EU Advocate General Says Banks Must Promptly Refund Phishing Victims Under PSD2
Summary
An EU Advocate General advised that banks should promptly refund unauthorized PSD2 transactions unless they have written grounds to suspect customer fraud. The opinion is advisory; the CJEU’s eventual ruling will be binding.
Key points
- The opinion arose from a dispute between PKO BP and a customer who lost money after entering bank credentials on a phishing page.
- The customer received a malicious link after listing an item for sale on an auction platform.
- The Advocate General said banks should immediately refund unauthorized transactions unless they have reasonable grounds to suspect customer fraud, communicated in writing to the competent national authority.
- Banks may seek recovery from customers if they prove intentional conduct or gross negligence involving obligations such as protecting personalized security data.
- The opinion is advisory, not a CJEU ruling; the court’s final decision will be binding on EU courts.
Article Details
- Event Type
- Advocate General opinion on banks' refund obligations for unauthorised transactions linked to phishing.
- Impact
- Advocate General Athanasios Rantos advised that banks should promptly refund unauthorised transactions unless they have reasonable grounds to suspect customer fraud, which must be reported in writing to the competent national authority. Banks may seek reimbursement from customers if they prove intentional conduct or gross negligence. The opinion is advisory; the final CJEU ruling will be binding on EU courts.