The duty to immediately refund unauthorised payment transactions: The implications of Tukowiecka (C-70/25)

Key takeaways

1. On 15 October 2026, the Court of Justice of the European Union (CJEU) issued its ruling in Case C-70/25 (Tukowiecka), in which a bank and a consumer argue over the refund of an unauthorized transaction.
2. Banks must generally refund unauthorised transactions immediately, even if payer acted with gross negligence, according to the CJEU. The refund must in principle be made first, with liability assessed later.
3. Although the customer is entitled to an immediate refund, the bank may subsequently seek to recover the funds if it can establish that the customer acted with gross negligence and is ultimately liable for the loss. However, the initiative to recover now lies at the banks.

Facts of the case

A consumer became the victim of a phishing scam after listing an item for sale on an online marketplace. A fraudster, posing as a prospective buyer, obtained information that enabled a payment of PLN 3,000 (approximately EUR 705) to be made from the consumer’s bank account. The payment was authenticated using a one-time code sent by SMS, which the fraudster also had managed to obtain from the consumer. The next day, the consumer realized that the transaction was fraudulent and reported the incident to both the bank and the police.

The consumer argued that, under Directive (EU) 2015/2366 (PSD2), the bank was required to refund the amount of the unauthorized payment transaction immediately. The bank, PKO BP, refused to do so. It claimed that the consumer had acted with gross negligence by failing to protect her personalized security credentials and was therefore liable for the loss.

Request for preliminary ruling

The referring court in Poland requested a preliminary ruling on the following question:

“Whether Article 73(1) and Article 74, (1) of Directive 2015/2366 must be interpreted as meaning that a payment service provider may refuse to refund a payer immediately for the amount of an unauthorized payment transaction on the ground that that payer made that transaction possible through gross negligence, in breach of the obligations incumbent upon him under Article 69 of that directive?”

Judgement

The CJEU answers this question negatively, following the Advocate General in his Opinion of 5 March 2026.

According to the Court, PSD2 requires payment service providers to refund unauthorized payment transactions immediately, unless the provider has reasonable grounds to suspect fraud by the customer and has reported those suspicions in writing to the National Competent Authority (NCA). The Court emphasized that the immediate refund obligation and the question of liability are two separate issues. On the one hand, Article 73 PSD2 concerns the bank’s obligation to provide an immediate refund. On the other hand, Article 74 PSD2 concerns the allocation of liability between the bank and the customer. As a result, a bank cannot refuse an immediate refund simply because it believes that the customer acted with gross negligence. The bank must first refund the customer and can only seek recovery of the funds afterwards if it can establish that the customer is liable because he or she has acted with gross negligence.

The CJEU noted that this interpretation is consistent with PSD2’s objective of ensuring a high level of consumer protection, found in recital 6. Allowing banks to refuse refunds upfront would significantly weaken that protection and force consumers to initiate legal proceedings to recover their money.

Looking ahead: PSD3 and PSR

This duty to immediately refund unauthorized transactions despite gross negligence by the customer, will cease to exist under the revised rules set out in the third Payment Services Directive (PSD3) and the Payment Services Regulation (PSR). In the compromise text of the PSR, which the Council and the Parliament are expected to adopt by the end of this year, gross negligence by the customer is an explicit ground for refusing an immediate refund (Article 56 PSR). This would represent a significant shift from the duty under PSD2 as interpreted by the CJEU in this judgment. However, service providers will have to comply with the current duty for at least two years, since the compromise text states that the PSR will apply 21 months after its entry into force.

Implications

1. First, payment service providers must refund unauthorized payment transactions immediately and no later than the end of the next business day, even where the customer may have acted negligently. As this will require greater availability of funds, they will have to reconsider their funding models and product pricing strategies.
2. Second, if the payer has acted with gross negligence, payment service providers can recover the funds through court proceedings. As a result, payment service providers will likely ramp up their litigation activity.
3. Third, because payment service providers are required to refund customers before liability is determined, effective fraud detection and prevention measures are becoming ever more important. As PSD3 and PSR will expand the obligations regarding fraud detection and prevention measures, payment service providers are advised to start preparing for these changes today.