Page Contents
Key contacts
Related areas
On 15 October 2026, the Court of Justice of the European Union (CJEU) ruled that a payment service provider (PSP) may not refuse the immediate refund of an unauthorised payment transaction on the ground that the transaction and consequent losses were attributable to the gross negligence of the payer.
The CJEU’s judgment in Case C-70/25 (Tukowiecka) is a preliminary ruling on the interpretation of Articles 73(1) and 74(1) of Directive (EU) 2015/2366 (PSD2), which concern PSP and payer liability for unauthorised payment transactions.
The CJEU ultimately held that PSPs are generally obliged to immediately refund the amount of an unauthorised transaction even in circumstances where the payer made the transaction possible through gross negligence in breach of his or her obligations under Article 69 of PSD2 (including a failure to take all reasonable steps to keep their personalised security credentials safe). The refund must be made no later than the end of the following business day after the PSP has been notified of the unauthorised transaction. There is, however, an exception to issuing an immediate refund if the PSP has reasonable grounds to suspect that the payer has committed fraud and communicates those grounds to the national competent authority.
PSD2 liability regime
PSD2 sets out the liability regime for unauthorised payment transactions. Key provisions include the following:
Facts of the underlying case
The underlying case involved a phishing attack perpetrated on a customer of a Polish bank, PKO BP. The customer was the applicant in the Polish proceedings relating to the preliminary reference made to the CJEU.
An unidentified fraudster expressed interest in an item advertised by the customer on an online auction platform. Posing as a legitimate buyer, the fraudster sent the customer a link that appeared to originate from the online platform for the purposes of confirming the sale. After following that link, the customer was led to a website imitating the website of PKO BP, where she entered her online banking login details. Using these details, the fraudster transferred 3,000 PLN (c. €705) from the customer’s bank account to an account he held. The payment transaction was authorised by the fraudster by means of a confirmation code sent by SMS (text message) that he had obtained from the customer as a result of his deceit. The customer discovered the fraud the following day and immediately reported it to PKO BP and the police.
PKO BP refused to refund the amount of the unauthorised payment transaction to the customer on the basis that the customer had, through gross negligence, made the transaction possible by failing to comply with her obligation under Article 69 of PSD2 to keep the payment instrument in question safe and by making it available to unauthorised persons. Essentially, the bank argued that the loss resulted from the customer’s own gross negligence.
Following PKO BP’s refusal to issue a refund, the customer brought proceedings before a Polish court (the referring court).
Question referred for preliminary ruling
The referring court asked, in essence, whether a PSP can refuse to refund an unauthorised payment immediately because it considers that the payer made the transaction possible through a grossly negligent breach of their PSD2 obligations.
CJEU ruling
The CJEU found that the referring court's question should be answered in the negative. It held that Article 73(1) and Article 74(1) must be interpreted as meaning that a PSP cannot refuse to immediately refund a payer the amount of an unauthorised payment transaction on the ground that that payer made the transaction possible through gross negligence, in breach of their obligations under Article 69 of PSD2, including, in this case, a failure to take all reasonable steps to keep personalised security credentials safe. The refund must be made no later than the end of the following business day after the PSP has been notified of the unauthorised payment transaction.
There is, however, one exception to the immediate refund obligation. A PSP does not have to immediately issue a refund if it has reasonable grounds to suspect that the payer committed fraud and notifies those grounds, in writing, to the national competent authority.
Rationale for the ruling
The CJEU noted that, as regards the relationship between the obligations in Article 73 and in Article 74, the wording of Article 74(1) does not make it possible to determine “unequivocally” the scope of the derogation provided for in Article 74(1). According to one interpretation, the derogation affects the immediate refund obligation in Article 73(1), where the payer fails, with gross negligence, to fulfil his obligations under Article 69. According to another interpretation, the derogation concerns only the definitive nature of the refund, with the PSP being obliged, initially, to proceed with the immediate refund before being able, subsequently, where appropriate, to seek reimbursement from the payer for losses relating to an unauthorised transaction.
