Banks must reimburse phishing victims within one working day, even if the customer made a serious mistake

The European Court of Justice has issued a landmark ruling requiring banks to reimburse victims of phishing attacks by the end of the next working day. This mandate applies even in cases where the bank suspects the customer of gross negligence. Previously, many institutions would withhold refunds pending their own investigations, but the court clarified that these banks cannot refuse immediate repayment based on mere suspicion of user error. The burden of proof now rests entirely with the bank if they wish to recover the funds later.

The case originated from a dispute involving a customer whose bank refused to refund 700 euros lost during a phishing incident on a deceptive website. The ruling ensures that consumers are not financially burdened while awaiting a legal resolution. Banks are only permitted to delay reimbursement if they possess concrete evidence suggesting the customer was involved in the fraud themselves. If an investigation later proves gross negligence, such as poor security of secret codes, the bank may then seek to reclaim the money provided they can legally substantiate their claims of customer misconduct.