CJEU backs ‘refund-first’ rule after fraud
Lawyers at A&L Goodbody (ALG) have highlighted a recent ruling from the EU’s top court on when banks should refund victims of fraud.
The Court of Justice of the European Union (CJEU) held that a payment-service provider (PSP), such as a bank, could not refuse to immediately refund an unauthorised transaction on the ground that the loss was due to ‘gross negligence’ on the customer’s part.
The court was ruling on questions referred to it by a Polish court on the interpretation of articles 73(1) and 74 (1) of the EU directive PSD2, which deals with liability for unauthorised transactions.
Phishing attack
The Polish case arose from a customer’s case against the bank PKO BP, which refused to refund her 3,000 PLN (€705) she had lost in a phishing attack during which she had provided her online banking login details.
The bank refused the refund on the basis that the customer had, through gross negligence, made the transaction possible by failing to comply with her obligation under article 69 of PSD2 to keep personal security credentials safe.
Article 73(1) says that a PSP must refund a customer no later than the end of the following business day after it has been notified of the unauthorised transaction.
Fraud exception
The CJEU found that a PSP could not refuse such a refund, except where it had “reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority”.
While article 74(1) indicates that a customer may be liable for losses caused by their own “gross negligence”, the EU court found that a PSP was still obliged to go ahead with an immediate refund.
The judges added, however, that a PSP could subsequently seek reimbursement if it could prove “gross negligence” on the part of the customer.
Previous refusals
In a note on the firm’s website, the ALG lawyers point out that the ruling could have an impact on previous refusals to refund based on suspected gross negligence.
“Whether a payer can now bring a claim in light of this judgment will likely depend on national time limits and procedural rules,” the lawyers state.
Gross negligence
ALG also notes that the CJEU did not rule on what constituted “gross negligence” under the directive, leaving this for the Polish court to determine.
The firm’s lawyers add that the judgment concerns unauthorised payment transactions only. The CJEU did not consider APP fraud, where a customer is manipulated by fraudsters into executing a payment transaction personally.
ALG also points out that the EU is currently working on a reform package consisting of a Payment Services Regulation (PSR) and a proposed third Payment Services Directive (PSD3).
The firm says that the PSR could reverse the refund-first rule, as its article 56 allows a provider to suspend the immediate-refund rules where it has “objectively justified reasons” to suspect intentional or grossly negligent conduct by the payer, communicated in writing.