What victims of phishing and account fraud should know after the decision of October 15, 2026. If your account has been emptied through phishing, your bank is generally obligated to reimburse the amount by the end of the following business day. According to a recent ruling by the European Court of Justice, this also applies even if the bank accuses you of gross negligence. Rogert & Ulbrich will review your case and enforce your reimbursement claim against the bank.
What the ECJ decided on October 15, 2026
In its judgment of October 15, 2026, in case C-70/25 (Tukowiecka), the European Court of Justice significantly strengthened the rights of bank customers. In the initial case, a customer in Poland had entered her login details on a fake website that resembled her bank's website. Fraudsters then initiated payments from her account. The customer reported the incident the following day. The bank refused to reimburse her, arguing that she had disclosed her login details through gross negligence.
The competent Polish court in Koszalin referred the question to the European Court of Justice (ECJ) as to whether a bank may refuse repayment on this grounds. The answer from Luxembourg is unequivocal: it may not.
Article 73 of the Second Payment Services Directive (Directive (EU) 2015/2366, or PSD2) is relevant. According to this article, the payment service provider must reimburse the amount of an unauthorized payment transaction without delay, and at the latest by the end of the next business day after becoming aware of the transaction or being informed of it. The directive provides only one exception: if the bank has reasonable grounds to suspect that the customer has acted fraudulently and communicates these grounds in writing to the competent national authority.
Gross negligence is not included in this exception. The European Court of Justice justifies this with the goal of a high level of consumer protection. If the bank could withhold reimbursement based solely on the allegation of gross negligence, those affected would have to initiate legal proceedings themselves to recover their money. According to the legislator's intent, the bank should initially bear precisely this risk.
Is the bank refusing a refund, citing gross negligence? According to the ECJ ruling, this is not permissible. Have the refusal reviewed.
Why the ruling also applies to bank customers in Germany
The case originated in Poland, but the ruling affects all bank customers in the European Union. The European Court of Justice interprets European law, and this interpretation is binding on the courts of all member states.
In Germany, Article 73 of PSD2 is implemented in Section 675u of the German Civil Code (BGB). This provision stipulates that in the case of an unauthorized payment transaction, the bank has no right to reimbursement of its expenses from the customer. It must immediately refund the payment amount and restore the debited account to the balance it would have had without the debit. Here, too, the deadline is the end of the business day following notification or knowledge of the unauthorized transaction. The only exception, in accordance with European regulations, is a substantiated suspicion of fraud against the customer themselves, reported in writing to the authorities.
In practice, many banks have previously rejected refunds, citing alleged gross negligence on the part of the customer. Affected individuals were then faced with the choice of accepting the loss or taking legal action themselves. This practice can no longer be maintained following the ruling. German courts must interpret Section 675u of the German Civil Code (BGB) in light of the ECJ decision.
One question the ruling, to our current knowledge, did not explicitly answer is whether a bank may immediately offset an alleged claim for damages against a claim for reimbursement. Such an offset would ultimately have the same effect as refusing reimbursement. It remains to be seen how German courts will handle this.
Is your bank citing its previous practice? The ECJ ruling changes the situation. Have your claims reviewed. banking law check.
Reimbursement and liability: The two steps after the verdict
The ECJ clearly distinguishes between two questions. The first is: Must the bank initially reimburse the amount? The second is: Who ultimately bears the loss?
The first step is for the customer to receive their money back. The bank is not allowed to postpone this refund simply because it considers the customer to be careless.
In the second step, the bank can attempt to reclaim the money from the customer. This requires that the customer intentionally or through gross negligence breached their obligations and that this breach of duty directly caused the damage. Under German law, this liability arises from Section 675v Paragraph 3 of the German Civil Code (BGB). According to Section 675l of the BGB, the customer's obligations include, in particular, protecting their personalized security features (such as PIN, password, or TAN procedure) from unauthorized access and reporting any misuse immediately.
The burden of proof lies with the customer. It is not the customer who must prove that they acted with due diligence. The bank must prove that the customer acted with gross negligence. Section 675w of the German Civil Code (BGB) explicitly clarifies that the mere recording of the authentication is not necessarily sufficient to prove gross negligence. The bank must present supporting evidence.
In addition, there is another protective rule: If the bank did not require strong customer authentication for the payment, the customer is generally not liable under Section 675v Paragraph 4 of the German Civil Code (BGB), unless they acted fraudulently. Furthermore, the customer is generally not liable for payments made after the misuse has been reported.
Is your bank demanding the return of refunded money? They must prove your gross negligence. Do not pay until this question is resolved.
When does phishing involve gross negligence?
