Unauthorised payment refund: gross negligence is no reason to delay
In short: an unauthorised payment refund cannot be withheld because the bank thinks the customer was grossly negligent. The Court of Justice of the European Union held on 15 October 2026 that the payer’s provider must refund by the end of the next business day, and may recover the loss later only if it proves the negligence. Regulation 76 of the Payment Services Regulations 2017 requires a UK provider to refund on the same timetable.
A customer who follows a phishing link and enters her online banking credentials on a fake site may have been careless, perhaps grossly so. Her bank must still refund the stolen payment by the end of the next business day and pursue any claim about her carelessness afterwards. That is the effect of the judgment of the Court of Justice of the European Union in Case C-70/25 Tukowiecka, given on 15 October 2026. UK payment service providers are under the same refund-first duty, and the Financial Conduct Authority (FCA) already expects them to meet it.
The facts and the question referred
A customer selling an item on an online auction site followed a link from a supposed buyer to a copy of her bank’s website and entered her login details. The fraudster used them, with a text-message confirmation code also obtained from her, to transfer 3,000 zloty (about 705 euros) to his own account. She reported the fraud to the bank and the police the next day. Her Polish bank refused to refund, relying among other things on her gross negligence in failing to keep her payment instrument safe (paragraphs 15 to 17).
The District Court in Koszalin asked whether Articles 73(1) and 74(1) of the second Payment Services Directive (PSD2, Directive (EU) 2015/2366) allow a provider to refuse an immediate refund on that ground. The referring court treated the payment as unauthorised, because the fraudster and not the customer initiated it. Scams in which the victim is deceived into making the payment herself fall under the separate regimes compared in scam reimbursement in the UK, the EU and Australia.
What the Court of Justice held on the refund duty
The Court held that a payment service provider may not refuse to refund the payer immediately on the ground that the payer made the unauthorised transaction possible through gross negligence (paragraph 52). Under Article 73(1) PSD2 the provider must refund immediately, and in any event by the end of the following business day. The Court found only one exception in that text, where the provider has reasonable grounds to suspect fraud and communicates those grounds in writing to the national authority, and held that suspected gross negligence does not fall within it (paragraphs 33 and 34).
Under Article 74(1) the payer bears all losses caused by fraud or by an intentional or grossly negligent failure to meet the obligations in Article 69, including the duty to keep personalised security credentials safe. The Court held that Article 73 imposes the immediate refund and that Article 74 allocates the loss between provider and payer at a later stage (paragraph 42). A provider that considers the payer grossly negligent must refund first and may then claim the loss back, and Article 72(2) puts the proof of gross negligence on the provider (paragraphs 40 and 46).
The Court reasoned that a refusal at the outset would deprive the refund duty of its effect and leave the consumer to sue at her own cost, which it found hard to reconcile with a high level of consumer protection (paragraph 45). It noted that the first Payment Services Directive had no express exception to immediate refund, and that the fraud exception was added during the legislative process that produced PSD2 (paragraph 49).
The UK unauthorised payment refund rule in regulation 76
Subject to the notification and evidence rules in regulations 74 and 75, a UK payment service provider must refund an executed payment transaction that the payer did not authorise and restore the account (regulation 76(1) of the Payment Services Regulations 2017 (PSRs 2017)). It must refund as soon as practicable and by the end of the business day after it becomes aware of the transaction (regulation 76(2)). The provider is released from that deadline, though not from the duty to refund, only where it has reasonable grounds to suspect fraudulent behaviour by the customer and notifies a person mentioned in section 333A(2) of the Proceeds of Crime Act 2002, such as a constable or a nominated officer, in writing (regulation 76(3)).
Gross negligence plays no part in regulation 76; it matters when the provider seeks to recover the loss. Under regulation 77(3) the payer is liable for all losses where she has, with intent or gross negligence, failed to comply with the security obligations in regulation 72, subject to the exceptions in regulation 77(4), for example for losses after she reported the problem or where strong customer authentication was required and not applied. Under regulation 75(3), a record of the use of the payment instrument is not in itself necessarily enough to prove gross negligence, and under regulation 75(4) a provider that alleges it must give the payer the supporting evidence.
The FCA reads regulation 76 as the Court reads Article 73. In its Approach Document on payment services and electronic money (version 8, May 2026), the FCA states that where a provider has no reasonable grounds to suspect fraud by the customer, for example where the customer may have been grossly negligent, it must still refund by the end of the next business day and continue any investigation after the refund (paragraph 8.208). If the provider later proves the customer liable, it can reverse the refund on reasonable notice (paragraph 8.210). The FCA puts the burden of proving gross negligence, which it describes as a very significant degree of carelessness, on the provider (paragraphs 8.221 and 8.222).
