European Court Orders Immediate Bank Refunds For Phishing Victims
Victims of phishing must not be scammed one more time by bad legislation, De Standaard reported after the Court of Justice of the European Union ruled that banks must immediately refund unauthorized transfers. The October 15 ruling in case C-70/25 mandates that financial institutions return stolen funds by the end of the next business day, even when gross negligence is suspected.
The European ruling stems from a case involving a Polish customer who lost approximately 700 euros through a forged banking website, according to ITdaily. Under the court’s interpretation, banks must issue the refund first and only later pursue legal action to recover the funds if they can prove gross negligence. The sole exception is a reasonable suspicion of direct customer fraud.
Federal Government Approves Fifteen-Day Investigation Window for Banks
Just one day after the European court decision, the Belgian federal government approved a draft bill granting banks fifteen business days to investigate suspected gross negligence, De Tijd reported. Conceived by Minister of Economy David Clarinval and Minister of Consumer Protection Rob Beenders, the text allows institutions to temporarily withhold refunds if they possess objectively justified reasons to suspect customer intent or severe carelessness.
The Belgian legislation clashes with the existing European Payment Services Directive (PSD2) upon which the court based its verdict. Government officials designed the measure to anticipate the upcoming European Payment Services Regulation (PSR), which is not scheduled to take effect until the second half of 2028. The Council of State must now review whether Belgium can legally deviate from current European directives before the bill proceeds through a second governmental reading and parliamentary approval.
Shifting Burden of Proof and New Rules for Unauthorized Bank Transactions
The draft legislation strengthens protections by defining any transaction as unauthorized if a fraudster initiates or alters it without the payer’s consent, regardless of whether security codes were shared. This protection extends to payments originating from a banking app on a criminal’s device, provided the customer did not personally confirm each individual transfer using authentication tools like Itsme. The bank bears the full burden of proving that a customer consented, committed fraud, or acted with gross negligence.
Financial institutions cannot draw legal conclusions from a silent customer or demand proof that the account holder does not reasonably possess, such as private telephone recordings. Invoice fraud and scams where victims willingly execute transfers themselves remain categorized as authorized transactions without an automatic right to reimbursement. Meanwhile, the Antwerp Court of Appeal recently held bank KBC fully liable for a Wilrijk school group’s 44,300-euro phishing loss, and Ombudsfin has started publishing its fraud advice alongside the names of dissenting banks and their specific refusal motivations.
Frequently Asked Questions About Phishing Refunds
Which phishing victims qualify for the immediate bank refunds under the European Court ruling?
Customers who lose funds through unauthorized transfers where they did not give explicit consent qualify for next-day refunds. The European Court of Justice established this right on October 15, 2025, in case C-70/25 following a case involving a forged Polish bank website.
How does the new Belgian draft bill alter the European refund mandate?
The federal bill introduced by ministers David Clarinval and Rob Beenders gives banks fifteen business days to investigate transactions when they have objectively justified reasons to suspect gross negligence or intent, temporarily pausing the immediate refund window.
Are victims of invoice fraud or voluntary money transfers protected by these rules?
No, invoice fraud and scams where victims manually execute money transfers themselves remain classified as authorized transactions, meaning consumers have no legal right to an automatic refund for those specific incidents.
Keep reading