Background
N.O., a Polish bank customer, was targeted in a phishing scheme after advertising an item on an online auction platform. A fraudster sent her a link resembling the platform’s sale-confirmation process. She entered her online-banking login details on a spoofed bank website, enabling the fraudster to transfer PLN 3,000 from her account. The transfer was confirmed using an SMS code obtained through the deception.
N.O. discovered the fraud the next day and promptly notified PKO BP and the police. The bank refused to refund the transaction, alleging that she had been grossly negligent in safeguarding her payment instrument and credentials. The Polish court asked whether the bank could withhold the immediate refund required by Directive 2015/2366 on that basis.
The Court’s Holding
The Court held that Articles 73(1) and 74(1) of the Payment Services Directive mean that a payment service provider cannot refuse immediately to refund an unauthorised payment transaction merely because it considers that the payer’s gross negligence made the fraud possible.
Article 73 imposes an immediate refund obligation, subject to the stated exception where the provider has reasonable grounds to suspect fraud by the payer and communicates those grounds in writing to the relevant national authority. Gross negligence under Article 74 concerns the ultimate allocation of loss: after refunding, the provider may seek reimbursement from the payer if it proves the payer acted with gross negligence in breach of Article 69.
Key Takeaways
- Banks generally must refund unauthorised transactions immediately, no later than the end of the next business day.
- Alleged customer gross negligence does not permit a bank to deny that immediate refund.
- The provider bears the burden of proving the payer’s fraud or gross negligence and may pursue later recovery where Article 74’s conditions are met.
Why It Matters
The ruling separates prompt customer reimbursement from the later determination of who ultimately bears the loss. It prevents providers from making consumers litigate first to recover funds lost to unauthorised payments.
For banks and payment providers, the decision requires prompt operational refunds except for the Directive’s express fraud-suspicion exception, while preserving potential recourse against customers whose gross negligence is established.