A UK court is not bound by Court of Justice decisions made on or after 31 December 2020 at 11pm, the end of the Brexit implementation period, but may have regard to them so far as they are relevant (section 6(1) and (2) of the European Union (Withdrawal) Act 2018). The wording differs in detail, for example “as soon as practicable” in regulation 76(2) where Article 73(1) says “immediately”, but the structure is the same, so a UK court may find the judgment persuasive.
| Question | EU: PSD2 as read in C-70/25 | UK: PSRs 2017 | EU: proposed Payment Services Regulation, compromise text of 17 April 2026 (not adopted) |
|---|---|---|---|
| Deadline for the refund | Immediately, and by the end of the following business day (Article 73(1)) | As soon as practicable, and by the end of the business day after the provider becomes aware (regulation 76(2)) | Immediately, and by the end of the following business day (Article 56(1)) |
| Grounds on which the provider is relieved of the refund deadline | Reasonable grounds to suspect fraud, communicated in writing to the national authority (Article 73(1)) | Reasonable grounds to suspect fraudulent behaviour by the customer, notified in writing under section 333A(2) POCA; the duty to refund remains (regulation 76(3)) | Objectively justified reasons to suspect an intentional or grossly negligent breach of the payer’s security obligations, given to the payer in writing, or reasons to suspect fraud by the payer (Article 56(1)) |
| Suspected gross negligence as a ground to hold the refund | No (paragraphs 33, 34 and 52) | No (regulation 76(2) and (3); FCA Approach Document, paragraph 8.208) | Yes, with 15 business days to refund or justify a refusal (Article 56(2)) |
| Payer’s liability for gross negligence | All losses, recovered after the refund (Article 74(1)) | All losses, subject to the exceptions in regulation 77(4) (regulation 77(3)) | Refund may be refused, with the reasons and the complaint routes given to the payer (Article 56(2)(b)) |
The proposed EU Payment Services Regulation would change the rule
Under Article 56(1) of the final compromise text of the proposed EU Payment Services Regulation, dated 17 April 2026 (Council document 8221/26), a provider would be able to delay the refund where it has objectively justified reasons to suspect that the payer failed, with intent or gross negligence, to meet the security obligations in Article 52, and tells the payer so in writing. Under Article 56(2) it would then have 15 business days to refund or to justify a refusal and point the payer to the complaint routes. PSD2, as the Court has now read it, allows no such ground.
The Regulation has not been adopted. On 15 October 2026 the European Parliament’s Legislative Observatory recorded the file as awaiting the Council’s first-reading position, with an indicative plenary date of 14 December 2026. Under Article 112 of the compromise text most of it would apply 21 months after entry into force, and article numbers may change before publication.
Implications for UK payment service providers
A UK bank, e-money institution or payment institution that holds an unauthorised payment refund while its fraud team decides whether the customer was grossly negligent does not comply with regulation 76(2), unless it suspects fraud by the customer and has made the written notification that regulation 76(3) requires. When the Financial Ombudsman Service decides what is fair and reasonable, it takes into account the law and regulations, and the regulators’ rules and guidance, that applied at the time (DISP 3.6.4R); here those include regulation 76 and paragraph 8.208 of the Approach Document.
A provider that wants to recover under regulation 77(3) has to prove gross negligence with evidence of the customer’s conduct, gathered while the refund is in place, and needs a process for reversing the refund on reasonable notice. The wider rules on authorisation and liability are explained in PSRs 2017 explained: payment authorisation and liability, and a review of unauthorised transaction procedures falls within the payments product, safeguarding and scheme governance service.
If the EU Regulation is adopted in its negotiated form, a provider with UK and EU customers that held back a refund on suspected gross negligence would comply with Article 56 in the EU and breach regulation 76(2) in the UK.
Viewpoint
I read the judgment as the right answer on the text, and the FCA’s guidance already said as much before the Court ruled. HM Treasury has not said whether the UK will keep the refund-first model. Its consultation on modernising payment services regulation, which closed on 6 October 2026, asked how regulation should adapt to agentic payments and whether the provisions on liability for unauthorised payment transactions need updating (question 15).
Under the negotiated EU text a provider could keep the money for up to 15 business days while it decides whether the customer was grossly negligent. Under the UK rule the money goes back to the customer and the cost of a dispute about negligence falls on the provider, which is better placed than a consumer to bear it.
Frequently asked questions
Can a UK bank refuse an unauthorised payment refund because the customer was grossly negligent?
Not at the outset. Regulation 76(2) of the Payment Services Regulations 2017 requires a refund by the end of the business day after the provider becomes aware of the unauthorised transaction. The deadline is lifted only where the provider suspects fraud by the customer and notifies under section 333A(2) of the Proceeds of Crime Act 2002. The provider may recover the loss later under regulation 77(3) if it proves gross negligence.
What did the Court of Justice decide in Case C-70/25?
On 15 October 2026 the Court held that Articles 73(1) and 74(1) of PSD2 do not allow a payment service provider to refuse to refund an unauthorised transaction immediately on the ground that the payer made it possible through gross negligence. The provider must refund first and may then seek to recover the loss, proving the negligence.
Does the judgment bind UK courts?
No. Under section 6(1) of the European Union (Withdrawal) Act 2018 a UK court is not bound by Court of Justice decisions made on or after the end of the Brexit implementation period on 31 December 2020. Under section 6(2) it may have regard to them. Regulation 76 closely follows the PSD2 text the Court construed, and the judgment is consistent with paragraph 8.208 of the FCA’s Approach Document.
Will the EU rule change?
It would, if the proposed Payment Services Regulation is adopted in its negotiated form. Under Article 56 of the final compromise text of 17 April 2026, a provider would be able to hold back the refund where it has objectively justified reasons to suspect gross negligence, and would have 15 business days to refund or justify a refusal. The Regulation has not yet been adopted.
For advice on unauthorised transaction refunds and liability under the Payment Services Regulations 2017, contact Rob Bratby at Bratby Law.
