Must banks refund money stolen by scammers? EU Court ruling 2026
On 15 October 2026, the Court of Justice of the EU ruled in Case C‑70/25 (Tukowiecka) that a bank cannot delay the initial refund of an unauthorised transaction merely because it believes the customer was grossly negligent. This does not guarantee final reimbursement for every fraud loss.
What happened and what did the Court decide?
A woman in Poland was selling an item through an online marketplace. A scammer sent a fake confirmation link leading to a counterfeit banking site. After she entered her login details, the criminal transferred approximately €700 from her account. The bank refused reimbursement, alleging gross negligence.
The EU Court held that an unauthorised payment must generally be refunded immediately and no later than the end of the following business day after the provider becomes aware or is notified. An allegation of the customer’s gross negligence does not, on its own, allow a bank to withhold that initial refund.
After refunding the payment, a bank may seek recovery of losses if it proves that the customer breached duties intentionally or with gross negligence. The exception to immediate refund concerns reasonable suspicion that the customer committed fraud, communicated to the relevant authority.
Which transactions qualify?
An unauthorised transaction is a payment made without the payer’s valid consent—for example, a criminal using stolen credentials to initiate a transfer without the account holder’s permission.
Where someone personally approved a transfer after being deceived, the legal position is different. The ruling does not promise automatic reimbursement. What was actually authorised through Smart‑ID or Mobile‑ID and the available evidence matter.
Use of a payment instrument or authentication method alone does not necessarily establish consent or gross negligence. The provider must support such claims with evidence.
What should you do immediately after discovering the loss?
1. Contact your bank immediately using its official emergency or support number. Ask to secure your access and cards and attempt to stop or recall the payment.
2. File a written report identifying the unauthorised transactions, amounts and dates. Request a refund and confirmation that your complaint was registered.
3. Report the suspected crime to the police. Keep account statements, messages, links, screenshots, phone numbers and all correspondence with the bank.
4. Change passwords from a trusted device and never approve unexpected Smart‑ID or Mobile‑ID requests.
Where to complain in Estonia if the bank refuses?
First, complain to the bank in writing and request a reasoned decision. Where relevant, refer to PSD2 Articles 71–74, Case C‑70/25 and § 733² of Estonia’s Law of Obligations Act.
If the bank’s answer is unsatisfactory, contact Finantsinspektsioon, the Estonian Financial Supervision Authority. It can request explanations and provide independent guidance, but it cannot adjudicate individual reimbursement disputes or award compensation.
Check whether your matter is eligible for the Consumer Disputes Committee; jurisdiction depends on the parties and the dispute. Court proceedings may be necessary to obtain an enforceable decision. Report suspected criminal activity to the police separately.
What about older fraud cases?
Article 71 PSD2 generally requires notification without undue delay and within 13 months of the debit date, provided the bank made the required transaction information available. This is not an automatic reopening of every historical dispute.
If a previous refund was rejected on grounds of alleged customer negligence, consider having the correspondence, evidence and deadlines reviewed.
Official primary sources
- CJEU judgment C‑70/25 (full text)
- Official CJEU press release (PDF)
- PSD2 Directive, Articles 69–74
- Estonian Law of Obligations Act, §§ 733² and 733⁷ (ET)
- Finantsinspektsioon: making a complaint
- Estonian Police and Border Guard Board
- Consumer Disputes Committee: submit an application
You may also find these articles useful
Fake bank numbers, AI-generated voices and practical ways to protect your accounts and personal data.
How proposed payment-service reforms address fraud, payee verification and stronger customer safeguards.
Learn how checking the recipient’s name against the IBAN can flag potential problems before you send money.
Practical steps to secure passwords, bank details and online messages against scams.
Easyfind lets you create a dedicated page for your service or business, with descriptions, photos, video, PDF files, contact details and special offers. Visitors can find key information in one place, and the page may be discoverable through search engines.
Current offers on Easyfind
How much will your job cost?
Choose a service and its scope to get an estimated price.