N.O. v. PKO BP SA (Tukowiecka)

15 October 2026 – Court of Justice – C-70/25

Preliminary reference from Koszalin District Court (Poland) on payment service provider’s refusal to refund immediately unauthorised payment transaction on ground of payer’s gross negligence [17]. Payer victim of phishing entered online banking login details on website ‘spoofing her bank’s website’ and gave confirmation code obtained ‘as a result of that deceit’ [15]. Articles 73 and 74 ‘govern distinct aspects of the procedure for the refund’ [42]. Refusal precluded.

Gross negligence of payer

1.
Payer grossly negligent: Whether payment service provider can refuse to refund immediately ‘on the ground that that payer made that transaction possible through gross negligence’ [28] under Article 73(1) and Article 74(1) of Directive (EU) 2015/2366.
2.
Article 73(1) of Directive (EU) 2015/2366 (Payment Services Directive 2) on refund of unauthorised transactions interpreted literally: ‘wording of Article 73(1) of that directive provides for only one exception to the immediate refund obligation, namely the situation where the payment service provider has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing.’ [33] Merck, 292/82 and Veracash, C-665/23.
1. 2.1
  Recital 71 of Payment Services Directive 2 on fraud exception applied: Recital ‘seems to support the interpretation that the only exception to the immediate refund obligation is that expressly laid down in Article 73(1) of that directive.’ [39]
3.
Article 74(1) of Payment Services Directive 2 on payer’s liability interpreted literally: Wording ‘does not make it possible to determine unequivocally the scope of the derogation provided for therein.’ Derogation may concern ‘only the definitive nature of the refund’ [38].
4.
Payment Services Directive 2 interpreted systematically: ‘Article 73 of Directive 2015/2366 imposes on the payment service provider an obligation to refund that amount immediately, whereas Article 74 of that directive regulates the allocation of liability between that provider and the payer at a later stage’ [42].
1. 4.1
  Later claim against payer: Provider not precluded ‘from subsequently claiming from the payer, under the conditions laid down in Article 74(1) of that directive, the reimbursement of the losses relating to unauthorised payment transactions’ [46].
2. 4.2
  Article 72(2) of Payment Services Directive 2 on burden of proof applied: Provision ‘places on the payment service provider the burden of proving gross negligence on the part of the payer.’ [40]
3. 4.3
  Out-of-court procedure not circumvented: Article 102(1) mechanism ‘is not limited solely to the settlement of disputes relating to the immediate refund laid down in Article 73 of that directive, but extends to any type of dispute that falls under Titles III and IV thereof.’ [51]
5.
Payment Services Directive 2 interpreted purposively: Exemption from immediate refund would require the user ‘to take the initiative to assert his or her right, where appropriate, before the competent courts and to bear the resultant disadvantages, including the potential costs of the proceedings.’ [45] DenizBank, C-287/19 and Eurobank Bulgaria, C-409/22.
1. 5.1
  Payment Services Directive 2 interpreted historically: Article 60 of Directive 2007/64 ‘did not provide for any express exception to that obligation.’ Fraud exception introduced only in the legislative process, without allowing Member States other provisions under Article 107(1) [49]. CRCAM, C-337/20.
6.
Refusal of immediate refund precluded: ‘a payment service provider cannot refuse to refund immediately to a payer the amount of an unauthorised payment transaction on the ground that that payer made that transaction possible through gross negligence, in breach of his or her obligations under Article 69 of Directive 2015/2366.’