EU Court: Banks Must Refund Phishing Victims Despite Gross Negligence in Poland

EU Court rules banks must refund phishing victims even despite gross negligence. Banks must return unauthorized payments immediately unless customers act as fraudsters themselves.

Under the law, banks refund unapproved transfers first, then investigate customer carelessness.

Judges stressed that carelessness alone cannot justify delaying refunds to phishing victims. Banks bear the burden of proving gross negligence, not the victims themselves.

If banks wrongly deny refunds, customers must sue, shouldering costs and hardship. The ruling stems from a Polish case but affects all member states.