CJEU C-70/25: gross negligence cannot block a PSD2 refund
On 15 October 2026 the Court of Justice ruled in case C-70/25 that a payment service provider cannot refuse the immediate refund of an unauthorised transaction because it thinks the payer was grossly negligent. Article 73(1) of PSD2 makes the refund the first step. Article 74(1) decides who finally bears the loss, and it does so afterwards. Gross negligence still matters, but it is something the provider has to prove when it seeks the money back, not a reason to keep it. This piece sets out the ruling, the articles it reads, what it leaves open, the Spanish provisions, and three cases.
1. What the Court decided
The reference came from a Polish district court. A consumer had advertised an item on an online marketplace. A supposed buyer sent her a link that looked like part of the platform’s sale process. It led to a fake copy of her bank’s website, where she entered her online-banking login details. The fraudster then used those details, plus an SMS confirmation code obtained from her by the same deceit, to move about EUR 705 to his own account. She reported the transaction to the bank and the police the next day. The bank refused to refund her, arguing that she had been grossly negligent in protecting her credentials.
The provider argued that payer gross negligence was a second ground, alongside suspected fraud, for withholding the refund, and that it could assess this itself. The referring court disagreed, noting that in practice consumers, not providers, were the ones forced to sue.
The First Chamber answered the single question this way: Article 73(1) and Article 74(1) of Directive (EU) 2015/2366 mean that a payment service provider cannot refuse to refund immediately the amount of an unauthorised payment transaction on the ground that the payer made the transaction possible through gross negligence, in breach of the obligations in Article 69. The judgment is ECLI:EU:C:2026:852. When this article was written, the English text on InfoCuria was still marked as provisional.
2. The articles the Court read
The ruling turns on five provisions of PSD2, all in Title IV:
- Article 69: the user’s duties. Use the instrument in line with its terms of issue and use (which must be objective, non-discriminatory and proportionate), report loss, theft, misappropriation or unauthorised use without undue delay, and take all reasonable steps to keep personalised security credentials safe.
- Article 71(1): the user gets rectification only if it notifies without undue delay, and no later than 13 months after the debit date.
- Article 72: the evidence rules. If the user denies authorising a transaction, the provider must prove authentication and correct recording. The fact that the instrument was used is not, on its own, enough to prove authorisation, fraud or gross negligence. The provider must produce supporting evidence of fraud or gross negligence.
- Article 73(1): refund immediately, and in any event by the end of the following business day after noting or being notified of the transaction, with the credit value date no later than the original debit date. The only exception is where the provider has reasonable grounds to suspect fraud and communicates them in writing to the relevant national authority.
- Article 74(1): by derogation from Article 73, the payer may bear up to EUR 50 for lost, stolen or misappropriated instruments, and all losses where it acted fraudulently or breached Article 69 intentionally or with gross negligence. Member States may reduce that liability where there was no fraud and no intentional breach.
Article 74(2) and (3) still apply: without strong customer authentication, or after the payer’s notification, the payer bears no loss unless it acted fraudulently.
3. Why the Court read it this way
The Court used its usual method of wording, context, objectives and legislative history. All four pointed the same way.
- Wording. Article 73(1) contains one exception to the refund duty, suspected fraud reported in writing to the authority. Nothing in it covers suspected gross negligence. The Court accepted that Article 74(1) on its own is ambiguous. It could cancel the refund duty, or it could only decide whether the refund becomes final.
- Context. Recital 71 describes the fraud exception as the only case in which the provider may investigate before refunding, and it links it to fraudulent behaviour by the user. Article 72(2) puts on the provider the burden of proving gross negligence. Taken together, the Court said, Article 73 governs the immediate refund and Article 74 governs the later allocation of liability.
- Objectives. PSD2 aims at a high level of consumer protection. If the provider could withhold the refund on its own assessment of negligence, the refund duty would lose its effect, and the consumer would have to start proceedings and bear their cost and inconvenience.
- History. The first Payment Services Directive (2007/64/EC, Article 60) had no express exception to immediate refund, and neither did the Commission’s 2013 proposal. The legislature added only the fraud exception, and Article 107(1) (full harmonisation) prevents Member States from adding others.
The Court also rejected the argument that this sidelines the out-of-court procedures in Article 102. Those cover every dispute under Titles III and IV and are not a check that must come before any refund.
4. Refund duty versus final liability
The practical result is two separate processes with different owners, deadlines and burdens:
| Question | Immediate refund (Art. 73(1)) | Final liability (Art. 74(1), with Art. 72) |
|---|---|---|
| Who acts | The payer’s payment service provider | The provider, if it wants to recover the loss from the payer |
| When | Immediately, and no later than the end of the next business day after noting or notification | Afterwards. The judgment sets no deadline, so national law applies |
| What triggers it | An unauthorised transaction, notified in time under Art. 71 | Losses caused by the payer’s fraud, or by an intentional or grossly negligent breach of Art. 69 (otherwise a EUR 50 cap, with the exceptions in Art. 74) |
| Exception | Only reasonable grounds to suspect fraud, sent in writing to the national authority | No payer liability without SCA (unless fraud) or after notification (unless fraud) |
| Burden of proof | None on the payer beyond the timely notification | On the provider, which must produce supporting evidence of gross negligence. Use of the credentials alone is not enough |
| Can gross negligence block it? | No (C-70/25) | Yes. It is the ground for full recovery |
5. What the judgment does not settle
The ruling is narrow, and it is worth reading it exactly:
- Whether the transaction was unauthorised. The Court took the transaction to be unauthorised, as the referring court did. It did not rule on whether a payment confirmed with a code the victim was tricked into handing over counts as authorised. That question is decided case by case under Article 64.
