“Banks in the European Union are required to immediately refund funds to customers who have fallen victim to cybercriminals or phishing attacks on their accounts,” according to a ruling by the Court of Justice of the European Union. Even if a financial institution believes that a person acted with gross negligence, it has no right to delay compensation.
This is an important precedent for all account holders in the European Union, including Ukrainians who use the services of European and Slovak banks. We’ll explain how this mechanism will work and what has changed for customers.
Why this issue arose and how it all began
The case was prompted by a specific incident in Poland. A local customer was selling goods on an online marketplace when she encountered a scammer. The fraudster sent the woman a phishing link that mimicked her bank’s official website.
The victim entered her online banking login credentials there, after which approximately 700 euros disappeared from her account. The next day, the woman immediately contacted the bank to report the crime. However, the financial institution refused to reimburse her for the losses, claiming that the customer herself had aided the scammers through her own carelessness.
The case reached the EU’s highest court in Luxembourg. The judges sided with the consumer, setting clear priorities for the protection of customers’ rights.
Key Rules for Refunds
The European Court of Justice ruled that financial institutions cannot use suspicion of gross negligence as a reason to immediately deny compensation. The procedure is now clearly divided into two stages:
Immediate reimbursement. The bank is required to refund the funds to the customer’s account immediately upon notification of an unauthorized transaction, provided the customer reported the incident without undue delay.
Subsequent recovery of compensation. If the bank is convinced that the customer acted with gross negligence (for example, by voluntarily disclosing all passwords or confirming a fraudulent transaction), it must first refund the money and only then seek compensation for losses from the customer through court proceedings or other legal means. Moreover, the customer’s fault must still be proven.
EU law provides for only one legal exception under which a bank may completely refuse to pay—if there is an official and well-founded suspicion that the customer was directly involved in the fraud itself, and the bank has notified the relevant government authorities of this in writing.
What this means in practice for customers in Slovakia
Given that digital fraud and phone phishing are becoming increasingly widespread, many people have found that banks have attributed the loss of funds to the “carelessness of the account holder” and closed the cases.
Now, the position of the European courts provides a strong legal shield for consumers. If you’ve fallen victim to cybercriminals, promptly blocked your card, and notified your bank:
The financial institution has no right to simply dismiss your claim on the grounds that you yourself clicked on a suspicious link.
The burden of proof lies with the bank itself, but the funds must first be returned to the victim’s account.
In case of emergencies involving cards or accounts, always act quickly: immediately block access via the mobile app and submit a formal complaint to your bank’s customer support.
