Phishing Scam Drained Your Account? Here's When the Bank Must Refund You

Under an EU Court of Justice clarification issued on October 15, 2026, a bank must immediately refund a customer whose money was stolen through an unauthorised payment made by a fraudster — even if the bank suspects the customer was careless — and can only refuse the refund if it has reasonable grounds to suspect the customer committed the fraud themselves.

In short

• On October 15, 2026, the EU Court of Justice ruled that banks cannot refuse to refund stolen money solely by accusing the customer of negligence.
• The bank must refund an unauthorised payment no later than the end of the following business day after being notified.
• The bank can refuse an immediate refund only if it has reasonable grounds to suspect customer fraud and notifies a public authority in writing.
• Proving the customer was negligent is the bank’s job — and it can only try to do so after the money has already been refunded.
• The rule applies in both theft scenarios: when the fraudster transferred the money directly, and when the deceived customer authorised the transfer themselves.

Why phishing scams keep working

Phishing accounts for 77.8% of all social engineering attacks across the EU, according to the Threat Landscape report from the European Union Agency for Cybersecurity. Fraudsters increasingly rely on artificial intelligence, which drafts emails in any EU language without grammatical errors — making fake messages far harder to spot by their wording alone.

Another technique involves tricking a user, through an email or browser prompt, into running a system command supposedly to “fix an error.” In reality, that exact action is what hands fraudsters access to the account. The typical scheme is simple: the victim clicks a link in a message and enters their banking details on a fake page. The money is withdrawn immediately, and the person has, in effect, carried out the very steps that made the theft possible.

The EU Court of Justice ruling of October 15, 2026

On October 15, 2026, the Court of Justice of the European Union clarified that accusing a customer of gross negligence is not, on its own, enough grounds for a bank to refuse an immediate refund of stolen money.

The ruling stems from a case involving a customer of a Polish bank. The woman was selling an item online, and a supposed buyer sent her a link to “confirm the sale.” She opened a site that looked like her bank’s page and entered her login details there, including her card number. The fraudster used that information to transfer roughly €700 out of her account.

The next day, she reported the incident to the bank, but the bank refused to refund the money: in its view, the customer had failed to adequately protect her banking details and was herself at fault for the leak.

in its view, the customer had failed to adequately protect her banking details and was herself at fault for the leak

Banks must refund the money immediately

If the payment was unauthorised — meaning the customer never made it or approved it — the Court made clear that the bank must refund it immediately, without delay. This obligation is set out in EU payment services law (the PSD2 Directive) and means the refund must happen no later than the end of the following business day after the bank is notified of the transaction. This is the general rule, not an exception reserved for clear-cut, no-fault cases.

There’s one condition: the customer must report the incident without delay, as soon as they realise they’ve been scammed — not the next day, and not after mulling it over.

An accusation of gross negligence does not, by itself, release the bank from this obligation. A bank cannot refuse a refund simply because the customer entered their card details or clicked a fraudulent link: assessing the customer’s conduct is a separate matter, to be resolved after the money has already been returned — not instead of returning it.

When a bank can refuse: suspicion that the customer committed the fraud

A bank is entitled to withhold an immediate refund if it has reasonable grounds to suspect the customer committed the fraud themselves — and, crucially, only if the bank notifies the competent public authority of those grounds in writing. Without that notification, the bank cannot rely on a suspicion of customer fraud as a reason to refuse.

The Court stressed that suspecting the customer of committing the fraud and accusing them of negligence are entirely different legal grounds. If the customer is accused specifically of negligence, not fraud, the bank must refund the money regardless of that accusation. A customer’s negligence gives the bank grounds to seek compensation after the refund — it is not a basis for refusing the refund itself.

Can the bank claw the money back after refunding it?

Once a bank has refunded the money, it can later seek to recover it — but only if it proves the customer breached their obligations intentionally or through gross negligence, and that this breach is what caused the loss. To do so, the bank must carry out a separate investigation: the immediate refund and the inquiry into the customer’s fault are two distinct stages, and the Court explicitly separated them in time.

The key point of the ruling: the burden of proof rests with the bank, not the customer. It is up to the bank to prove that a person handed over passwords or card details through negligence — the customer does not need to prove their own innocence to get their money back at the first stage.

the burden of proof rests with the bank, not the customer

Two theft scenarios — and what to do if your money is stolen

The EU Court distinguishes between two scenarios. In the first, the fraudster transfers money out of the customer’s account or card directly, without the customer’s involvement. In the second, the customer authorises the transfer themselves, but does so while being deceived, unaware they’re being scammed. These are different situations, but the outcome for the customer is the same: the bank must refund the money in both cases, and any inquiry into fault happens only after the refund.

the bank must refund the money in both cases, and any inquiry into fault happens only after the refund

What to do immediately after your money is stolen:

1. Contact the bank right away — call, use an official channel, or block access to the account.
2. Keep all correspondence with the fraudster, along with any links and payment details.
3. Go to a bank branch in person and state in writing that you never authorised the transaction.
4. Insist that your complaint be formally logged and demand a reasoned response from the bank.

Don’t click links in suspicious messages — and that applies not just to emails, but to fake login pages that mimic social media and other services, all built for one purpose: to capture a customer’s username and password.

What to do immediately after your money is stolen

• Contact the bank right awayrequiredCall, use an official channel, or block access to the account
• Keep all correspondence with the fraudsterrequiredEvery message, link, and payment detail
• Go to a bank branch in personrequiredState in writing that you never authorised the transaction
• Insist your complaint is formally loggedrequiredAnd demand a reasoned response from the bank
• Never click suspicious linksIncluding fake login pages for social media and other services

Frequently asked questions

What happens if the customer reports the theft to the bank several days later, not right away?

The condition for an immediate refund is that the customer must report the incident without delay, as soon as they realise they’ve been scammed. If the notification is delayed, the bank may dispute whether the report was made in time — though that’s a different issue from accusing the customer of negligence when entering their details.

Can the bank refuse to refund the money altogether if it decides the customer is at fault?

No, the bank cannot withhold the money at the initial refund stage by citing the customer’s negligence. The only exception is reasonable suspicion that the customer committed the fraud themselves — and even then, the bank must notify the competent public authority in writing.

Does the customer have to prove they weren’t at fault for the data leak?

No, the burden of proof rests with the bank, not the customer: it’s the bank that must prove the customer breached their obligations intentionally or through gross negligence. The customer doesn’t need to prove their own innocence to get their money back at the immediate-refund stage.

What’s the technique called where fraudsters trick someone into running a system command through an email or browser?

This technique is called clickjacking. A user is tricked, through an email or browser prompt, into running a system command supposedly to fix an error — but in reality, that very action is what gives fraudsters access to the account.