The TUKOWIECKA case – CJEU ruling on banks’ obligation to refund unau-thorised payment transactions

1. What is the case about?

The decision relates to a case of phishing fraud, in which a customer entered her payment details via a fraudulent link on a website that resembled that of her bank. This resulted in the fraudsters gaining access to her account and making transfers that had not been authorised by the account holder herself.

The customer reported the incident the following day; however, the bank refused to reimburse her on the grounds that she had herself facilitated the payment transaction through grossly negligent behaviour. It argued that she had failed to adequately fulfil her duty to protect her personalised security credentials from unauthorised access. The customer subsequently sued the bank for payment of the relevant amount.

2. What are the legal grounds for the decision?

Of particular relevance to this decision is the Payment Services Directive 2 (Directive (EU) 2015/2366, PSD 2):

• Article 73 (1) PSD 2 stipulates that the payment service provider must refund an unauthorised payment transaction immediately, and at the latest by the end of the following business day. The only exception applies where the payer’s payment service provider has reasonable grounds to suspect fraud on the part of the customer and notifies the relevant national authority of these grounds in writing.

• Article 74 (1) PSD 2 governs the payer’s liability for unauthorised payment transactions, stipulating that a customer who breaches their obligations intentionally or through gross negligence must, in principle, bear the resulting loss themselves. 

• Article 69 PSD 2 obliges payment service users, amongst other things, to protect personalised security credentials from unauthorised access.

3. What was the question referred for a preliminary ruling?

A request for a preliminary ruling was submitted to the CJEU asking whether a bank, as a payment service provider under PSD 2, is obliged to refund the amount of an unauthorised payment transaction immediately, even if it considers that the customer acted with gross negligence.

4. What was the ECJ's ruling?

The ECJ answered the Polish court’s question in the affirmative: where an unauthorised payment transaction has taken place, the payment service provider is, in principle, obliged – provided the incident has been duly reported – to refund the relevant amount immediately, or by the end of the following business day at the latest. 

According to the ECJ

• the payment service provider is obliged to refund the amount immediately and

• the payment service provider may only, as a subsequent step, seek reimbursement from the customer if it can prove that the customer has breached their obligations – in particular the obligation to protect their personalised security credentials from unauthorised access – either intentionally or through gross negligence. The burden of proof lies with the payment service provider.

Accordingly, the question of reimbursement of the amount of the unauthorised payment transaction must be separated from the question of who is to bear the losses. 

5. Implications for Austrian Banks?

This ruling is also significant for the Austrian banking sector: legal proceedings are currently pending before the Supreme Court of Austria (OGH) which deal with the same issue and were interrupted due to the Tukowiecka case (OGH 5 Ob 54/24p). In light of the ECJ’s ruling, the proceedings are now expected to resume shortly and a decision to be handed down.

6. What questions does this raise for the banking sector?

• When is a payment transaction deemed to be authorised?

• What steps should be taken if a customer refuses to reimburse their bank for the payment? 

• How does this decision affect processes and procedures within banks?

• What new developments does the PSR introduce in this context?

• What fraud scenarios does this decision facilitate?

I will have the opportunity to discuss these and other questions relating to this decision on 16 November 2026 as part of the special event on PSD 3 and PSR organised by the imh Institute. Further information and details on how to register can be found here.

About the author:
Ms Mag. Sylvia Unger has been a solicitor for over 25 years and founded her own law firm, ‘Unger Rechtsanwälte’, in 2011.

Her areas of specialism include employment law, company law, contract law and payment transactions law. She is the (co-)author of several specialist books, gives lectures on employment law, company law and payment transactions law, and advises companies across a wide range of sectors.