Europe changes the rules on bank fraud and shifts the burden of proof onto banks

The Court of Justice of the European Union (CJEU), the court that determines how EU law is applied across all Member States, issued a ruling on 15 October that changes the order in which banks respond to a bank fraud claim. In case C-70/25, the Court concludes that a customer’s gross negligence does not justify delaying the refund of an unauthorised transaction. The institution must refund the amount immediately, and no later than the end of the following business day. If it subsequently proves that negligence, it may claim the money back.

There is only one exception that allows the refund to be suspended: reasonable grounds to suspect that the customer has committed fraud, which must be reported in writing to the relevant national authority.

The ruling does not determine who bears the final loss in each case. What it does is separate two steps that until now went together. The money is refunded first, and liability is discussed afterwards, with the burden of proof on the institution. Because the ruling interprets the Payment Services Directive (PSD2), its criteria are binding on all Member States, including Spain, where the Real Decreto-ley 19/2018 sets out the same obligations.

Proof depends on what the session records

In Spain, the Supreme Court (Tribunal Supremo) had already established in April 2025 that the use of the customer’s credentials or of strong customer authentication is not, in itself, sufficient to prove gross negligence.

The principle is not exclusive to Spanish law. PSD2 sets it out for the entire EU in Article 72, and the European ruling gives it greater operational weight by confirming that the burden of proof lies with the institution.

Reconstructing what happened requires a different kind of information, such as the device used to carry out the transaction and whether it matched the usual one, the presence of remote access tools, or whether the way the user interacted was consistent with the account holder’s historical pattern.

This traceability works in both directions. It supports a claim when there are genuine indications of negligence or fraud by the customer, and it allows the claim to be quickly dismissed when the evidence points to impersonation. In both cases, the decision is backed by verifiable data.

Acting before the transaction is executed 

If the refund is immediate and recovery depends on a long and complex process, the most effective approach is to act before the money leaves the account. Many of these scams are set up outside the banking environment, through text messages, phone calls or listings on online marketplaces, as in the case that gave rise to the ruling.

A customer of a Polish bank who was selling an item online received a link from a supposed buyer to confirm the sale. The link led to a website imitating her bank’s, where she entered her login details, which the fake buyer then used to transfer around 700 euros to his own account. In this type of fraud, by the time the fraudster accesses online banking, they already have valid credentials.

Outside the EU, the debate is taking different paths. In the United Kingdom, reimbursement has been mandatory since October 2024 for fraud in which customers are tricked into authorising the transfer themselves, with the loss shared between the sending and receiving institutions. In Chile, the Supreme Court rejected in October a bank’s claim to recover an amount already refunded to a customer, as his negligence had not been proven. In Brazil, the Superior Tribunal de Justiça, which harmonises civil case law across the country, tends to exempt institutions when the customer carries out the transfer, although it has ruled against them when monitoring of unusual transactions has failed.

Whatever the legal framework, signals that emerge during the session itself are gaining importance, from a never-before-seen device to an interaction pace that is unusual for the account holder. Their value increases when they are read alongside the customer’s identity and history, because they make it possible to respond in proportion to the risk, with additional verification, a temporary hold or a block, while keeping a record of the basis for each decision.

For financial institutions, the quality of evidence and the ability to detect fraud early now have a direct impact on the cost of fraud.

At Facephi, we bring together the full context of an identity in a single platform to make better decisions in every interaction and preserve evidence of what happened.