Anyone who suffers an unauthorized debit as a result of phishing can generally demand an immediate refund from their bank. A mere allegation of gross negligence is not sufficient grounds to deny a refund. The European Court of Justice clarified this in its ruling of October 15, 2026, Case No. C-70/25.

For those affected, this decision provides important support. However, whether they will ultimately have to bear the cost themselves may need to be clarified separately afterward.

The Case: Fraudsters Steal Online Banking Login Credentials

A customer of a Polish bank wanted to sell an item on an online platform. A supposed prospective buyer sent her a link purporting to confirm the sale. The link led to a fake bank website.

The customer entered her login information there. Fraudsters used the information to transfer approximately 700 euros from her account. Although she reported the incident the next day, the bank refused to reimburse her and accused her of gross negligence.

The ECJ ruled: This claim does not relieve the bank of its obligation to reimburse the amount immediately. If the bank subsequently seeks compensation for the loss, it must prove that the conditions for such compensation are met—in particular, a breach of duty committed intentionally or through gross negligence that caused the loss. Source: ECJ, Judgment of October 15, 2026, C-70/25

When is the bank required to reimburse a customer for phishing?

In the case of an unauthorized payment , the bank must generally refund the amount immediately, or by the end of the following business day at the latest. The decisive factor is when the bank was notified of the lack of authorization or otherwise became aware of it. The account must also be restored to the balance it would have had had the unauthorized charge not occurred.

This obligation is governed by Section 675u of the German Civil Code (BGB). An exception applies if there are legitimate grounds to suspect that the customer is acting fraudulently, provided the bank notifies the competent authority of these grounds in writing. This does not refer to fraud committed by external phishing perpetrators. Legal basis: Section 675u BGB

The key question is: Did you agree to the payment?

Not every loss resulting from online fraud should be treated the same under the law. The right to a refund applies to unauthorized payments—that is, payment transactions that the account holder did not authorize.

If a victim has personally initiated a transfer to a fraudster, it must be determined separately whether valid consent was given and what claims exist. The term “phishing” alone does not answer this question. Legal basis: § 675j BGB

What should phishing victims do now?

If you notice a suspicious charge, you should act quickly:

• Notify the bank immediately: Report the transaction and explain if you did not authorize it.
• Secure Your Accounts: Have any affected online banking accounts and, if necessary, cards blocked.
• Keep your records: Save messages, bank statements, screenshots, and correspondence with the bank.
• Request a refund: Request a refund for the unauthorized charge, providing as much evidence as possible.
• Have the rejection reviewed: If the bank cites gross negligence, you should have its reasoning reviewed by a lawyer.

Do not delay in reporting the incident: The law requires immediate notification upon discovery. In addition, a 13-month statute of limitations generally applies, the start of which depends on the bank’s proper notification. This period is not a waiting period. Legal basis: Section 676b of the German Civil Code (BGB)

Bank Refuses to Reimburse You After a Phishing Attack? We'll Review Your Claim

Have you lost money due to phishing, and is your bank refusing to reimburse you? We'll investigate whether the payment was authorized, whether you're entitled to a refund, and whether the bank's objections are valid.

Contact us to have your case reviewed. We will help you assert your claims against the bank.