The decision, delivered on 15 October, clarifies how European payment regulations must be applied and has implications for banks and account holders throughout the European Union, including Portugal.

Under the ruling, financial institutions cannot delay reimbursement simply because they believe a customer failed to protect their banking details. The money must normally be returned immediately, and no later than the end of the following business day after the bank becomes aware of the unauthorised transaction.

The case originated in Poland, where a woman lost approximately €700 after falling victim to an online banking scam.

She had advertised an item for sale on an internet marketplace when someone posing as a potential buyer sent her a link, supposedly to confirm the purchase.

The link directed her to a fraudulent website designed to resemble her bank’s online banking page. After entering her login details, she unknowingly gave the scammer access to information that enabled money to be transferred from her account.

The woman reported the transaction to her bank the following day, but the institution refused to refund her, arguing that she had been grossly negligent in protecting her security credentials.

She challenged the decision in court, prompting a Polish judge to seek clarification from the CJEU about the bank’s obligations under European law.

Banks must refund first

The European court ruled that a customer’s alleged negligence does not remove the bank’s obligation to provide an immediate refund for an unauthorised payment.

The decision interprets the EU’s Payment Services Directive, known as PSD2, which establishes rules governing electronic payments and consumer protection.

Importantly, the judgment separates the obligation to reimburse customers from the question of who is ultimately responsible for the financial loss.

Banks can subsequently seek to recover the money if they establish that the customer acted fraudulently or intentionally or through gross negligence failed to meet their security obligations.

The responsibility for proving gross negligence rests with the financial institution.

There is also an exception to the immediate refund requirement where a bank has reasonable grounds to suspect that the customer personally committed fraud and reports those suspicions to the appropriate national authority.

Simply alleging that someone was careless with their password or banking information is not sufficient to justify withholding the initial reimbursement.

What does this mean for customers in Portugal?

The ruling is relevant to Portuguese banking customers because it clarifies how existing European payment legislation must be interpreted by national courts.

Banco de Portugal already states in its official consumer guidance that banks must provisionally reimburse customers for allegedly unauthorised transactions by the end of the following business day, subject to the exception involving suspected fraud by the customer.

The central bank also explains that customers may, in certain circumstances, be responsible for losses of up to €50 resulting from unauthorised payments.

That limit does not necessarily apply where gross negligence or deliberate misconduct is established.

The new judgment reinforces the distinction between receiving an initial refund and determining whether the customer must ultimately bear the loss.

It does not mean that every person who loses money to an online scam is automatically entitled to permanent reimbursement. Payments that customers knowingly authorise, even after being deceived, can raise different legal questions.

What should fraud victims do?

Banco de Portugal advises anyone who discovers an unauthorised transaction to contact their bank immediately and report the incident.

Customers should also notify the police or other relevant authorities and retain records of suspicious messages, transactions and communications with their bank.

Under the applicable rules, unauthorised transactions must generally be reported without undue delay and within 13 months, although waiting to report suspected fraud can affect a customer’s rights.

The regulator also recommends avoiding links received through unexpected emails or text messages and never sharing online banking passwords or security credentials.

The CJEU ruling, issued in Case C-70/25, provides a binding interpretation of EU law for national courts dealing with comparable disputes, including those brought before Portuguese courts

Set The Portugal News as your preferred source for news on Google

GoogleAdd as a preferred source on Google