Banks must refund money stolen by fraudsters from a card or account at once, even if they blame the client, EU court rules
If fraudsters trick someone into revealing passwords or codes and then transfer money from their account themselves, the bank must refund it immediately, even if it believes the client was grossly negligent. This was the ruling of the Court of Justice of the European Union (CJEU), and it is binding on Portuguese banks too (ECO).
The case began in Poland, where fraudsters obtained a bank customer's login details through phishing and transferred about €700. The bank refused to refund her, arguing that she had failed to keep her passwords safe. The EU court ruled that a client's negligence is not in itself a reason to refuse an immediate refund. A bank may delay a refund only if it suspects the client of fraud and informs the supervisory authority in writing. It is up to the bank to prove that the client was grossly negligent.
The bank can later demand the money back, but only if it proves the client was grossly negligent. In that case, lawyers warn, the client will have to repay both the amount and interest, and if the case goes to court and they lose, pay the legal costs as well.
The ruling applies only to transfers the client did not make themselves. If a fraudster persuades someone to send the money themselves, for example 'to a safe account', the transfer counts as authorised, and this ruling does not cover it.
If you notice a transaction on your account or card that you did not make, report it to your bank at once and ask for the money back: the bank cannot refuse an immediate refund just because it says it was 'your own fault'.