Whether a customer has acted with gross negligence cannot be answered categorically. Courts assess the circumstances of each individual case. The ECJ ruling does not establish a rule that ensures every phishing loss remains permanently with the bank. However, it does prevent the mere accusation from blocking reimbursement.
The sophistication of these scams has become is illustrated by a case reported by ARD: A doctor from Thuringia received a letter that looked like it was from his bank and contained a QR code. After scanning the code, fraudsters withdrew more than €100,000 from his account. The letter appeared so authentic that he didn't suspect a thing.
Typical tricks used by fraudsters to obtain login credentials:
- Fake emails and text messages: Messages in the bank's design request confirmation of data or an update to a security procedure.
- QR codes in letters: Deceptively authentic letters sent by post redirect to fake websites via a QR code (so-called quishing).
- Calls from fake bank employees: Perpetrators impersonate security personnel on the phone and trick customers into granting permissions.
- Fake banking websites: Fake login pages intercept login data and TANs, often via links in messages or search results.
- Registration of digital cards: Scammers link the victim's card to their own smartphone and use it to make payments.
The assessment depends, among other things, on how genuine the deception appeared, whether the customer was pressured by time constraints, what warnings the bank provided, and what information was displayed to the customer during the authorization process. The more professional the scheme, the more difficult it usually is for the bank to prove gross negligence.
Are you being accused of carelessness? The bank doesn't decide whether this accusation is legally valid. Have the accusation reviewed by a lawyer.
Important distinction: unauthorized and authorized payments
The obligation to reimburse under Section 675u of the German Civil Code (BGB) applies only to unauthorized payments. A payment is considered unauthorized if you have not consented to it. This is the case with classic phishing: fraudsters use your data and initiate a bank transfer or card payment themselves.
The situation may be different if you yourself initiated a transfer, for example, because an alleged bank employee asked you to transfer money to a so-called security account. In this case, the payment is usually legally authorized, and the obligation to reimburse under Section 675u of the German Civil Code (BGB) does not automatically apply. Other claims may be considered in such cases and must be examined separately.
More complicated are incidents where customers grant approval because they were misled into believing a different transaction was being processed, such as a supposed cancellation. Whether this constitutes valid authorization depends on the circumstances, such as the information actually displayed by the approval app. Banks often consider such cases authorized, but this is not necessarily the case.
The obligation to reimburse is not limited to online banking. It also applies to fraudulent payments made with credit or debit cards and digital cards. You can find more information on our page for Victims of credit card fraud.
Pay attention to the deadlines: According to § 676b para. 2 of the German Civil Code (BGB), claims for unauthorized payments are excluded if you have not informed the bank no later than 13 months after the debit.
Does your bank classify the payment as authorized? This classification determines your claim. Have it reviewed before giving up.
What you should do now after a phishing attack
Anyone who has been a victim of phishing or online banking fraud Anyone who has become a victim should act quickly and systematically. The following steps will protect your rights:
- Inform the bank immediately: Report the incident immediately and have your online banking and cards blocked. The central blocking hotline can be reached at 116 116.
- Request a refund in writing: Explicitly request reimbursement with reference to Section 675u of the German Civil Code (BGB) and the ECJ ruling C-70/25, and set a short deadline.
- Specify payments precisely: List each payment you did not agree to, including the date and amount.
- Secure evidence: Save emails, text messages, letters, QR codes, screenshots, call logs and bank statements.
- File a criminal complaint: Report the fraud to the police and note the case number.
- Caution with questionnaires: Banks often send out forms detailing the events after fraud cases. Their answers can later serve as evidence of gross negligence.
Do not fill out bank questionnaires hastily. Every word you write could play a role in a liability dispute.
If your bank has already rejected your claim, the matter is not yet settled. You can reclaim the money, citing the court ruling, and request a written explanation for the rejection. Whether and to what extent older cases are still enforceable depends on the applicable deadlines and the specific circumstances of each case.
Money gone, bank refusing to help? Now a sound approach is crucial. Seek advice before making any further statements to the bank.
Rogert & Ulbrich – Your lawyers in banking law
Rogert & Ulbrich has been representing consumers against banks, payment service providers, and large companies for many years. The partners Dr. Marco Rogert and Tobias Ulbrich have extensive experience in enforcing consumer claims, even in complex cases of Online fraud and unauthorized account debits.
We investigate whether your payment was unauthorized, whether your bank's rejection is legally valid, and whether the allegation of gross negligence is justified. We pursue reimbursement out of court, defend against bank claims for repayment, and represent you in court if necessary. Our multilingual team assists you with cross-border payments.
Have you fallen victim to phishing and is your bank refusing a refund? The ECJ ruling provides you with a strong argument. Take contact and secure your claims.