The CJEU pointed out that recital 71 of PSD2 refers to the situation where a PSP has objective grounds for suspecting fraud by a payment service user and communicates those grounds to the competent national authority. The CJEU states that recital 71 appears to support the interpretation that the only exception to the immediate refund obligation is that expressly laid down in Article 73(1), i.e. reasonably suspected fraud on the part of the payer.
The CJEU concluded that Articles 73 and 74 govern distinct aspects of the refund process for unauthorised payment transactions. Article 73 imposes on the PSP an obligation to refund the amount of an unauthorised payment transaction immediately. Whereas Article 74 determines who ultimately bears liability for the loss relating to the unauthorised payment transaction, at a later stage. On this basis, the PSP is initially obliged to proceed with the immediate refund. Subsequently, the PSP may, where appropriate, seek reimbursement from the payer of the losses relating to the unauthorised payment transaction if it can prove that the losses resulted from the payer’s failure, with intent or gross negligence, to comply with their obligations under Article 69 (including the obligation to safeguard personalised security credentials). The PSP must prove gross negligence on the part of the payer. The CJEU stated that this approach is consistent with the objective of ensuring a high level of consumer protection. Allowing the PSP to refuse an immediate refund by relying on gross negligence on the part of the payer would render the immediate refund obligation ineffective and would require the payer to assert their rights through the courts, while bearing the potential costs of the proceedings.
Impact of the judgment on PSPs
A PSP that is notified of an unauthorised payment transaction by a payer within the prescribed timeframe must refund the amount of the transaction by the end of the following business day. It cannot immediately refuse to make a refund simply because it considers the loss was attributable to the gross negligence of the payer. The PSP must make the refund first. It may then bring a separate claim against the payer, but it must prove that the payer was grossly negligent.
For refund claims prior to the CJEU’s judgment that were rejected by PSPs, the ruling interprets PSD2 as it has applied since coming into force. As a result, a previous refusal to refund based on suspected gross negligence was inconsistent with PSD2 at the time. Whether a payer can now bring a claim in light of this judgment will likely depend on national time limits and procedural rules.
What the CJEU did not rule on
The CJEU did not rule on several matters, including:
EU payments reform context
The judgment interprets PSD2, which remains the current framework. The EU is also progressing a broader reform package made up of a proposed Payment Services Regulation (PSR) and a proposed Third Payment Services Directive (PSD3). As at 9 November 2026, the PSR legislative procedure remains ongoing: the Council of the EU adopted its first-reading position on 29 October 2026, and the European Commission adopted a communication on that position on 3 November 2026.
The PSR could reverse the refund-first rule. Article 56 of PSR allows the PSP to suspend the immediate refund rules where it has “objectively justified reasons” to suspect intentional or grossly negligent conduct by the payer, communicated in writing. Within 15 business days, the PSP must either issue a refund or justify its refusal to do so.
Whilst the CJEU concluded that the legislator deliberately limited the exception to fraud. Article 56 of PSR would extend the exception to the very ground the CJEU has now excluded, the PSP’s suspicion of gross negligence. The PSR text also contains improvements the CJEU’s judgment does not provide: authentication alone may not be treated as proof of authorisation, fraud or gross negligence; the provider must supply supporting evidence; and the user must be invited to describe the events before the provider reaches a conclusion. But the core shift is plain. Under PSD2, as interpreted by the CJEU, the PSP must refund immediately and then prove gross negligence. Under Article 56 of PSR, the PSP may withhold the refund based on its own suspicion of gross negligence and decide the question itself, at least for 15 business days.
Key takeaways
To discuss the CJEU’s judgment and how it may impact on your business, please contact Louise Hogan, Partner, Eimear O’Brien, Partner, Eoin O Connor, Partner, Patrick Brandt, Partner or Sarah Lee, Senior Practice Development Lawyer.
Date published: 11 November 2026
