Phishing losses: first the bank pays, then it may sue

The case

After selling an item via an online platform, a bank customer in Poland fell victim to a phishing attack: a supposed buyer sent her a link that deceptively imitated the interface of the platform and then that of her bank. She disclosed her login credentials, whereupon an unknown third party made an unauthorised payment from her account. The bank refused the refund — it accused the customer of having breached her obligation to keep her credentials safe with gross negligence.

The statutory starting point

Art. 73(1) of the second EU Payment Services Directive provides that a payment service provider must in principle refund the amount of an unauthorised payment transaction immediately — with exactly one express exception: a reasonable suspicion of fraud on the part of the customer, which has been reported to the authorities. Gross negligence does not appear in this list of exceptions; it is dealt with only in Art. 74, which determines how liability is subsequently allocated between bank and customer. The referring Polish court wanted to know from the CJEU (EuGH) whether a bank may nevertheless already rely on gross negligence in order to refuse an immediate refund.

The Advocate General's proposal

In his Opinion of 5.3.2026 (Case C-70/25, Tukowiecka), Advocate General Athanasios Rantos proposed that the CJEU answer this question in the negative. According to his reading, the two provisions govern two separate phases: first, the bank must refund the amount immediately and without exception, unless there is a reported suspicion of fraud — the question of gross negligence plays no role in this first step. Only afterwards, in a second step, may the bank examine whether the customer has breached their duties of care with gross negligence, and, if necessary, must itself enforce its resulting claim for compensation against the customer in court. A contrary interpretation would allow banks effectively to circumvent the strict, narrowly drawn exception by informally relying on misconduct by the customer — and would force the customer to sue in order to get their money at all.

Departure from German practice

This view contradicts previous German practice: the BGH (Federal Court of Justice) and the prevailing opinion have so far assumed that the bank can refuse to fulfil its refund obligation in good faith (nach Treu und Glauben) if it asserts its own claim for damages on account of the customer's gross negligence — the customer must then sue to get their money back. Should the CJEU follow the Advocate General, this sequence would be reversed: the refund would come first, and the bank's action — if justified at all — only afterwards.

Assessment

Important for the assessment: the Opinion of an Advocate General does not bind the Court, even though it follows it in the majority of cases. Until the actual decision, it remains open whether and how the CJEU will adopt this line — and whether German courts will subsequently implement such a requirement in conformity with the Directive. For bank customers who fall victim to a phishing attack, the implications would nonetheless be considerable: they would no longer have to bear the burden up front and sue at their own expense just to regain access to their money at all — the risk of litigation would then lie with the bank.