Banks must reimburse customers who lose money to fraud, such as phishing, straight away, even if the customer was seriously negligent, the European Court of Justice in Luxembourg ruled on Thursday 15 October.
A bank can then try to recover the loss from the customer, but it must show that the customer failed to meet their obligations intentionally or through gross negligence.
In practice, the ruling means the bank pays first, and the burden of proving the customer was at fault lies with the bank.
How the case reached the court
The case involved a customer of a Polish bank who was tricked on a sales website into clicking a link to a page that looked very much like her bank’s own site.
After the phishing attack, €700 disappeared from her account, and the bank refused to refund the money.
She took the dispute to a Polish court, which referred the case to the European Court of Justice.
If the phishing case has you thinking about the bank that holds your own money here, start with how banking works for internationals in Amsterdam.