Phishing: when must the bank refund your money?

Did you receive a message that looked genuine, enter your details on a fake page and then find that someone had taken money out of your account? If you did not authorise that transaction, the bank’s refusal to return the money can be challenged, even where you are accused of “gross negligence”.

What the Court of Justice of the European Union decided

In a judgment of 15 October 2026 in case C-70/25, the Court of Justice of the European Union clarified that such an allegation does not allow a bank to refuse the immediate refund of an unauthorised payment transaction. The ruling matters for victims of phishing, the fraud in which fake messages or web pages are used to obtain personal and banking data.

The case concerned a customer of a Polish bank who entered her credentials on a page imitating the bank’s own. A fraudster used those details to transfer around €700. The bank refused to return the amount, arguing that the customer had failed to protect her data properly.

Immediate refund: the deadline the bank must meet

The Court drew a distinction between the immediate refund and the question of who ultimately bears the loss. As a rule, the bank must return the money immediately and, at the latest, by the end of the first business day after becoming aware of, or being notified of, the transaction. The customer must notify the bank without undue delay. In Portugal, this obligation is set out in Article 114 of the regime approved by Decree-Law No. 91/2018.

The exception: suspicion of fraud by the customer

The exception to the immediate refund requires reasonable grounds to suspect fraud committed by the customer, communicated in writing to the judicial authorities within the same period. A mere allegation of carelessness in protecting one’s data does not amount to such a suspicion.

The refund may not be final

The refund may, however, not be final. The bank may subsequently seek repayment if it proves that the losses resulted from the customer’s intentional or grossly negligent failure to comply with their obligations. The burden of that proof lies with the bank: the mere record that the victim’s credentials were used does not automatically prove that the victim authorised the transaction or acted with gross negligence.

Transactions the customer authorised fall outside

This protection concerns unauthorised transactions. Where it is the customer who instructs and authorises a transfer, even when deceived by a third party, the legal framework calls for a different analysis and the judgment does not automatically guarantee a refund.

What to do if you have been a victim of phishing

If you have been a victim of phishing, report the matter to your bank immediately, ask for the compromised access credentials to be blocked, report the facts to the authorities and contact your lawyer.

At VPA, we examine the circumstances of the fraud and identify the appropriate means of defending your rights and recovering the amounts involved. A refusal by the bank does not, in itself, close the matter.