InfoSecBulletin Cybersecurity for mankind
Athanasios Rantos, Advocate General of the CJEU, said that banks should quickly refund account holders for unauthorized transactions, regardless of the account holders’ fault.
The opinion was issued in response to a request for a preliminary ruling submitted by the District Court in Koszalin, Poland, in a dispute between the PKO BP S.A. bank and one of its customers.
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
The case involved phishing fraud where a customer listed an item for sale on an auction site and was contacted by a fraudster who sent a malicious link mimicking the bank’s login page.
The customer shared their bank details on a site, and a fraudster used that information to make an unauthorized payment.
The victim reported the transaction to the bank and police the next day, but the fraudsters were not caught, and the bank denied the refund. In response, the customer sued the bank.
The dispute arose because the bank argued it could deny the refund if the customer’s negligence caused the loss.
Rantos claims that according to the EU Payment Services Directive (2015/2366/PSD2), banks must issue immediate refunds to victims unless they have valid reasons to suspect fraud.
“Advocate General Athanasios Rantos considers that EU law requires the bank, as a first step, to refund immediately the amount of the unauthorised transaction, unless it has good reason to suspect fraud, which it must communicate in writing to the competent national authority,” reads the CJEU press release.
The process doesn’t stop there; banks can still recover losses from customers if they show evidence of gross negligence or intent that led to the security breach.
“If the bank establishes that the customer has failed, intentionally or through gross negligence, to fulfil one of the obligations relating, in particular, to personalised security data, it may require the customer to bear the corresponding losses,” reads the AG’s opinion.
“If the customer refuses to reimburse the amount of the unauthorised transaction, it is up to the bank to take legal action against that person to obtain payment.”
This opinion is not a CJEU ruling; it suggests the court’s possible direction. The AG’s opinion is a legal recommendation for the CJEU judges, but the final ruling will be binding on all EU courts.
