Banks in Spain must refund unauthorised payments even if customers were careless, EU court rules

So you’ve clicked a link that looks exactly like your bank’s website, and by the time you’ve realised what’s happened, your money’s gone. Now, the EU’s top court has said banks can’t leave you out of pocket while they argue if it was your own fault or not.

Banks can’t use blame to delay a refund 

Customers who have money taken from their accounts without their permission must be refunded straight away, even if the bank believes they were careless, the Court of Justice of the European Union (the EU’s top court) ruled on Thursday October 15.

The case began with a Polish woman who was selling something online. A fake buyer sent her a link to a copy of her bank’s website, and after she typed in her login details and passed on a code sent by text message, the fraudster moved about €700 out of her account. Her bank refused to pay it back, saying she’d been seriously careless with her security details. However, the court said a bank can’t hold back a refund just because it has decided the customer was to blame.

The deadline is the end of the next working day

The refund has to come immediately, and no later than the end of the business day after the bank finds out about the payment or is told about it. That’s different from the “24 hours” some reports have used, so a payment reported on a Friday afternoon wouldn’t need to be refunded over the weekend. 

Spain already has this in its payment services law, so banks here were meant to refund by the next business day anyway. What the ruling adds is that an argument over negligence can’t be used to delay that first refund.

The bank can still try to claw it back

A refund isn’t always the end of the story though. Once it has paid, the bank can try to recover the money if it proves the customer acted deliberately or with gross negligence, and the burden of proving that falls on the bank.

There’s also one exception to paying out straight away. If the bank has reasonable grounds to suspect the customer is behind the fraud, it can hold back, but it has to put those reasons in writing to the national authority, which in Spain is the Banco de España.

Not every scam is covered

The ruling is about unauthorised payments, where the scammer moves the money rather than you. That means it doesn’t promise a refund for every transfer made after being tricked.

Spain’s Supreme Court has also said banks must prove customers were seriously negligent, in a case where an Ibercaja customer lost more than €83,000 in one night.

What to do if your account is hit

Tell the bank as soon as you notice, and do it in writing through a channel you can trace, such as your online banking messages, an email, or a phone call where you’re given a reference number. Keep screenshots of the messages and the payments too.

If the bank refuses, you can complain to the Banco de España’s complaints service, and consumer groups OCU and Facua can point you in the right direction. So if it happens to you, report it in writing straight away and ask when the refund will arrive.