The CJEU Advocate General advised banks must immediately refund customers for phishing-related unauthorized payments under PSD2. Banks must refund unless they have reasonable grounds to suspect customer fraud; they may later recover funds only if they prove gross negligence or intent.
Part of the PlainSec briefing for 2026-03-09