Online Fraud and Unauthorised Payments: the bank Reimbursement Must Be Immediate, Even Where the Customer Is Alleged to Have Been Grossly Negligent
The spread of online fraud has led to an increasing number of disputes concerning bank transfers, cash withdrawals and payments carried out using credentials obtained through phishing, smishing or vishing techniques.
Against this background, the judgment of the Court of Justice of the European Union referred to in the article under review — Case C-70/25 — introduces an important clarification: a payment service provider may not refuse immediate reimbursement of an unauthorised payment transaction merely because it considers that the customer acted with gross negligence.
Gross negligence may be relevant, but at a later stage and according to a logic distinct from that governing the initial reimbursement.
The principle: reimbursement first, final determination of liability afterwards
Article 73 of the Payment Services Directive, or PSD2, provides that, in the event of an unauthorised payment transaction, the payment service provider must refund the payer the amount of the transaction “immediately and in any event no later than by the end of the following business day” after noting or being notified of the transaction.
European law provides for only one exception: the provider may suspend reimbursement where it has reasonable grounds for suspecting fraud committed by the customer and communicates those grounds in writing to the relevant national authority.
Italian law transposes this rule in Article 11 of Legislative Decree No. 11 of 2010. The provider must refund the amount of the unauthorised payment transaction “immediately and in any event no later than by the end of the following business day” after becoming aware of the transaction or receiving notice of it. The account must also be restored to the position in which it would have been had the payment transaction not taken place.
The systemic consequence is significant: the bank may not turn the reimbursement stage into a preliminary assessment of the customer’s conduct. The allegation of gross negligence does not, in itself, remove the obligation to reimburse immediately.
This does not mean, however, that the customer is always and definitively released from the loss. The system distinguishes between two issues:
the customer’s right to receive prompt reimbursement;
the determination, at a later stage, of the party that must ultimately bear the loss.
The provider may therefore reimburse the customer and subsequently seek repayment of the sum if it proves that the transaction was made possible by the user’s intentional or grossly negligent conduct.
Immediate reimbursement does not amount to a final determination
The distinction between reimbursement and final liability is already consistent with the structure of Italian law.
Article 11(3) of Legislative Decree No. 11 of 2010 provides that reimbursement does not prevent the provider from subsequently proving that the payment transaction was authorised. In that event, the provider is entitled to claim directly from the user repayment of the amount reimbursed.
The mechanism does not therefore impose automatic and definitive liability on the bank for every disputed transaction. It does, however, prevent the financial risk from being initially shifted to the customer through a unilateral refusal to reimburse.
The solution serves a clear protective purpose: if it were sufficient for the bank merely to assert that it suspected gross negligence, the customer would be forced to commence legal proceedings to obtain what the law grants immediately. The obligation to reimburse would thereby lose much of its effectiveness.
The use of credentials does not, by itself, prove authorisation
One of the most important aspects of the regulatory framework concerns the burden of proof.
Under Article 10 of Legislative Decree No. 11 of 2010, where the user denies having authorised a transaction, the provider must prove that the transaction was authenticated, correctly recorded and accounted for, and that it was not affected by a malfunction or other deficiency.
The same provision states that the mere use of the payment instrument recorded by the provider is not, in itself, necessarily sufficient to prove that the transaction was authorised by the user or that the user acted fraudulently, intentionally or with gross negligence. The provider also bears the burden of proving those circumstances.
The distinction is fundamental:
authentication shows that the technical procedure provided for by the system was used;
authorisation concerns the user’s actual consent;
gross negligence concerns a serious breach of the obligations to safeguard and use the payment instrument.
A bank transfer carried out after the entry of a username, password and one-time password may be technically authenticated without having been actually authorised by the account holder. This is precisely what occurs in fraud involving manipulation of the user, where the customer is induced to provide data to a person falsely presenting themselves as a bank, an online marketplace or an anti-fraud service.
The customer’s obligations and the relevance of gross negligence
The user must use the payment instrument in accordance with the contractual terms and take all reasonable steps to protect personalised security credentials. The user must also notify the provider without undue delay of the loss, theft, misappropriation or unauthorised use of the instrument.
