A ruling that could change the rules for bank fraud victims
On 15 October 2026, the Court of Justice of the European Union issued its ruling in case C-70/25, known as the Tukowiecka case. For millions of bank customers across the EU, including in Poland, this is not an abstract legal dispute. It answers a question that anyone who has ever clicked a suspicious link has asked themselves: does the bank have to give the money back if a fraudster broke into my account and I was "tricked"? The Court's answer: yes, in most cases it does, and it has to do it quickly.
A story that started with an online sale
The case that reached the EU's top court originated at the District Court in Koszalin, Poland. A customer of PKO Bank Polski listed an item for sale online. A "buyer" contacted her and sent a link supposedly confirming the transaction. The page she landed on looked almost identical to her bank's own website. She entered her online banking login details there, and moments later approved, with an SMS code, an operation she believed was part of receiving payment. In reality, she had just authorised a transfer of 3,000 zloty to the fraudster's account.
The next day she reported the crime to the police and filed a complaint with the bank. The bank refused to refund the money, arguing that she had been grossly negligent by entering her login details and approving the operation with a code. The dispute went to court, and the court asked the CJEU how a bank's obligations should work in such a situation.
What exactly the Court said
The EU's PSD2 directive, implemented in Poland through the Payment Services Act, already required a bank to refund an unauthorised transaction immediately, no later than the end of the following business day. The exception applies when the provider has a well founded suspicion, reported in writing to the relevant authority, that the customer committed fraud. Separately, the law says that if the customer caused the unauthorised transaction intentionally or through gross negligence, they, not the bank, bear the full loss.
In practice, banks had been merging those two rules: if they suspected gross negligence, they simply refused the refund before anyone had actually proven that negligence. The Court said plainly that this is not how it should work. The obligation to refund immediately is the rule. The only exception that allows a bank to withhold it is a well founded suspicion of fraud committed by the customer themselves, meaning a case where the customer acted in collusion with the criminal or staged the incident, not a mere suspicion of carelessness or inattention.
Just as importantly, the Court stressed that it is the bank that must prove the customer's gross negligence, not the other way around, and that this cannot happen inside the bank's own internal complaint procedure without the customer having a real chance to defend themselves. Correctly entering an SMS code or logging in successfully is not, by itself, proof that the account holder genuinely authorised the operation, since in this very case the victim formally "authorised" it without understanding what she was actually signing off on.
What this means for your wallet
In practice, the ruling separates two questions that banks used to treat as one. First: does the money come back quickly. Second: who ultimately pays for it. If you fall victim to a similar scam, the bank should return the funds immediately, even if its staff have doubts about how careful you were. Only afterwards, in a separate proceeding, can the bank try to recover that money from you, but it has to prove its case rather than simply assume it.
The Polish Bank Association (ZBP), commenting on the ruling, stresses that it is not a surprise for the Polish sector: most banks had already adjusted their procedures to earlier guidance from the Polish Financial Supervision Authority (KNF) and the competition and consumer protection authority (UOKiK). The industry would like the planned EU Payment Services Regulation (PSR) to explicitly allow providers to withhold an immediate refund where there is an objectively justified suspicion of gross negligence. That, however, is still only a proposal, not binding law, so for now the interpretation from the C-70/25 ruling applies.
It is just as important to understand what the ruling does not do. It does not automatically reopen every previously closed complaint, and it does not mean that anyone who clicked a fake link will get their money back without question. What still matters is whether the transaction was genuinely unauthorised, how quickly you reported the problem, and whether the bank can actually demonstrate your gross negligence through a proper procedure rather than a brief internal review.
What to do if you suspect your account has been compromised
- Call your bank as fast as you can, using the number from its official website, never a number or link from the message that triggered your suspicion.
- Ask for your online banking access and card to be blocked immediately if you shared their details.
- File a written complaint and explicitly cite the immediate refund obligation.
- Report the incident to the police the same day if possible, keeping screenshots of the fake website, the fraudster's messages and the transaction confirmation.
- If the bank still refuses, you have the right to escalate to the Financial Ombudsman, citing the interpretation from the C-70/25 ruling.
Protecting your money starts much earlier
The CJEU ruling is an important safety net, but it is far better never to need it. It helps to split your money by purpose: keep only what you need for everyday spending in the account you use for cards and transfers, and move the rest to a savings account or a term deposit, where an extra internal transfer step buys you a moment to cool down before a fraudster can empty the account. If you are wondering whether your current bank offers convenient, well protected everyday banking, you can compare personal accounts and see which banks offer the strongest transaction security. If you would rather keep most of your money outside your current account, check the current savings account rankings, and for money you can set aside for longer, the term deposit comparison is worth a look too, since your funds stay just as protected there while also earning interest.
Summary: what you should remember
The ruling in case C-70/25 settles something that had long frustrated bank customers: the automatic pairing of a suspicion of carelessness with a refusal to refund. The Court reminded everyone that it is the bank's job to prove gross negligence, and until it does, the money should go back to the victim's account. That does not mean carelessness has no consequences, since the bank can still recover the loss if it proves negligence, and that process can be long and stressful. The best strategy therefore remains reducing risk from the start: splitting your funds between accounts, never clicking links from unknown sources, and treating every request to "confirm a transfer" as a potential trap. If you are planning to put your finances in order and look for a bank that genuinely prioritises customer security, start by comparing today's offers on BankSorter.com.