Financial institutions must immediately refund phishing victims by the end of the next working day, according to a ruling from the Court of Justice of the European Union issued on October 15, 2026. Banks bear the full burden of proof to demonstrate gross negligence before recovering funds.
The European Union’s highest court has settled a long-standing financial dispute across member states, establishing that banks cannot withhold stolen money on mere suspicion of customer error. Under the ruling, financial institutions must process repayments to account holders no later than the close of the first business day following notification. The judgment reinforces existing regulations that consumer advocates argue lenders routinely bypassed by reversing the burden of proof onto victims.
The Polish Phishing Case That Prompted the European Court Ruling
The legal clarity arrived via a preliminary question referred by a Polish court handling a specific online fraud case. A bank customer listed an item for sale online, prompting a fraudster to send a malicious link designed to mimic the victim’s banking portal. After entering credentials on the fraudulent site, the account holder lost 700 euros.
When the victim reported the theft the following day, the financial institution refused reimbursement, alleging gross negligence by the customer. The national court subsequently asked the EU high court whether lenders can retain funds when they suspect user fault. The Court of Justice ruled that presumptive error does not justify withholding stolen assets.
Strict Proof Requirements and Single Exceptions for Lenders
Banks face a high legal threshold if they intend to reclaim refunded money. The court established that financial institutions carry the entire investigative burden to prove gross negligence, such as the mishandling of a secret PIN. Only credible evidence demonstrating that a customer actually participated in fraudulent activity permits a bank to pursue clawback procedures through the courts.
A single exception allows lenders to delay or deny payouts: if the institution holds a reasonable suspicion of customer fraud and files a written report with competent national authorities. Absent such formal reports, banks must reimburse victims first and initiate legal arguments afterward.
Consumer Advocacy Reaction and Legal Alignment in Belgium
Consumer protection organizations welcomed the decision, noting that the judgment mirrors previous verdicts handed down by Belgian courts. Advocacy groups argue that mandatory reimbursement prevents victims from facing expensive and stressful legal battles just to recover their own assets from institutional withholding.
Consumer representatives emphasized that lenders frequently flipped the evidentiary burden onto defrauded account holders in the past.
For years, we have denounced the fact that banks do not comply with existing regulations and reverse the burden of proof. In Belgium, many courts have already raised this issue as well. Now we have a ruling from the highest European court that definitively confirms that banks must pay first and discuss afterward, and we hope that they will now actually adhere to it. Laura