These obligations are laid down in Article 7 of Legislative Decree No. 11 of 2010.
An intentional or grossly negligent breach of those obligations may result in the customer bearing the entire loss. Article 12 of Legislative Decree No. 11 of 2010 provides that, in cases of fraud, intent or gross negligence, the ordinary limit on the user’s liability does not apply.
In other cases, the payer’s liability may be limited to the loss resulting from the unauthorised use of the instrument, up to the statutory maximum.
Gross negligence does not, however, amount to every mistake or instance of imprudence. It requires conduct of a qualified nature, incompatible with the minimum level of care reasonably expected in the circumstances. It cannot be inferred automatically from the mere fact that fraudsters obtained possession of the credentials.
The position of the Italian Supreme Court: phishing risk is part of banking activity
The case law of the Italian Supreme Court has long treated the fraudulent theft of access codes as falling within the sphere of the bank’s professional risk.
In one of its leading decisions, the Italian Supreme Court, Civil Division, judgment No. 2950 of 2017, held that the possibility of codes being stolen through fraudulent techniques forms part of the institution’s business risk. The bank must therefore adopt measures capable of verifying, before execution, that the transaction can be attributed to the customer’s will.
It is not sufficient, therefore, to rely on the abstract possibility that the account holder acted imprudently. It is necessary to establish concretely whether the transaction can be attributed to the customer’s will and whether the conduct amounted to intent or gross negligence.
The same approach was reaffirmed by the Italian Supreme Court, Civil Division, order No. 32075 of 2021, which criticised a decision on the merits that had placed on the customer the burden of proving a breach of the bank’s computer system. According to the Court, the bank must prove that the transaction is attributable to the customer, in light of the technical standard of care expected of a prudent banking professional.
In similar terms, the Italian Supreme Court, Civil Division, order No. 13204 of 2023, held that the customer is not required to prove that they used the computer system diligently. The provider must prove that the transaction is attributable to the user’s will, unless the use of the codes is attributable to intentional conduct or conduct so reckless that it could not have been prevented by measures normally expected of the provider.
Phishing does not automatically establish gross negligence
Recent case law shows that the assessment must be conducted on a case-by-case basis.
The Italian Supreme Court, Civil Division, judgment No. 3780 of 2024, classified phishing among the typical risks of banking activity and required the bank to prove that it had adopted solutions capable of preventing or reducing fraudulent use of the system.
According to the Court, the bank may not limit itself to proving that the credentials were used correctly. It must also show that the harmful event fell outside the safeguards reasonably required in the circumstances and that the customer’s conduct reached the threshold of gross negligence.
The Italian Supreme Court, Civil Division, order No. 16417 of 2022, further held that a merely abstract allegation of a breach of precautionary rules is insufficient. The bank must prove, in concrete terms, the account holder’s intentional or grossly negligent conduct.
The same logic emerges from the Italian Supreme Court, Civil Division, order No. 9721 of 2020, which placed on the bank the burden of proving the correct execution of the transaction, the absence of technical anomalies and the fact that the instruction was attributable to the customer’s will.
The courts on the merits: the specific conduct is what matters
Recent decisions of the courts on the merits confirm that there is no uniform answer for every phishing case.
The Court of Venice, judgment No. 5581 of 2025, excluded the customer’s gross negligence where the customer had clicked on a fraudulent link but the bank had failed to prove that the customer had also disclosed the one-time password required to complete the transaction. Merely accessing the link was not considered sufficient to attribute the entire loss to the customer.
A different conclusion was reached by the Court of Santa Maria Capua Vetere, judgment No. 149 of 2026, which found gross negligence in the voluntary disclosure to third parties of credentials and dynamic authorisation codes, giving weight to the user’s specific conduct and its causal contribution to the execution of the bank transfer.
The Court of Bologna, judgment No. 2540 of 2026, also attached importance to the adequacy of the alerts sent by the bank. According to that decision, the intermediary must prove not only that the system functioned correctly, but also that the security communications were sufficiently clear and effective to enable the customer to understand the risk and take timely countermeasures.
