This post is also available in:
On 15 October 2026, the Court of Justice ruled that a customer’s gross negligence does not allow the bank to refuse the immediate refund of an unauthorised payment transaction. For Belgian litigation, the real issues now lie on two fronts the judgment does not settle: the qualification of the transaction, and procedure.
For an overview of the rules, see our guide to phishing and payment fraud.
In June, we commented on the Antwerp order requiring a bank, in summary proceedings, to refund almost EUR 50,000 to a couple in their nineties. The president relied on Advocate General Rantos’s opinion in case C-70/25. We wrote that the bank was becoming the temporary financier of uncertainty. A few days after the Antwerp order, two Brussels judges, one French-speaking and one Dutch-speaking, each ruled the other way.
The Court of Justice has now delivered its judgment. Unsurprisingly, it follows its Advocate General and rules that have applied for many years. The question is no longer whether the bank must refund first. It is when that obligation arises, and before which court it is argued.
The Court confirms that an unauthorised transaction must be refunded despite gross negligence, even if the customer may have to repay the bank later
The facts are Polish and ordinary. A customer sells an item on an online auction platform. A fake buyer sends her a link. She enters her login details on a copy of her bank’s website, then passes on the confirmation code received by text message. The fraudster transfers PLN 3,000. The bank refuses to refund, citing the customer’s gross negligence.
The Court answers in three steps.
Article 73 of Directive 2015/2366, transposed into Belgian law by Article VII.43 of the Code of Economic Law, provides for a single exception to immediate refund: reasonable grounds to suspect fraud by the payer, communicated in writing to the national authority (paragraphs 33 and 34). Gross negligence is not among them.
Articles 73 and 74 govern distinct aspects: the first requires the refund, the second allocates liability at a later stage (paragraph 42). The bank refunds first, then may claim the losses from the payer through the legal remedies available (paragraphs 38 and 46).
A different reading would force the customer to take the initiative of going to court and to bear the costs, which is hard to reconcile with a high level of consumer protection (paragraph 45). The bank therefore cannot assess its own liability and exempt itself from the refund (paragraphs 20 and 47).
None of this is new in the text. The Court itself recalls that the first Payment Services Directive provided for no exception at all, and that the fraud exception was added during the legislative process (paragraphs 48 and 49). What changes is that a reading which softened the rule is now ruled out across the Union.
The rule only applies to unauthorised transactions, and the Court does not rule on that question
The judgment rests on a premise no one disputed: the transaction was unauthorised. The Polish bank did not contest it. It argued only that negligence exempted it.
One sentence deserves attention. In paragraph 15, the Court records that the transaction was authorised by the fraudster using a text-message confirmation code obtained from the customer by deception. It will be quoted in vishing cases, as if the Court had held that a payment validated with a code obtained from the customer remains unauthorised. It did not. Paragraph 15 restates the facts as the referring court described them. The Court was not asked about the qualification of the transaction and did not examine it.
In Belgium, that is almost always where the case begins. In the most common fraud, a fake bank employee calls the customer and has him validate a transfer himself in his banking app, without the customer realising that he is authorising that transfer. Under Article VII.32 of the Code of Economic Law, a payment is authorised when the payer has consented in the form and according to the procedure agreed with the payment service provider. The unauthorised nature of the transaction is not an exception to Article VII.43: it is the condition for its application.
Before a Belgian court, what can a fraud victim’s refund claim expect?
A customer who wants a refund before any debate on negligence has two routes. Belgian courts do not treat them the same way.
The first is summary proceedings. The president of the Antwerp Enterprise Court opened that route on 26 May 2026 (C/26/00024, published in D.B.F. 2026/11). In his view, urgency follows from the text of Article VII.43 itself, which requires a refund by the end of the following business day at the latest. He declined to examine either authorisation or negligence: it is enough that the conditions of Article VII.43 appear to be met. We find this position open to criticism under procedural law, since urgency in summary proceedings must be assessed in concreto and cannot be inferred from a statutory provision.
As noted above, the Brussels presidents did not follow. On 9 June 2026, the president of the French-speaking Brussels Enterprise Court dismissed a similar claim (C/26/00014; we acted for the bank). The loss of a significant sum is not enough to establish urgency, otherwise every unpaid creditor could go to summary proceedings. The president of the Dutch-speaking court ruled the same way the following day.
The second route is an interim measure under Article 19(3) of the Judicial Code. The trial judge could then, within a few weeks, order the bank to pay on a provisional basis. The customer must nonetheless show that the transaction was unauthorised, and the bank remains free to file a counterclaim based on gross negligence.
On this ground, case law is divided.
Several courts have refused the interim measure. On 27 June 2023, the Dutch-speaking Brussels Enterprise Court (A/23/01035) held that it could not rule without adopting principles likely to influence the decision on the merits, relying on the Court of Cassation’s judgment of 26 February 2014 (C.12.0388). On 17 April 2025, the first chamber of the French-speaking Brussels Court of First Instance (24/6623/A) held that Article VII.43 is a substantive rule that does not derogate from Article 19(3). The judge must therefore check that a provisional payment is proportionate. It refused the payment, as the bank’s solvency was in no way at risk.
Will judgment C-70/25 change anything?
Customers seeking a provisional payment order will rely on the judgment.
What does not change, however, is qualification. The judgment says nothing about when a transaction must be treated as unauthorised. Brussels courts ruling under Article 19(3) check, at least prima facie, whether the unauthorised nature of the transaction is plausible. That is where the interim debate now takes place. The bank relies on authentication logs, the trusted device, the channel used and the consistency of the customer’s account. The 2023 reasoning, that a court does not decide provisionally what lies at the heart of the dispute, keeps its full force where authorisation is seriously contested.
Businesses are not consumers, and in phishing cases this can make a difference
Article 61(1) of the Directive allows the parties to agree, where the user is not a consumer, that certain provisions do not apply, including Article 72 on evidence and Article 74 on liability. Where the general terms derogate from the burden of proof, the business must first establish that the transaction was unauthorised before it can rely on Article VII.43. Business account terms deserve a fresh reading with this in mind.
Tomorrow, the PSR will significantly change the approach
The forthcoming EU Payment Services Regulation will shift part of the debate. As we explained, it creates a category of authorised but refundable transactions: a consumer who consented because a third party impersonated the bank, through channels that appear to be the bank’s own, may be refunded. The provider will have fifteen business days to refund or give reasons for refusing. It may refuse only by proving fraud or gross negligence by the consumer. The Regulation thus addresses the issue directly.
The contrast with this week’s judgment is telling. For an unauthorised transaction, gross negligence does not delay the refund. For an authorised transaction induced by impersonation, it will remain a ground for refusal. The distinction between authorised and unauthorised does not disappear. It becomes even more important.
Key points for banks
Do not base a refusal on gross negligence alone where the unauthorised nature of the transaction is not disputed.
Where authorisation is disputed, say so and document it within the business day: authentication logs, device, channel, timeline. It is the only defence that holds at the interim stage.
Prepare every fraud file as if it were to be argued at the introductory hearing.
Keep gross negligence for the merits, by way of counterclaim, and weigh the cost: the bank becomes the claimant.
Review business account terms in light of Article 61 of the Directive.
Judgment C-70/25 does not make the bank an insurer against fraud. It sets the order of operations. The battle is no longer about negligence at the time of the complaint. It is about the qualification of the payment, from day one.
Leave a Reply