EU Court of Justice: after phishing, the bank refunds first and argues about the customer's 'gross negligence' later. What to do in France if money leaves your card or account, and the deadlines that apply

What happened

On 2 November 2026, Service-public.gouv.fr published an explainer on a ruling by the Court of Justice of the European Union (CJUE) of 15 October 2026 on refunds for phishing victims.

The case comes from Poland. A woman was selling an item on an online marketplace. A fake buyer sent her a link that looked like the marketplace and led her to a fake copy of her bank's website, where she typed in her online-banking login. The fraudster moved about €700 (3,000 zlotys) to his own account, obtaining the SMS confirmation code through the same fake page. She reported the fraud to her bank and to the police the next day. The bank refused to refund her, arguing she had been grossly negligent (négligence grave) and had failed to keep her payment instrument safe.

What the court decided

According to Service-public, the court relied on the EU Payment Services Directive (2015/2366):

• the bank must refund an unauthorised transaction as soon as it learns of it, and no later than the end of the next business day. The customer's gross negligence is not among the grounds for refusing;
• the bank may shift the loss onto the customer, but only after refunding. The exception is a serious suspicion that the customer is the fraudster, which the bank must justify in writing to the national supervisory authority;
• it is for the bank to prove gross negligence, in court, if it decides to claim the money back.

In short: refund first, argue later. In French law, the immediate refund of an unauthorised transaction is set out in Article L133-18 of the Code monétaire et financier, which the National Consumer Institute (INC) cites.

The key caveat: 'unauthorised' transactions

The ruling covers transactions the payer did not consent to: a fraudster gained access to the card or account and took the money. It does not cover so-called 'authorised' fraud, where the victim makes the transfer themselves under pressure, for example from a fake 'bank adviser'. Keep this distinction in mind from the first minute: it decides which rules you can rely on.

What to do if money has gone

The steps below follow the Service-public page F34800 and the INC:

1. Block the card straight away (faire opposition): through your bank's number or the interbank line 0892 705 705 (€0.35 per minute plus the cost of the call). The INC then recommends confirming the block by registered letter with acknowledgement of receipt, quoting the block reference number.
2. Dispute the transactions with the bank and ask for a refund. Keep the reference number.
3. Keep the evidence: the message itself, a screenshot of the fake site, the phone number, the page address.
4. Report it on the Perceval platform (via service-public.fr, logging in with FranceConnect) if card details were used without the holder's knowledge. The platform issues a receipt to attach to the refund request to the bank. Perceval does not handle theft of the physical card.
5. File a complaint (plainte) at a police station or gendarmerie, or in writing to the public prosecutor.
6. Check other online accounts, change passwords and turn on two-factor authentication.

Phishing attempts by SMS or call to a mobile phone can be reported to 33 700; suspicious emails to Signal Spam; suspicious links to Phishing Initiative.

Deadlines in France

According to the INC (Articles L133-18, L133-23 and L133-24 of the Code monétaire et financier):

• you must act 'without delay' once you discover the transaction, and no later than 13 months after the debit for payments within the European Economic Area. For a payment outside it, the limit is 70 days, which a contract can extend to 120;
• the bank must refund not only the amount but also related costs, including overdraft interest and payment-incident fees;
• if the customer, deliberately or through gross negligence, failed to meet their obligations, there may be no refund, but it is the bank that must prove it. The INC gives an example: in 2020 the Cour de cassation held that replying to an email with obvious signs of forgery was gross negligence.

A common mistake is to wait for the bank 'to sort it out', or not to dispute a transaction at all on the assumption that one's own slip rules out a refund. The EU ruling says precisely that such a slip does not, on its own, allow the bank to hold back the refund. These are general rules, not an assessment of any individual situation; in a disputed case, a lawyer or a consumer association can help.

Background

For newcomers the risk is higher: messages about a 'refund', an 'urgent payment', a 'parcel delivery problem' or an 'account security alert' arrive in a language they are still getting used to, which makes fakes harder to spot. Service-public's advice is simple: don't click links, and don't share personal or bank details in reply to an unexpected message.