InfoSecBulletin Cybersecurity for mankind
Athanasios Rantos, Advocate General of the CJEU, said that banks should quickly refund account holders for unauthorized transactions, regardless of the account holders’ fault.
The opinion was issued in response to a request for a preliminary ruling submitted by the District Court in Koszalin, Poland, in a dispute between the PKO BP S.A. bank and one of its customers.
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
The case involved phishing fraud where a customer listed an item for sale on an auction site and was contacted by a fraudster who sent a malicious link mimicking the bank’s login page.
The customer shared their bank details on a site, and a fraudster used that information to make an unauthorized payment.
The victim reported the transaction to the bank and police the next day, but the fraudsters were not caught, and the bank denied the refund. In response, the customer sued the bank.
The dispute arose because the bank argued it could deny the refund if the customer’s negligence caused the loss.
Rantos claims that according to the EU Payment Services Directive (2015/2366/PSD2), banks must issue immediate refunds to victims unless they have valid reasons to suspect fraud.
“Advocate General Athanasios Rantos considers that EU law requires the bank, as a first step, to refund immediately the amount of the unauthorised transaction, unless it has good reason to suspect fraud, which it must communicate in writing to the competent national authority,” reads the CJEU press release.
The process doesn’t stop there; banks can still recover losses from customers if they show evidence of gross negligence or intent that led to the security breach.
“If the bank establishes that the customer has failed, intentionally or through gross negligence, to fulfil one of the obligations relating, in particular, to personalised security data, it may require the customer to bear the corresponding losses,” reads the AG’s opinion.
“If the customer refuses to reimburse the amount of the unauthorised transaction, it is up to the bank to take legal action against that person to obtain payment.”
This opinion is not a CJEU ruling; it suggests the court’s possible direction. The AG’s opinion is a legal recommendation for the CJEU judges, but the final ruling will be binding on all EU courts.
