Bank Fraud: Your Bank Must Now Refund You Before Debating Your Negligence

Have you fallen victim to a banking scam, a fraudulent wire transfer, or a successful phishing attack on your account? A ruling handed down on October 15, 2026 by the Court of Justice of the European Union is changing things for thousands of customers in France. In case C-70/25, known as “Tukowiecka,” European judges now require banks to refund first and discuss any negligence afterward.

What the new European rule says

Until now, many banks refused or delayed refunding an unauthorized payment transaction as soon as they suspected gross negligence on the part of the account holder: a card PIN written on a piece of paper, a link clicked by mistake, confirmation given too quickly to a fake advisor. The CJEU points out that the European directive on payment services (PSD2) does not leave this choice up to the bank. The refund must be issued without delay, no later than the end of the first business day following the report of the fraud.

Gross negligence is no longer enough to deny a refund

The heart of the ruling can be summed up in one sentence: even if the customer's gross negligence is established, this does not exempt the bank from its obligation to refund immediately. The question of the customer's liability can still be examined, but only after the money has been credited back to the account. For consumers, this is a complete reversal of the order of proof: the discussion no longer happens before the refund, but after it.

Only one exception under the directive

Banks still have some leeway, but it is very narrow. The exception applies only when the bank has good reason to suspect fraud committed by the customer themselves—in other words, a staged transaction. In that specific case, the bank must notify the relevant national authority in writing in order to suspend the refund. Outside of this very particular scenario, no other reason allows the payment to be delayed, not even doubt over how the credentials were leaked.

What this means in practice for victims in France

Under French law, this obligation is based on Article L. 133-18 of the Monetary and Financial Code, which transposes PSD2. In practice, a customer who reports an unauthorized transaction must have their account credited for the disputed amount no later than the business day following their complaint. This principle applies just as much to an individual tricked by a fake text message from their bank as to a business whose employee clicked a fraudulent link from the company account. Before taking any action, however, it's worth comparing the protections offered by your insurance policy or card provider—a useful habit for any day-to-day consumer matter. Consumer advocacy groups also point out that this type of dispute increasingly affects small businesses, an issue closely followed by specialists in household and professional finance and economics. Business consulting firms also recommend training staff on these risks, an issue that has now become standard for any business managing online accounts.

Frequently Asked Questions

How quickly must the bank refund a fraud victim?

No later than the end of the first business day following the report of the unauthorized transaction, under Article L. 133-18 of the Monetary and Financial Code.

Can the bank refuse a refund if the customer was negligent?

No, not at first. The CJEU specifies that gross negligence, even when proven, does not exempt the bank from refunding first; the question of liability is settled afterward.

Is there an exception to this immediate refund obligation?

Yes, just one: if the bank has good reason to believe the customer staged the fraud themselves, and it reports this in writing to the relevant national authority.

Sources

• Kohen Avocats — Bank Fraud and Unauthorized Transactions (CJEU, October 15, 2026)
• Planet.fr — Bank Fraud: The Bank Must Refund Immediately
• Bazacle & Solon — The CJEU Confirms the Obligation of Immediate Refund

This article was written with the help of artificial intelligence. Editorial policy