Portugal

Banks required to reimburse phishing victims even when claiming gross negligence of the client

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 02/11/2026, 08:26:25 UTC.

Briefings

The European Court of Justice ruled that banks must immediately refund victims of unauthorized payment operations, even if the customer acted with gross negligence due to phishing. Banks can only demand restitution after returning the funds if they can prove the customer was negligent. This decision clarifies EU payment service directives effective from October 15, 2026.

Key points

• Banks are legally required to immediately refund victims of unauthorized payment operations, regardless of whether the customer acted with gross negligence.
• Banks may only demand restitution after returning the funds if they can prove the customer was negligent.

Context

This ruling clarifies the application of EU payment service directives, specifically addressing the balance between consumer protection and bank liability when fraud occurs via phishing attacks.

Limitations

The ruling applies to EU jurisdictions only. The effective date is October 15, 2026. Evidence is limited to the specific CJEU decision; broader implementation timelines or regional variations are not covered.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 02/11/2026, 09:24:47 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeig4fe6j3ika2esfkofabay3zi4o6v3se5qjm7fwse77ukevrq3b24