The CJEU’s Tukowiecka Judgment: A One-Hit Wonder or a Turning Point for Unauthorised Payments?

On 15 October 2026, the Court of Justice of the European Union (CJEU) answered a question in Case C-70/25 (Tukowiecka) that affects a great many banks and other payment service providers (PSPs) across the EU: may an institution refuse to refund an unauthorised payment transaction immediately on the grounds that the payer enabled it by breaching their obligations under Article 69 PSD2 through gross negligence?

The judges in Luxembourg have now answered that question in the negative. According to the Court, the refund obligation under Article 73(1) PSD2 is subject to only one exception: reasonable grounds for suspecting fraud by the customer, provided that those grounds are communicated in writing to the relevant national authority. An allegation of gross negligence on the customer’s part can therefore become relevant only at a later stage, when the bank seeks to recover its losses from the customer.

The judgment is particularly significant for Austria, where banks sometimes refuse refunds on the grounds that the customer acted with gross negligence and set off their resulting claims for damages against the customer’s refund claim. This practice will no longer be permissible. In the short term, many institutions will therefore need to adjust how they handle fraudulent payments.

In the medium term, however, this decision may well prove to be a one-hit wonder. The latest draft of the Payment Services Regulation (“PSR”), specifically Articles 56 and 57, allows PSPs to suspend refunds where there are objectively justified grounds for suspecting fraud or gross negligence on the customer’s part. A refund must then be made within 15 business days, although it may also be refused if reasons are given. If the PSR is adopted in this form, as we expect in view of the political compromise already reached, it will supersede the effect of the Tukowiecka judgment for the future.

Below, we examine the background, the legal framework, the CJEU’s decision, its practical implications and the outlook.

Background

The underlying case involved a classic phishing scam. A customer of a Polish bank had advertised an item on an online sales platform. An unidentified fraudster posed as a buyer and sent her a link that purported to confirm the sale but actually led to a replica of her online banking website. Using the login credentials entered there, the fraudster was able to transfer approximately EUR 700 to an account of their own. The fraudster had also tricked the customer into disclosing the SMS code needed to approve the transaction.

The customer reported the incident to the bank and the police the following day. The bank refused a refund on the grounds that she had been grossly negligent in failing to safeguard her payment instrument. In the bank’s view, it was entitled to assess all the conditions for liability itself and refuse a refund if it found gross negligence.

The Polish court hearing the case referred a question to the CJEU asking whether Articles 73(1) and 74(1) PSD2 must be interpreted as allowing a PSP to refuse an immediate refund of the amount of an unauthorised payment transaction to a payer on the grounds that the payer enabled that transaction by breaching their obligations under Article 69 PSD2 through gross negligence.

Legal Framework

Directive (EU) 2015/2366 (“PSD2”) and, correspondingly, the Austrian Payment Services Act 2018 (“ZaDiG 2018”) allocate liability for unauthorised payment transactions through two provisions:

• Article 73(1) PSD2: The PSP must refund the amount to the payer immediately and, in any event, no later than the end of the following business day. The only exception is where there are reasonable grounds for suspecting fraud by the payer and the bank communicates those grounds in writing to the relevant national authority.
• Article 74(1) PSD2: “By way of derogation from Article 73”, the payer may bear losses of up to EUR 50 resulting from the use of a lost, stolen or misappropriated payment instrument. Where the payer acts fraudulently or breaches their obligations under Article 69 intentionally or with gross negligence, they bear the entire loss. Article 69 requires, in particular, that personalised security credentials be kept safe.

At the heart of Tukowiecka was the relationship between Articles 73(1) and 74(1) PSD2.

The CJEU’s Judgment

In substance, the CJEU follows Advocate General Rantos’s Opinion of 5 March 2026, which recommended a two-stage approach: “Refund first, litigate later”. Accordingly, in the event of an unauthorised payment, the PSP is generally required to refund the amount immediately and, in any event, no later than the end of the business day following the day on which it became aware of, or was notified of, the transaction, provided that the customer notifies the PSP without undue delay. There is only one exception to this immediate refund obligation: where the PSP has reasonable grounds for suspecting fraud committed by the customer and communicates those grounds to the relevant national authority.

The fact that the PSP considers the customer to have enabled the unauthorised transaction through gross negligence, in particular by failing to take the necessary steps to safeguard their personalised security credentials, does not entitle the PSP to refuse an immediate refund.

Under EU law, a distinction can be drawn between refunding the amount of an unauthorised payment transaction and determining who must ultimately bear the associated losses. According to the CJEU, the PSP must therefore first make the refund immediately. It may subsequently, where appropriate, seek compensation from the customer for the losses incurred if it proves that those losses resulted from the customer’s intentional or grossly negligent failure to fulfil their obligations, particularly the obligation to safeguard their personalised security credentials. The CJEU makes clear that the burden of proving such gross negligence on the customer’s part rests with the PSP.

