Financial fraud is currently one of the fastest-growing forms of crime in Europe. Phishing emails, fake bank messages, scam calls, and social engineering schemes swindle millions of euros from consumers every year.
In practice, the same scenario often plays out in such situations: the bank refuses to compensate for the lost funds, arguing that the customer “disclosed the information” themselves and must therefore bear the financial consequences.
However, there is a growing trend in European Union law to change this practice. A recently published opinion by the Advocate General of the Court of Justice of the European Union addresses an important question: can a bank refuse to immediately refund a customer for an unauthorized payment solely on the grounds that it suspects the customer of gross negligence?
The Advocate General’s proposed answer is quite clear and unequivocal.
According to his conclusion, the bank must immediately refund the amount of the unauthorized transaction to the customer, and only then may it determine whether the customer acted with gross negligence.
In other words, the logic of the legislation is as follows: first, the protection of consumers’ money must be ensured, and only then is the issue of liability allocation addressed.
In his opinion, the Advocate General emphasizes that European Union legislation has deliberately sought to put an end to the practice whereby payment service providers refuse to refund funds on the grounds of alleged improper conduct on the part of the customer. Such practices often forced consumers to take legal action themselves in order to recover their money.
That is precisely why the Payment Services Directive stipulates that:
- the payment service provider must immediately refund the amount of the unauthorized transaction;
- If the service provider believes that the customer acted in bad faith or with gross negligence, the service provider must prove these circumstances and, if necessary, seek compensation through the courts.
This means that the financial risk falls primarily on the bank or other payment service provider, rather than on the consumer.
If the Court of Justice upholds this conclusion, it will fundamentally change the practical approach to fraud disputes. Until now, in most cases, consumers have had to prove themselves that they were not at fault for the lost funds. This often meant lengthy disputes with the bank or even litigation in court.
Under the interpretation proposed by the Advocate General, the situation would be different: consumers would not have to spend years in court fighting for their money. The bank would be required to compensate for the loss first, and if it believes that the customer acted with extreme negligence, it would have to prove those circumstances itself.
This logic is also consistent with a general principle of European payment law: the consumer is considered the weaker party in the relationship, and therefore the payment system must ensure a high level of protection for the consumer. Under the PSD2 Directive, the payment service provider is generally liable for unauthorized transactions, except in cases where the consumer acted fraudulently or with gross negligence.
However, even in such cases, the burden of proof lies with the bank.
This case is not an isolated incident. There is growing discussion in European legislative circles about the need to strengthen consumer protection in cases of financial fraud. The European Commission is already proposing new payment regulation rules that would, in certain cases, hold payment service providers liable even in cases of so-called“authorized push payment”fraud—where the customer authorizes the payment themselves but does so after being misled by a fraudster.
This points to a clear regulatory direction: the fintech and payments sector must play a more active role in fraud prevention and assume a greater share of the risk.
A Signal for Lithuania
The number of financial fraud cases in Lithuania is skyrocketing. Disputes between banks and customers over lost funds are also not uncommon. Therefore, the European Court of Justice’s ruling in this case could have very real implications for Lithuanian legal practice.
If the Court agrees with the Advocate General’s opinion, it will become significantly more difficult for banks across Europe—including in Lithuania—to refuse to compensate victims of fraud for their losses. This would mark a significant shift: in the financial services market, the center of responsibility is gradually shifting from the individual consumer to the institutions that manage the payment infrastructure.
Laurynas Staniulis
Partner at the law firm AVOCAD, attorney