On 15 October, the Court of Justice of the European Union delivered a judgment holding that a bank cannot refuse to refund immediately to a customer the amount of an unauthorised payment transaction on the ground that the customer made that transaction possible through gross negligence.
The Facts of the Case
A customer of a Polish bank fell victim to a phishing attack committed by an unidentified perpetrator, who, after showing interest in the purchase of an object advertised for sale by the victim on an online auction platform, sent her a link of such a kind as to cause her to believe that it originated from that platform and that it had the purpose of confirming the sale. After following that link, the customer accessed a website spoofing her bank’s website where she entered her online banking service login details.
The data thus obtained enabled that perpetrator to transfer, from the client’s account to an account held by the perpetrator, the sum of approximately EUR 700. That payment transaction was authorised by the perpetrator of the fraud by means of a confirmation code sent by SMS and obtained from the applicant in the main proceedings as a result of that deceit.
The next day, the client immediately notified the unauthorised payment transaction to the bank, which refused to refund to the client the amount of the unauthorised payment transaction, on the ground, inter alia, that the loss she had suffered resulted from her having, as a result of gross negligence, failed to comply with her obligation to diligently safeguard the payment instrument in question and not to make it available to unauthorised persons.
Subsequently, the client brought an action before the District Court in Poland.
In the course of the proceedings, the referring court submitted a request for a preliminary ruling to the Court of Justice of the European Union concerning the interpretation of the Directive on payment services in the internal market.
In particular, the referring court sought to ascertain whether, under EU law, a bank can refuse to refund to a client immediately the amount of an unauthorised payment transaction if the payer has suffered a loss in connection with the unauthorised payment transaction as a result of failing, with gross negligence, to fulfil the obligations set out the directive.
The CJEU’s Ruling
The CJEU answered the question in the affirmative, laying down the following principle: in the event of an unauthorised payment transaction, the payment service provider is required to refund immediately to a client the amount of that transaction, and in any event no later than the end of the following business day after becoming aware of, or being notified of, the transaction, provided that the customer notifies the payment service provider thereof without undue delay.
However, the payment service provider may subsequently seek reimbursement from the customer for losses arising from unauthorised payment transactions where such losses result from the payer’s failure, through gross negligence, to fulfil the obligations incumbent upon them, by bringing legal proceedings against the customer.
The burden of proof rests with the bank, which must establish that the losses incurred resulted from the customer’s intentional or grossly negligent breach of their obligations, particularly the obligation to safeguard their personalised security credentials.
As a result of this ruling, the payment service provider bears responsibility for deciding whether to initiate legal proceedings to pursue its claim and, consequently, for bringing such proceedings and discharging the burden of proof, whereas previously the litigation risk and the associated costs were borne by the customer.
Exception to the General Principle
There is only one exception to this obligation of immediate reimbursement: where the payment service provider has reasonable grounds to suspect fraud committed by the customer and communicates those grounds in writing to the competent national authority.
Unauthorised Payment Transactions and the Right to Reimbursement
Immediate reimbursement is provided for only in cases of unauthorised payment transactions. This expression refers to a payment transaction initiated by a third party without the account holder’s consent, using security credentials unlawfully obtained from the latter.
Examples include a bank transfer executed after the account holder has entered their login credentials on a fraudulent website impersonating their bank, or the use of cloned payment card details to make online purchases. In such cases, the payment order is initiated not by the bank’s customer, but by the perpetrator of the fraud.
Exclusions from the Right to Reimbursement
Conversely, immediate reimbursement is excluded where the payment transaction is done directly by the bank’s customer, even if the customer has been deceived into authorising it.
An example is investment fraud: a bank customer who has been induced to make a fraudulent investment by transferring funds from their own account to that of a purported trader is not entitled to claim immediate reimbursement under the rules governing unauthorised payment transactions.
The Legal Effect of Judgments of the Court of Justice of the European Union
A judgment delivered by the Court of Justice of the European Union in preliminary ruling proceedings is binding on the referring national court as regards the interpretation or validity of the provisions and acts of EU law to which it relates, clarifying their meaning and scope of application, with erga omnes effect throughout the European Union.
In particular, the legal principle established by this judgment is also binding on Italian courts called upon to adjudicate similar cases.
Procedure for Obtaining Immediate Reimbursement
The customer should promptly notify the bank of the fraudulent transaction, formally dispute the payment, and request immediate reimbursement of the amount debited, expressly referring to the judgment of the Court of Justice of the European Union.
If the bank fails to provide reimbursement, the customer may lodge a formal complaint with the bank and, subsequently, refer the dispute to the Italian Banking and Financial Ombudsman (Arbitro Bancario Finanziario – ABF).
The Banking Practice Prior to This Judgment
Prior to this judgment, the prevailing banking practice, supported by legal scholarship, was to refuse immediate reimbursement on the grounds that the customer had enabled the unauthorised payment transaction to take place through gross negligence, particularly by failing to take the necessary measures to safeguard their personalised security credentials.
The law firm Dal Pozzo in Milan provides legal assistance to private individuals, public entities, and businesses, including matters related to to cybercrimes.