European court strengthens the position of phishing victims against their bank
The Court of Justice of the European Union has ruled that banks must immediately reimburse customers who become victims of fraud such as phishing. This also applies when the bank believes the customer acted with gross negligence. The ruling came in the case of a Polish bank customer.
The customer was offering a product on an online marketplace when an attacker posed as a buyer. The attacker sent a link to supposedly confirm the sale, but it led to a phishing page where she entered her details. With those details, 700 euros was stolen from her bank account.
The bank refused to reimburse the loss. It argued that the customer had grossly neglected her obligation to protect her login credentials. A Polish court then asked the European Court of Justice whether the bank must refund an unauthorised transaction even when it considers the customer grossly negligent. According to the court, it must, and the stolen amount should be back in the customer’s account within one day.
There is one exception. A bank does not have to reimburse the money if it suspects intentional fraud by the customer and communicates the grounds for this suspicion to the competent national authority. If the bank believes the customer was grossly negligent, it can try to recover the loss from the customer afterwards, but the bank must prove that the gross negligence occurred.
For banks, this means fast refund processes and solid evidence when they dispute a customer’s conduct. For consumers and organisations, it remains important to recognise phishing links, especially in situations like online sales. Regular awareness training and phishing simulations help you reduce the risk of becoming the next victim.