Łódź: A payment provider must still make an unauthorised payment refund immediately even when the customer acted with gross negligence, the Court of Justice has held. The judgment of 15 October 2026 in Case C-70/25 Tukowiecka strengthens the position of consumers who fall victim to card and online banking fraud.

The case arose from a dispute over an unauthorised transaction on a customer’s account. The provider argued that the customer’s own gross negligence relieved it of the duty to give the money back straight away. The Court rejected that argument and ruled that gross negligence by the customer does not exempt the payment provider from the obligation to refund an unauthorised transaction immediately.

The ruling interprets the Payment Services Directive, which sets out the liability rules for unauthorised payments. Under the directive, the provider generally has to make the unauthorised payment refund without delay, normally by the end of the next business day, and restore the account to the state it would have been in without the transaction. The text allows an exception where the provider has reasonable grounds to suspect fraud by the customer and reports them in writing to the national authority. The Court’s decision makes clear that customer carelessness does not fall under that exception.

What changes in practice is the order of events. The question of who bears the loss can still arise, and national law may allow a provider to pursue the customer afterwards where gross negligence is proven. The Court’s press release, however, places the immediate unauthorised payment refund first, so that consumers are not left without funds while the dispute is argued. Banks cannot hold back the unauthorised payment refund to await an assessment of the customer’s conduct.

Consumer groups have long argued that delayed refunds hurt people who lose money to phishing and other scams, because the delay itself can cause hardship. The judgment gives them a clear reference. Banks and payment institutions, for their part, will need to review their internal procedures so that each unauthorised payment refund follows the deadline in the directive and not an internal view about fault.

The ruling arrives while the Union prepares a new generation of payment rules. The Commission proposed a Payment Services Regulation and a revised directive to deal with fraud, including scams in which criminals impersonate bank staff. Negotiators on those files can now rely on the Court’s reading of the existing text when they decide how far the refund duty should reach.

Consumers in every member state benefit from the same interpretation, because the Court’s reading binds national courts. Anyone who suffers an unauthorised transaction can now point to the Tukowiecka judgment to demand a prompt unauthorised payment refund, even when the provider alleges that they were careless with their credentials.