- How recovery works. The Court said the provider may afterwards claim reimbursement from the payer under the conditions of Article 74(1), and referred to the legal remedies available for that purpose. It did not say whether a provider may simply re-debit the account. That depends on national law and the framework contract, and it should be handled carefully: the burden of proof stays with the provider.
- The scope of the fraud exception. The Court read it, with recital 71, as covering suspected fraud by the user. Third-party phishing, where the customer is the victim, is not that case.
- National reductions. Nothing suggested that Poland had used the option in the fourth subparagraph of Article 74(1) to reduce payer liability. Where a Member State has used it, the recovery claim may be smaller still.
- The pending reform. The judgment interprets PSD2 as it stands and does not discuss the proposed Payment Services Regulation.
6. The same rule in Spain
Real Decreto-ley 19/2018 transposes these articles almost word for word. Article 41 sets the user’s obligations, Article 44 the evidence rules, Article 45 the provider’s refund duty and Article 46 the payer’s liability, including full liability for fraud or for intentional or grossly negligent breach of Article 41. The difference is in Article 45.1: in Spain, the provider that relies on suspected fraud must send its reasons in writing to the Banco de España, in the form, content and deadlines the Banco de España sets. Because PSD2 is a full-harmonisation directive, the interpretation in C-70/25 applies to Articles 45 and 46 as well. A Spanish refusal letter that cites only gross negligence is now hard to defend in a Banco de España complaint.
7. Worked case: the marketplace phishing claim
Facts: a retail customer of an e-money institution reports a EUR 1,200 transfer she says she did not make. She admits she entered her login and a one-time code on a page reached from a link sent by a “buyer”. The fraud team considers this gross negligence.
Applicable rule: Article 73(1) requires the refund by the end of the next business day. The only exception is suspected fraud by the user, reported to the authority, and nothing points to that. Gross negligence is an Article 74(1) question, and Article 72(2) puts the burden of proving it on the provider.
What the compliance officer does: has the refund booked within the deadline, with the original value date. Opens a separate liability file holding the session logs, device data, the authentication record, the customer’s own statements and the warnings shown in the app. Gets a legal view on whether the evidence goes beyond the mere use of the credentials before deciding to bring a claim.
Outcome: the deadline is met. Any recovery claim rests on evidence rather than on a refusal letter the regulator is likely to overturn.
8. Worked case: the refused-complaints backlog
Facts: a payment institution’s quality review finds 140 open or recently closed complaints where the refund was refused with the standard wording “the customer failed to protect their credentials”. None involved a fraud report to the authority.
Applicable rule: C-70/25 interprets Article 73 as it has stood since PSD2 took effect, so the refusals were inconsistent with the directive when they were made.
What the compliance officer does: takes the backlog to the management body with a remediation plan. Refunds the open cases. For closed cases, applies a documented policy, with a legal view on national limitation periods and on cases already before an ADR body or court. Rewrites the complaint templates and the decision tree so that “gross negligence” can no longer be selected as a reason for refusing a refund.
Outcome: the exposure is measured and closed off before a supervisor or ADR body finds it.
9. Worked case: a business account with an opt-out clause
Facts: an SME customer’s finance clerk is socially engineered into approving a supplier-payment fraud. The framework contract, signed with a non-consumer, disapplies Articles 72 and 74.
Applicable rule: Article 61(1) lets a provider and a non-consumer user agree that Articles 72 and 74 do not apply, in whole or in part. Article 73 is not on that list. Member States may also choose to treat microenterprises like consumers (Article 61(3)).
What the compliance officer does: checks whether national law treats this customer as a microenterprise. If the transaction is unauthorised, the refund still follows Article 73. The contract eases recovery afterwards; it does not allow the refund to be withheld.
Outcome: the opt-out works where the directive allows it, and it is not used to override the refund duty.
FAQ
What did the CJEU decide in C-70/25?
That a payment service provider cannot refuse to refund an unauthorised payment transaction immediately on the ground that the payer made it possible through gross negligence in breach of Article 69 of PSD2.
Does the provider lose the money for good?
Not necessarily. Under Article 74(1) it may later claim the losses from the payer if it proves that the payer breached Article 69 with intent or gross negligence. The burden of proof is on the provider.
Is there any ground for withholding the refund?
Only one: reasonable grounds to suspect fraud, communicated in writing to the relevant national authority. In Spain that authority is the Banco de España, under Article 45.1 RDL 19/2018.
Is it enough to show the customer’s credentials and SMS code were used?
No. Article 72(2) says the use of the instrument is not necessarily enough to prove authorisation, fraud or gross negligence. Supporting evidence is required.
Can business customers agree to something different?
For non-consumers, Article 61(1) allows Articles 72 and 74 to be disapplied, but not Article 73. The immediate refund duty stays.
Does the ruling apply to past refusals?
A preliminary ruling explains what the provision has always meant, so earlier refusals made on gross-negligence grounds alone were not in line with the directive. How far back customers can claim depends on national limitation rules.
10. What to do, today
- Complaints and fraud operations: separate the refund decision from the liability investigation in your workflow tool. Gross negligence must not be selectable as a reason for refusing a refund.
- Compliance: review open and recently refused unauthorised-transaction complaints for refusals based on negligence alone, and put a remediation plan to the management body.
- Legal: amend framework contracts and the customer-facing “unauthorised payments” pages that describe negligence as a bar to refund, and check that business-account opt-outs stay within Article 61(1).
- Fraud analytics: define what evidence beyond credential use you will collect for each case (session, device and warnings shown), so that a recovery claim under Article 74 can meet the Article 72(2) burden.
- Finance: provision for refunds now paid up front and for recovery claims that may not succeed, and report the losses in line with your fraud statistics by liability bearer.
Related: Unauthorised payment transactions · Fraud losses per liability bearer · PSD2 fraud reporting under the EBA Guidelines
