Cybercrime and phishing scams continue targeting bank account holders across Europe. For years, victims faced long legal battles to recover stolen funds. Banks frequently refused immediate refunds, claiming customers acted with gross negligence by sharing passwords or clicking malicious links. However, a landmark ruling from the Court of Justice of the European Union (CJEU) fundamentally changes financial protection for bank customers.
Contents
The Landmark EU Ruling on Phishing Refunds
Under the CJEU ruling (Case C-70/25), banks must immediately refund money stolen through unauthorized transactions. Specifically, payment providers must return the full stolen amount by the end of the first business day following the customer’s notification.
This ruling reverses the traditional burden of proof. Previously, financial institutions held frozen funds while forcing account holders to prove their innocence through lengthy arbitration. Now, immediate reimbursement is the primary legal obligation.
Exceptions and Bank Obligations
Banks can suspend the immediate refund under very strict conditions. The institution must have well-founded, documented reasons to suspect the customer committed deliberate fraud. Additionally, the bank must formally report this suspicion in writing to the national central bank (such as the Bank of Italy).
If a bank believes an account holder acted with gross negligence, it cannot withhold funds arbitrarily. Instead, the bank must refund the money first. After issuing the refund, the bank may initiate separate legal proceedings to prove customer fault and request repayment.
What to Do If You Fall Victim to a Scam
To benefit from this legal protection, account holders must act rapidly after discovering an unauthorized transaction:
- Block Accounts Immediately: Contact your bank’s official emergency hotline to freeze cards, mobile apps, and online banking credentials.
- File an Official Police Report: Report the cybercrime to local police or specialized postal police authorities to obtain formal documentation.
- Submit a Formal Complaint: Send a certified email (PEC) or registered letter to your bank demanding an immediate refund within one business day, explicitly referencing CJEU ruling C-70/25.
In conclusion, European law now forces banks to protect account holders against digital fraud. By mandating immediate refunds, the new ruling ensures customers do not bear the financial burden of complex cyberattacks while banks investigate fraud.
