CJEU phishing judgment: an allegation of gross negligence does not automatically postpone an unauthorised-payment refund

The October 15 ruling

The Court of Justice’s 15 October 2026 release in C-70/25, Tukowiecka concerns an unauthorised payment following phishing. It explains that an allegation of the customer’s gross negligence does not, by itself, allow the bank to postpone the immediate refund required by the Payment Services Directive. The Court distinguishes that initial obligation from the bank’s ability to pursue recovery later if the relevant liability is established.

The case name is fictitious, as the Court’s release notes. The release is an official explanation of the judgment, not the binding judgment text itself. This article focuses on the legal distinction described in that release and the directive provisions, without claiming to have the national court’s complete evidential record.

Immediate reimbursement and ultimate liability

Articles 73 and 74 of Directive 2015/2366 address different stages of an unauthorised-payment dispute. The immediate-refund framework generally requires reimbursement by the end of the following business day after the provider becomes aware or is notified. The stated exception concerns reasonable grounds to suspect fraud by the customer, reported to the relevant national authority. Gross negligence and customer fraud should not be treated as interchangeable allegations.

A later dispute can still examine whether the customer acted intentionally or with gross negligence and should bear the loss. The practical consequence is a separation between who carries the financial burden while the facts are investigated and who ultimately bears the loss. A provisional or prompt refund should therefore not be described as a final ruling that the customer can never be liable.

Authorisation is a factual and legal question

Phishing cases can involve different conduct: stolen credentials, a payment initiated by an attacker, or a customer deceived into approving a transfer. Those scenarios should not be collapsed into one category. The first question is what transaction was actually authorised, if any, under the applicable legal framework. A bank’s technical record and the customer’s account of events need to be examined together.

The useful evidence includes the message or website used, timestamps, the disputed transaction, authentication prompts, contact with the provider and the time of notification. Preserve evidence without continuing to interact with the suspected fraudster. A complaint should identify the unauthorised transaction and the remedy requested, rather than only state that the customer “was scammed”. The legal classification can determine which rules apply.

An EU account used from Georgia

Living or travelling in Georgia does not, by itself, establish which payment-services law governs an account. The provider, contractual relationship, transaction and territorial scope must be checked. A person using an EU payment account from Tbilisi may have a different legal position from someone using a Georgian account for a cross-border transfer. The Court’s interpretation of EU law should not be presented as a new Georgian statutory refund deadline.

For a Georgian provider, the applicable Georgian payment-services rules and complaint mechanisms require their own analysis. An EU judgment can be useful comparative material, but it does not automatically rewrite a Georgian contract or give an EU court jurisdiction over every dispute. Where several providers are involved, identify which one performed the disputed service and where the complaint belongs.

A practical complaint sequence

• Notify the provider promptly and identify the transaction, amount and date.
• Preserve the fraud messages, account records and authentication evidence.
• Ask whether the provider treats the transaction as authorised and on what evidence.
• Separate a claim for immediate reimbursement from any later dispute over ultimate liability.
• Use the correct national complaint, ombudsman or court route after checking the account’s legal framework.

The judgment matters because it prevents a bare negligence allegation from being treated as a complete answer to the initial refund duty within the applicable EU framework. For a different cross-border banking development, see our Georgia–UAE cooperation analysis.

Legal check date

Sources and law checked on 15 October 2026. Later developments are not reflected automatically. Application of the rules depends on the individual facts.