On 15 October 2026, the Court of Justice of the European Union ruled in Case C-70/25 (Tukowiecka) that a payment service provider must refund an unauthorised transaction immediately, even when it believes the customer was grossly negligent. The facts are painfully ordinary: a Polish bank customer selling an item online clicked a fake link, entered her banking credentials on a cloned website, and lost about €700; she reported it the next day, and the bank refused to pay, blaming her carelessness. Reading Articles 73 and 74 of PSD2 together, the Court held that the refund is due no later than the end of the following business day, and that the only way out is a reasonable suspicion of fraud by the customer that the provider reports to the national authority. Gross negligence is not that exception. It matters for the final allocation of loss, which comes later: the provider may claw the money back, but only if it proves the customer's intent or gross negligence.

In my view, the strength of this judgment lies in separating two questions that banks have long merged: liquidity and liability. A consumer who has just been robbed should not have to sue her own bank to recover funds while the bank decides whether she was foolish; the Court rightly puts the burden of litigation and proof on the stronger, better-informed party! The gap, I believe, is practical: the ruling says little about how a bank should recover from a customer who refuses to repay, and it may encourage aggressive recovery letters that undo the consumer protection it aims to achieve. Providers may also respond by tightening authentication or slowing payments. The practical lesson for compliance teams in any jurisdiction is clear: build reimbursement workflows that pay first and investigate second, document fraud indicators carefully, and treat "gross negligence" as an evidentiary claim to be proved, not a label to be asserted. Fraud risk belongs to the system designer, not to the victim at the first business day!

Source: Court of Justice of the EU, press release No 147/26, 15 October 2026; Lewis Silkin, 21 October 2026