Court of Justice of the European Union (First Chamber), Case C-70/25, Tukowiecka, judgment of 15 October 2026
Case background
A customer of a Polish bank advertised an item for sale on an online auction platform. A supposed buyer sent her a link, apparently from the platform, to confirm the sale. It led to a copy of her bank’s website, where she entered her online banking login details. With those, the fraudster transferred PLN 3,000 (about EUR 705) to his own account, confirming the transfer with an SMS code she had also been tricked into handing over. She discovered the fraud the next day and notified the bank and the police at once. The bank refused to refund because she had, it said, failed with gross negligence in her duty to safeguard her payment instrument, and a provider which has itself established gross negligence is released from the duty to refund. The case name “Tukowiecka” is fictitious, assigned to the case by the Court so that it can be cited without identifying the claimant, which is why it appears in square brackets in the judgment’s heading.
The District Court in Koszalin asked the CJEU whether Article 73(1) and Article 74(1) of Directive (EU) 2015/2366 on payment services in the internal market (PSD2) permit that refusal. Article 73(1) requires the payer’s provider to refund an unauthorised transaction “immediately, and in any event no later than by the end of the following business day”, with one stated exception: where the provider has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing. Article 74(1) makes the payer bear all losses incurred by acting fraudulently or by failing, with intent or gross negligence, to fulfil the obligations in Article 69, among them the duty to take all reasonable steps to keep personalised security credentials safe.
The referring court made an additional observation regarding the practical application of the rules: Polish banks had not brought proceedings against consumers to recover sums on the basis of gross negligence, whereas consumers had frequently brought claims against banks challenging their refusal to reimburse them. In practice, therefore, the exception had become the rule.
The CJEU’s ruling
The Court held that a provider cannot refuse to refund immediately on the ground that the payer made the transaction possible through gross negligence. Article 73(1) names a single exception, suspected fraud reported in writing to the national authority, and says nothing about negligence. The Court accepted that Article 74(1) could be read in two ways: either as allowing the provider to withhold the immediate refund where the payer was grossly negligent, or as governing only the final allocation of liability, with the provider refunding first and seeking recovery later through the ordinary legal remedies. Context and purpose settle it in favour of the second. Article 72(2) places on the provider the burden of proving fraud or gross negligence, and recital 71 contemplates a refund being held back only where fraud by the user is suspected. The two articles govern “distinct aspects” of the refund: Article 73 the immediate refund, Article 74 the allocation of liability “at a later stage”.
The reasoning on objectives is the heart of the judgment. Reading Article 74(1) as an exemption would strip the refund of its effect and require the customer “to take the initiative to assert his or her right” in court and bear the costs. That allocation of risk, the Court said, is “difficult to reconcile” with the high level of consumer protection PSD2 pursues. The legislative history supports the same interpretation. Directive 2007/64/EC contained no equivalent exception, while Article 107(1) of PSD2 requires full harmonisation of the matters it regulates. Member States cannot therefore add a further exception to the harmonised immediate refund obligation. The argument that this interpretation circumvents the out-of-court dispute resolution mechanism under Article 102 was also rejected. That mechanism applies to all disputes arising under Titles III and IV and is not a prerequisite to the right to a refund.
What the judgment does not do is relieve a careless customer of liability. The provider may still claim the loss back under Article 74(1) where it proves intent or gross negligence. The sequence is now settled, and so is who must sue.
The position in Cyprus
PSD2 is transposed by the Provision and Use of Payment Services and Access to Payment Systems Law of 2018, Law 31(I)/2018, which keeps the Directive’s article numbers for sections 69 to 74 (the subsections are numbered differently), so the judgment reads directly onto the Cyprus text. Section 73(1) names the authority to which a Cyprus provider must report its suspicion of fraud in writing: the Central Bank of Cyprus. A bank that withholds a refund without reasonable grounds and that written report has no exception to rely on. Section 72(4) puts the burden of proving fraud or gross negligence on the provider, and section 72(3) provides that the recorded use of the payment instrument, an SMS code entered on a fraudster’s instruction for instance, is not in itself enough to prove either.
Two features of section 74 bear on what a bank can recover afterwards. Law 31(I)/2018 does not take up the option in the fourth subparagraph of Article 74(1) to reduce the payer’s liability where the payer neither acted fraudulently nor intentionally failed in his obligations, so a payer found grossly negligent bears the whole loss, as under the Directive. Section 74(4), on the other hand, provides that where the provider did not require strong customer authentication the payer bears no financial consequences unless he acted fraudulently; gross negligence then does not count against him at all. An early question in any claim is therefore whether strong authentication was required for the transaction.
After a phishing loss, the customer should notify the bank without undue delay, preferably the same day. Section 69(1)(b) requires notification once the customer becomes aware of the loss, theft, misappropriation or unauthorised use of the payment instrument, and section 71(1) requires the unauthorised transaction to be reported without undue delay and, subject to section 71(2), no later than 13 months after the debit. The customer should then ask in writing for the refund under section 73(1), rather than allow the bank to treat the matter solely as an inquiry into the customer’s own carelessness. If the bank refuses, the complaints procedure in section 100 requires the provider to respond within 15 business days or, in exceptional circumstances, 35, and a complaint to the Central Bank under section 98 is open alongside it. For the bank, the refund decision cannot wait on an internal finding of gross negligence, and if it later seeks to recover the money it bears the burden of proving the grounds.
This article is provided for general information only. It is not legal advice and should not be relied upon as such. Specific professional advice should be sought before acting on anything it discusses.