The CJEU forces banks to return money from a fraud even if they allege gross negligence by the client

BarcelonaThe Court of Justice of the European Union (CJEU) has ruled that gross negligence committed by a client does not exempt the payment service provider from its obligation to immediately refund the amount of an unauthorized transaction. However, "the payment service provider may subsequently claim from the client the reimbursement of losses resulting from gross negligence committed by the latter," says the CJEU press service in a statement.

The case, which sets a precedent for the entire EU, refers to a client of a Polish bank who was the victim of identity theft fraud. A person pretended to be interested in buying an item put up for sale by the affected party on an online sales platform and sent her a fraudulent link that appeared to come from that platform, and which was intended to confirm the sale. Upon clicking the link, she arrived at a page that looked like her bank's, entered her credentials, and with them, the scammer managed to transfer an amount of about 700 euros to his account.

The next day, the client notified her bank of the fraudulent operation, but the entity refused to return the amount of the unauthorized payment transaction, because it considered that the client, through gross negligence, had made this operation possible by failing to fulfill her obligation to protect personalized security credentials. The affected party went to a Polish court, which asked European justice whether, as a payment service provider, the bank is obliged to immediately return the amount of an unauthorized transaction, even if it considers that the client committed gross negligence.

The CJEU responds affirmatively to this preliminary question and recalls that in the event of an unauthorized payment transaction, the payment service provider is in principle obliged to immediately refund the amount of the transaction, no later than the end of the business day following the one in which it observed or was notified of the transaction. "The fact that the payment service provider considers that the client made the unauthorized transaction possible due to gross negligence [...] does not allow it to refuse the immediate refund," stresses the court based in Luxembourg.

European Union law allows for a distinction between the issue regarding the refund of the amount of the unauthorized payment transaction and the issue regarding who must ultimately bear the losses arising from that transaction. In other words, the payment service provider must immediately refund the amount and, subsequently, may claim reimbursement from the customer for the losses incurred if it demonstrates that they are due to the fact that the customer, deliberately or through gross negligence, failed to fulfill the obligations incumbent upon them, in particular the obligation to protect the security of personalized security credentials.