Falling victim to a cyber scam is not a happy meal for anyone. It’s much more painful to have your bank then tell you it was your fault and that it’s going to compensate you for the stolen money. However, despite laws already in place to protect users from such cybercrimes, it happens more often than we can imagine.
The EU’s Court of Justice has just issued a ruling that tips the balance a bit further when it comes to protecting users who are victims of cyber scams: banks must put money on the table first and ask questions later. Never the other way around.
A fake link and 700 euros. It all started with reports of a cyber scam in Poland. A woman was selling an item online when a supposed buyer sent her a link to stop the sale. The message appeared to be from a sales platform, but actually led to a website cloned from his bank. He entered his credentials there and the fraudster took about 700 euros. A textbook fishing. The next day, the victim informed the bank, which refused to refund the money due to neglect of custody of his security certificate.
Now, the Court of Justice of the EU has ruled in favor of the client. As the sentence concludes, this gross negligence “does not permit him to refuse immediate return.” If the customer notifies without delay, the bank must refund the money by the end of the next working day.
How the Banks Protected Themselves. The European directive on payment services allows only one exception that occurs when the bank suspects, with reasonable grounds, that the client has committed fraud or some irregularity. In that case, the entity must notify the national authorities in writing and not return the stolen money. However, some banks made this exception the norm and relied on the gross negligence of the user for non-payment.
Article 45 of the Payment Services Regulation already obliges banks to immediately reverse unauthorized operations. Courts have already started to stop this practice. In April 2025, the Supreme Court ordered Ibarcaza to pay back 56,474 euros to SIM swap victims. Judges criticized that something as rare as fifteen shifts in one night “didn’t set off alarm bells at that point.” In Galicia, several courts found banks guilty of phishing cases when they did not find gross negligence on the part of the victims.
First you pay, then you negotiate. Key to the European Court’s ruling is the ordering of steps in the process of returning the stolen money. Courts distinguish between awarding money and determining who should bear damages. Refunds must always arrive first and it is always up to the bank to pay “immediately”. The court explained that, if it could be denied from the outset as it currently is, it would “deprive the immediate return obligation” contained in the European Regulation of any effective effect. Additionally, it will force the client to sue the bank to recover their money, with legal costs involved.
If the bank proves that the client has acted in bad faith or with gross negligence, it can claim the money back. That is, the burden of proof has shifted and it is not the user’s onus to prove that it was not their fault, but the bank’s onus to prove that the user was negligent. In his dissenting opinion, General Magistrate Rantos declared that, if the client refuses to return this unreasonable amount, it is the bank that has the right to go to court to claim it.
Fraud with cards and bank transfers is the first cause of claims recognized by the Bank of Spain in 2025. It accounts for about 28% of the total. According to data from the Quarterly Crime Report 2025 prepared by the Ministry of Home Affairs, around 430,493 computer scams were registered throughout last year.
In Xataka | Jordi Nebot, specialist in payment solutions: “It must be very bad for you to be the victim of a scam and not get your money back”
Picture | Unsplash (Vitaly Garev)
