Europe's top court has handed consumers a stronger hand against payment fraud. Per heise online, the Court of Justice of the European Union (CJEU) has ruled that banks must reimburse customers who fall victim to phishing — at least in the first instance — rather than pushing the loss back onto the customer while a dispute drags on.
The ruling sits on top of rules Europe already has. Under the revised Payment Services Directive (PSD2), a payment service provider must refund an unauthorised payment promptly, and the burden of showing that a customer acted with gross negligence — the main route to refusing a refund — lies with the bank, not the customer.
In practice, banks have often leaned on claims of customer carelessness to stall or deny reimbursements, and consumers have had to escalate to national regulators or courts. A clear CJEU position shifts the default: the institution with the transaction data and the fraud-detection systems carries the initial cost and must make its case if it wants the money back.
For customers, the practical takeaway is procedural. A refusal should come with reasoning; a bank cannot simply assert that the user should have known better. For banks, the ruling reinforces the commercial logic of stronger fraud detection up front — spoofed sender addresses and "safe account" scams are now a cost the institution is expected to absorb first.
National implementations and any limits still vary, so how a specific case is handled remains a matter for the competent authority in each member state.
Source: heise online. The exact scope of the judgment and its application to national law should be checked against the court's published decision.