It follows that the assessment of gross negligence requires an overall examination of several factors:
the content of the fraudulent message;
the degree of sophistication of the fraud;
the customer’s conduct before and after the transaction;
whether passwords, one-time passwords or other codes were disclosed;
the content of the alerts sent by the intermediary;
the amount and destination of the transaction;
the presence of anomalies compared with the ordinary operation of the account;
the time taken to notify the bank;
the security measures actually adopted by the provider.
Prompt notification remains essential
The right to reimbursement presupposes that the customer reports the unauthorised transaction without undue delay and, in any event, within the maximum period of thirteen months from the debit, pursuant to Article 9 of Legislative Decree No. 11 of 2010.
The Court of Justice has distinguished the subjective requirement of notification without undue delay from the objective thirteen-month time limit. In its judgment No. 598 of 2025, the Court clarified that mere compliance with the thirteen-month period does not exclude an assessment of delay, but that loss of the right to reimbursement because of late notification requires intentional conduct or gross negligence.
In practical terms, the customer should therefore:
immediately block the payment instrument;
formally dispute each individual transaction;
preserve messages, emails, telephone numbers and screenshots;
file a report with the police or other competent law-enforcement authority;
request from the bank the technical documentation relating to authentication and security alerts;
avoid relying solely on an undocumented telephone notification.
Prompt action does not by itself resolve the dispute, but it prevents the customer’s conduct after discovering the fraud from becoming a further factor against them.
The European approach strengthens, but does not eliminate, customer liability
The principal significance of the European ruling does not lie in excluding the relevance of gross negligence. The PSD2 and Legislative Decree No. 11 of 2010 continue to provide that the customer may be required to bear the entire loss where they acted fraudulently or breached their security obligations intentionally or with gross negligence.
The significance lies in the point in time at which that issue must be addressed.
The bank may not refuse immediate reimbursement on the basis of its own unilateral and as yet unproven assessment. It must first comply with the restitution obligation, except where there is a justified suspicion of customer fraud that has been communicated in writing to the competent authority. The bank may then assert the customer’s liability by proving the relevant conduct and the causal link with the loss.
The principle produces a rebalancing effect between the parties: the bank retains the possibility of defending itself and bringing a recovery claim, but the customer is not required to bear the costs and delays of litigation in order to obtain reimbursement of an amount that the law grants immediately.
Practical consequences for banks and customers
For intermediaries, the ruling requires greater attention to the distinction between:
correct technical authentication;
actual authorisation of the transaction;
any gross negligence on the part of the user;
proof of fraud committed by the customer.
An internal procedure that merely establishes the correct use of credentials does not appear sufficient to justify refusing reimbursement. The context of the transaction must be considered and the elements supporting any allegation concerning the customer’s conduct must be documented.
For users, the ruling does not authorise careless behaviour. The enhanced protection operates principally at the initial reimbursement stage, whereas proof that the customer voluntarily disclosed payment codes, unjustifiably delayed notification or engaged in other seriously imprudent conduct may lead to the loss being attributed to them at a later stage.
Conclusions
The framework resulting from European law, Italian legislation and national case law may be summarised in three principles.
First, an unauthorised transaction must be reimbursed immediately, within the statutory period, unless the provider has a justified suspicion of customer fraud and has communicated it to the competent authority.
Second, the use of credentials and correct technical authentication do not automatically prove either that the transaction was authorised or that the user was grossly negligent.
Third, gross negligence may affect the final allocation of the loss, but it must be proved by the provider through concrete evidence and not through presumptions based solely on the occurrence of the fraud.
The new European interpretation therefore strengthens the customer’s procedural protection without turning it into a general exemption from responsibility. The balance remains that outlined by Italian legislation and the Supreme Court: the bank bears the professional risk of fraud that is foreseeable and technically capable of being prevented, while the customer is liable where their conduct has, in the circumstances, crossed the threshold of gross negligence.
© Avv. Gabriele Lanzi
Comments