 46.
- Article 481 of the Polish Civil Code.
Official CJEU press release (in Polish): https://curia.europa.eu/site/upload/docs/application/pdf/2026-10/cp260147pl.pdf
This article is for information and does not replace individual legal advice.
This article is also published in Polish on the legal blog of Barbara Kardynia, Advocate.