EuGH Fraud Ruling: Banks Must Refund Phishing Victims, But Your Fees Will Pay for It

The Case That Broke the Bank’s Defense

Let’s rewind to the specifics. The Polish customer was selling something online when a scammer sent her a link disguised as a legitimate payment confirmation. She landed on a pixel-perfect fake of her bank’s website and entered her login details. The fraudster siphoned €700 to their own account.

The bank refused reimbursement, claiming she’d been grossly negligent. The case wound its way to Luxembourg, where the EuGH delivered a stinging rebuke to banks everywhere: Under Article 73 of the PSD2 directive, the EU’s Payment Services Directive, unauthorized payments must be refunded immediately, no later than the end of the next business day.

The only exception? If the bank has concrete reasons to believe you were the fraudster, and even then, they have to report that suspicion to authorities in writing.

That’s a massive shift. Previously, German banks could stonewall customers with the “grobe Fahrlässigkeit (gross negligence)” card and force them to sue. Now, as CLLB Rechtsanwälte explains, the burden flips: the bank pays first, argues later.

What the Court Actually Changed

Here’s where it gets interesting. The ruling doesn’t mean fraud victims are permanently off the hook. Banks can still sue customers afterward to recover the money, but they need to prove gross negligence in court. That’s a much higher bar than simply asserting it in a rejection letter.

Think of it like a parking ticket: the city can’t just refuse to let you drive until you prove your innocence. They fine you, you contest it, and they have to present evidence.

For consumers, this is genuinely transformative. The Verbraucherzentrale Bundesverband (Federation of German Consumer Organizations) has long criticized that banks use gross negligence claims to shut down legitimate claims, knowing most people won’t risk the court costs. A lawyer at CLLB put it bluntly: “Not the customer must sue to get their money back. Rather, the bank must first pay and then possibly proceed against the customer.”

The Uncomfortable Question: Who Actually Pays?

Now, the part that’s stirring up debate from Munich’s fintech meetups to Frankfurt’s bank towers: this protection isn’t free.

Banks aren’t charities. When they absorb fraud losses, those costs get redistributed. We’ve already seen German banks experimenting with everything from negative interest rates to fees on previously “free” current accounts. The Sentiment among many bank customers is clear: “I have no desire to subsidize Oma Inge transferring her entire retirement savings to a Nigerian prince.”

The numbers back the concern. Fraud isn’t a rare event, it happens daily, even at mid-sized banks. Victims regularly share their login details or confirm transactions in 2FA (two-factor authentication) because a “police officer” or “bank employee” on the phone told them to. And as one commentator noted, criminals keep using these tactics because they work.

Here’s the uncomfortable truth: banks will treat this ruling as a cost line item. That means higher Kontoführungsgebühren (account maintenance fees), increased charges for premium services, or reduced interest on savings. The European consumer protection framework that’s meant to protect the vulnerable might end up creating a system where the tech-savvy pay more to cover the digital-naive.

A Real-World Cautionary Tale

Before you roll your eyes at “greedy banks”, consider what a bank customer recently experienced when volunteering as treasurer for a small club (Verein). He needed online banking access for the club’s account, which supposedly required a second person to confirm transactions.

The bank sent him login credentials via mail, but to an address from 2010, because their system didn’t recognize the current postal code. No phone verification, no ID check against his Personalausweis (ID card). The letters containing his full login access could have gone to anyone.

When he complained, the bank’s response was essentially “you’re responsible for your address being correct.” Not a word of apology.

This is the reality: even in 2026, security measures at German banks are inconsistent. Some still rely on SMS TANs that security researchers have warned about for years. So when the EuGH says banks must be more accountable, it’s not entirely unreasonable, banks are making mistakes too, and the consequences are often borne by the customer.

What This Means for You

Here’s the practical part. If you’re living in Germany and ever find yourself as a phishing victim, your playbook just changed dramatically:

1. Report it immediately, time is money. The ruling requires banks to refund “promptly”, and delays on your end could suggest negligence.
2. Demand the refund in writing. If the bank refuses, cite the EuGH ruling (case C-70/25). That piece of paper is your legal sword.
3. Don’t accept compromise offers. Before this ruling, banks could pressure victims into accepting 50-70% of their losses. Those days are over, at least until banks figure out their next trick.
4. Watch your account fees. Over the next 12-18 months, pay attention to how your bank adjusts pricing. If your Sparkasse or Volksbank suddenly introduces new fees, you’ll know why.

There’s even a deadline angle here. Claims from 2023 that were previously rejected may still be recoverable, but the Verjährungsfrist (statute of limitations) looms, many claims expire on December 31, 2026. If a bank denied you reimbursement in 2023, you might have weeks, not months, to act.

The Moral Dilemma We Can’t Ignore

This ruling touches a cultural nerve in Germany. There’s a deeply held belief in Eigenverantwortung (personal responsibility) that clashes with the protective welfare state model. The comments on initial coverage of this ruling show how polarized people are:

Some argue banks should absolutely bear liability, they’re the ones deploying security systems that are sometimes laughably weak. Others insist that adults should know better than to hand their passwords to strangers over the phone.

The truth sits somewhere in between. Yes, some fraud victims are willfully naive. But as one commenter pointed out, the real issue is that “even legitimate companies” train customers to click links in emails, and financial scams have gotten scarily sophisticated. KI-generated phishing emails and deepfake voice calls are becoming indistinguishable from real communications.

The Bottom Line

This EuGH ruling is a genuine consumer victory, but it’s a pyrrhic one. The costs won’t vanish, they’ll be socialized across all bank customers. As this breakdown of collective consumer actions in Germany shows, individual wins often trigger systemic adjustments.

The 80-year-old who falls for a fake police officer call will get her money back. The 35-year-old tech professional will likely see higher banking fees or reduced interest rates to fund that protection. It’s the same pattern we see with credit scoring and financial access, protections for some inevitably cost others.

For anyone living in Germany, the practical takeaways are clear: keep your security practices tight, document everything if you become a victim, and don’t expect banks to become more lenient on fees. They’ve just been handed a bill, and trust me, they’ll find a way to pass it along.

The German banking system operates with the same efficiency as a Deutsche Bahn train, usually impeccable, until suddenly it isn’t. And when it fails, you now have the right to get your money back fast. Just be prepared to pay for that right in other ways.