The CJEU bases its reasoning on the wording of PSD2, its interpretation in the context of the Directive as a whole, its purpose and its legislative history. In particular, the Court emphasises that PSD2 aims to ensure a high level of consumer protection. If gross negligence could release the PSP from its refund obligation, the payer would have to enforce their rights in court and bear the associated disadvantages, including litigation costs. According to the Court, that would be difficult to reconcile with the objective of a high level of consumer protection.

In our view, it is noteworthy that the Polish court narrowly confined its reference to the relationship between Articles 73 and 74 PSD2. As Professor Linardatos has already observed, the CJEU was not asked whether the immediate refund obligation precludes a national rule allowing a PSP to defend itself against the exercise, contrary to good faith, of individual rights conferred on the customer by PSD2 under EU law. Whether other defences and security rights under national law may be invoked against the refund claim therefore remains open.

Another relevant case is pending before the CJEU: Case C-635/26, Yurga. At least the questions referred in that case offer an opportunity to address the relationship between Article 73 PSD2 and national legal doctrines. The outcome of those proceedings remains to be seen.

Practical Implications

Under the current legal framework, the Tukowiecka judgment means that, outside the narrow “fraud exception”, PSPs may no longer refuse a refund on the grounds that the customer breached their obligations under the contractual relationship with the PSP through gross negligence.

The judgment is particularly significant for Austria because proceedings concerning the same question are currently pending before the Austrian Supreme Court (OGH) and were stayed pending the outcome of Tukowiecka (see OGH, 3 June 2025, 5 Ob 54/24p). Now that the CJEU has delivered its judgment, we expect a decision in those proceedings soon, likely to follow the CJEU’s ruling closely.

The Tukowiecka judgment therefore raises several important practical questions for banks:

When Is a Payment Transaction Considered Authorised?

In our view, it is important to emphasise that the CJEU’s judgment concerns only unauthorised payment transactions. If the customer authorises a transfer themselves, the immediate refund obligation does not apply. As the Austrian Financial Market Authority (FMA) recently highlighted, the vast majority of fraudulent payment transactions now involve authorised transactions. According to the latest figures, approximately 98% of fraudulent credit transfers were approved by the affected customers themselves, despite the use of strong customer authentication (see the FMA’s Integrated Report on Bank Distribution 2026). The CJEU’s judgment therefore brings the clear distinction between authorised and unauthorised payments into focus. For a more detailed discussion, see our article Fletzberger/Falke, “Aktuelle Probleme bei missbräuchlichen Zahlungen – Autorisiert oder nicht autorisiert, das ist hier die Frage!”, ZFR 2024, 364 (in German).

What Does the CJEU’s Judgment Mean for Banks’ Existing Processes?

PSPs must adapt their complaints-handling and refund processes for fraudulent payments, particularly where they have previously refused refunds for unauthorised transactions on the grounds of the customer’s gross negligence. Internal review procedures, refusal letters, recovery letters, customer information and the underlying general terms and conditions should be reviewed and adjusted where necessary. Evidence for subsequent recovery claims must be preserved accordingly.

We also believe that the right of recourse under Article 92 PSD2 will play a greater role in future. Formal third-party notices to the recipient institution are likely to be considered more frequently.

Existing pending cases must also be reassessed in light of the Tukowiecka judgment.

It is clear that the fraud exception, involving notification to the relevant authority, is not a routine solution. In most cases, the customer is simply the victim: even if they have acted with gross negligence, they will generally not have acted fraudulently.

Outlook: The PSR

Article 57 of the latest PSR draft, as of October 2026, provides that, in the event of an unauthorised payment transaction, the payer’s PSP must refund the amount to the payer immediately and, in any event, no later than the end of the business day following the day on which it became aware of, or was notified of, the unauthorised payment transaction. So far, so good. However, if the payer’s PSP has objectively justified grounds for suspecting that the payer has failed to fulfil one or more of their obligations under Article 53 PSR intentionally or with gross negligence, and communicates those grounds to the payer in writing, the immediate refund obligation does not apply.

In that case, the payer’s PSP must take one of the following steps within 15 working days of becoming aware of, or being notified of, the transaction:

• Either refund the amount of the unauthorised payment transaction to the payer if, following further investigation, the payer’s PSP concludes that the payer did not act fraudulently and did not breach one or more of their obligations under Article 53 PSR intentionally or with gross negligence;
• Or provide the payer with reasons for refusing the refund and identify the bodies to which the payer may turn under Articles 100, 101, 103, 104 and 105 PSR if they do not accept those reasons. If the PSP concludes that the payer acted fraudulently, it must also communicate the reasons for that conclusion to the relevant national authority.

If the PSR is adopted in this form, Tukowiecka may well become a thing of the past. The PSR provides for an approach that differs substantially from the current two-stage model of “Refund first, litigate later!” and is, in our view, more workable. For example, it is wholly unrealistic to assume that the factual issues frequently arising in fraudulent transactions can be resolved within a single day. The 15-day period alone should lead to better, more accurate outcomes in future: decisions by PSPs based on a sound understanding of the facts surrounding the transaction in question.

How Can We Help?

PFR advises banks, electronic money institutions and payment institutions on disputes with customers concerning fraudulent payments. We are also currently supporting numerous institutions in preparing for the PSR and PSD3.