Policy & Regulation · Phishing / BEC
The CJEU Advocate General advised banks must immediately refund customers for phishing-related unauthorized payments under PSD2. Banks must refund unless they have reasonable grounds to suspect customer fraud; they may later recover funds only if they prove gross negligence or intent.
1 source · Mar 8
BleepingComputer
EU court adviser says banks must immediately refund phishing victims
Athanasios Rantos, the Advocate General of the Court of Justice of the EU (CJEU), has issued a formal opinion suggesting that banks must immediately refund account holders affected by unauthorized transactions, even when it's their fault.
originalPart of the PlainSec briefing for 2026-03-09
Every edition of this story: EU Court Adviser: Banks Must Immediately Refund Phishing Victims