The payment service provider may, however, subsequently claim reimbursement from the customer of losses resulting from gross negligence on the part of the customer A customer of a Polish bank was the victim of phishing fraud: a third party presented himself as interested in purchasing an item that she was selling on an online sales platform and sent her a fraudulent link, presented as originating from that platform and intended to confirm the sale. Deceived, she clicked on that link which led to a website that resembled that of her bank and entered her connection details to the e-banking service. Thanks to that data, the third party in question was able to transfer an amount of approximately EUR 700 from the customer's bank account to an account in his name. The following day, the customer reported the fraudulent transaction to her bank. However, the customer refused to refund the amount of the unauthorised payment transaction, taking the view that the customer, through gross negligence, had made that transaction possible and failed to fulfil its obligation to protect the personalised security credentials. Following this refusal, the customer brought an action before a Polish court, which asked the Court of Justice of the European Union whether, in the light of EU law, the bank, as a payment service provider, is obliged to immediately reimburse the amount of an unauthorised transaction, even if it considers that the customer has committed gross negligence.

In its judgment, the Court answers in the affirmative. In the event of an unauthorised payment transaction, the payment service provider is, in principle, required to reimburse the amount of that transaction immediately, at the latest by the end of the first business day following that on which it became aware of or was informed thereof, provided that the customer informs that payment service provider thereof without delay.

There is only one exception to this immediate reimbursement obligation: where the payment service provider has reasonable grounds to suspect fraud committed by the customer and notifies the competent national authority of those reasons in writing. The fact that the payment service provider considers that the customer made the unauthorised transaction possible due to gross negligence – in particular by failing to take the necessary measures to protect the personalised security credentials – does not allow it to refuse immediate reimbursement. Indeed, EU law makes it possible to distinguish between the question of the reimbursement of the amount of the unauthorised payment transaction and that of who is ultimately to bear the losses relating to that transaction. Therefore, as a first step, the payment service provider is required to make the immediate reimbursement. Subsequently, it may, where appropriate, claim reimbursement from the customer of the losses incurred if it proves that those losses arise from the fact that the customer, intentionally or through gross negligence, has breached its obligations, in particular the obligation to protect personalised security credentials. It is for the payment service provider to prove the existence of such gross negligence on the part of the customer.