In this article, Margaux FRISQUE, Partner, and Léa SARFATI, Associate, in the Commercial Contracts and Litigation department, analyse the scope of the judgment delivered by the Court of Justice of the European Union on 15 October 2026, its consequences for banks’ refund obligations and the remedies available to victims of banking fraud.
When a customer falls victim to bank fraud, it is not uncommon for their bank to refuse a refund on the grounds that they disclosed their security credentials or approved a suspicious transaction. The bank then invokes “gross negligence” in order to make the customer bear the financial consequences of the fraud.
In a judgment of 15 October 2026 (C-70/25, Tukowiecka), the Court of Justice of the European Union (CJEU) calls this practice into question, ruling that a customer’s gross negligence does not allow the bank to refuse the immediate refund of an unauthorised payment transaction. If the bank considers that its customer committed such a fault, it must first refund them, before it may, where appropriate, claim repayment of the sums paid.
This decision significantly shifts the balance of banking litigation, without however guaranteeing final compensation to every fraud victim.
Gross negligence is no bar to an immediate refund
EU payment services law, derived from Directive (EU) 2015/2366, known as PSD2, rests on two complementary mechanisms.
First, Article 73 of the Directive, transposed into Article L. 133-18 of the French Monetary and Financial Code (Code monétaire et financier), requires the bank to refund any unauthorised transaction immediately after being notified of it and, at the latest, by the end of the following business day.
Second, Article 74 of the Directive, transposed into Article L. 133-19 of the same Code, provides that the customer may bear the losses resulting, in particular, from an intentional or grossly negligent failure to comply with their security obligations.
The difficulty lay in how these provisions fit together. Some banks regarded gross negligence as an exception to their refund obligation and relied on it to refuse their customers’ claims outright.
The CJEU rejects this interpretation by distinguishing the obligation to refund immediately from the final allocation of losses. The bank therefore cannot refuse to re-credit the account solely because it considers its customer to have been grossly negligent. It nevertheless retains the possibility of subsequently claiming repayment, through the appropriate legal channels, provided that it proves the fault alleged.
Only where there are reasonable grounds to suspect fraud by the customer themselves may the refund be deferred, provided that those grounds are communicated in writing to the Banque de France, in accordance with Article L. 133-18 of the Monetary and Financial Code.
A shift in the balance of power between bank and customer
Beyond clarifying the legislation, the judgment changes the way in which disputes over unauthorised transactions are brought. Whereas victims were often forced to go to court to challenge a refusal based on their alleged gross negligence, it is now for the bank, once it has complied with its refund obligation, to take the necessary steps if it intends to make the customer bear the loss definitively.
This development comes with significant evidentiary requirements. Article L. 133-23 of the Monetary and Financial Code specifies that the use of the payment instrument, as recorded by the bank, is not necessarily sufficient in itself to establish that the customer authorised the transaction or acted with gross negligence. Furthermore, where the bank did not require strong customer authentication, Article L. 133-19, V of the same Code provides that the customer bears, in principle, no loss, unless they acted fraudulently.
Failure to comply with the refund obligation also exposes the bank to the penalties laid down in Article L. 133-18 of the Monetary and Financial Code. Sums due bear interest at the statutory rate plus five percentage points, rising to ten points beyond seven days’ delay and fifteen points beyond thirty days.
Finally, this interpretation may be relied upon in pending disputes, including where the refusal to refund predates the judgment, subject to the applicable time limits and to decisions that have become final.
Protection limited to unauthorised transactions
This solution does not, however, benefit all fraud victims indiscriminately. It applies only where the disputed transaction qualifies as unauthorised, that is to say executed without the payer’s consent, within the meaning of Article L. 133-6 of the Monetary and Financial Code.
This may be the case where a fraudster uses banking credentials stolen through phishing to carry out a transfer themselves.
The position is different where the victim personally ordered the transfer of funds, for instance to a fake investment platform. Even though they were deceived as to the destination or use of their money, the payment remains, in principle, authorised and falls outside the refund mechanism provided for in Article L. 133-18.
That said, the absence of a right to a refund on this basis does not rule out all action against the bank. Its contractual liability may be engaged, in particular, where it fails in its duty of vigilance in the face of apparent anomalies affecting the transactions carried out, notwithstanding the principle of non-interference in its customer’s affairs. Such an action, however, requires proof of a breach attributable to the bank and of a loss caused by that breach, and any fault on the customer’s part may also be taken into account.
Bank adviser impersonation scams are a particularly clear illustration of why this distinction matters. Where a fraudster poses as a bank adviser and persuades the customer to approve a transaction presented as a way of blocking a suspicious payment, the question arises whether the customer actually consented to the disputed transfer.
The answer requires a detailed analysis of the circumstances of the fraud, of how the transaction was approved and of the information actually brought to the payer’s attention. The mere use of an authentication device is not necessarily sufficient to establish that the payer authorised the payment.
The characterisation of the transaction is therefore an essential prerequisite to any action against the bank, since it determines the applicable liability regime and the remedies that may be pursued.
What remedies are available to victims of bank fraud?
A victim of bank fraud should block their payment instrument where necessary and report the disputed transaction to their bank without delay, preferably in writing, and then file a criminal complaint. For unauthorised transactions, Article L. 133-24 of the Monetary and Financial Code provides, in principle, a maximum period of thirteen months from the debit date, failing which the claim is time-barred.
Where the bank refuses a refund on grounds of gross negligence, the Tukowiecka judgment now provides an additional basis for demanding compliance with Article L. 133-18 and, where appropriate, for claiming the late-payment penalties provided for in that article.
If the refusal persists, a referral to the banking ombudsman (médiateur bancaire), which is free of charge, may precede legal proceedings.
The firm d&a partners assists victims of banking fraud in analysing their situation and pursuing the appropriate remedies, from challenging a refusal to refund to bringing a liability claim against their bank.
