A major European court ruling could reshape what happens after a phishing scam drains a bank account in Spain.
For transfers a customer never authorized, the bank has to put the money back before any dispute over the customer's conduct is settled.
Here's what to know
Under an Oct. 15 judgment from the Court of Justice of the European Union, banks must quickly reimburse unauthorized payments instead of withholding repayment over alleged carelessness, according to Euro Weekly News. Once the bank learns of the transaction, or the customer reports it, the refund is due by the end of the next business day.
The dispute stemmed from an online sale in Poland. After a supposed buyer steered a woman to a convincing imitation of her bank's site, she entered her sign-in details and relayed a code sent by text message, allowing a scammer to take roughly €700 from her account.
Her bank denied reimbursement on the grounds that she'd been seriously careless with her security information. The EU court, however, said that conclusion can't be used to hold up the initial repayment.
In Spain, that point matters because domestic payment services rules already required next-business-day reimbursement for unauthorized payments.
TCD Picks » Quince Spotlight
💡These best-sellers from Quince deliver affordable, sustainable luxury for all
More background
The judgment is narrower than a blanket promise to cover every scam loss. It is limited to unauthorized payments — transactions executed by a fraudster — not transfers a customer technically sends after being deceived.
In the Polish case, the fraudster used stolen credentials and a texted code to move the money, placing the transfer within the court's definition of an unauthorized payment.
The ruling also clarifies who has to prove fault in these fights. After making the refund, a bank seeking to recover the money must establish that the customer acted deliberately or with gross negligence.
Spanish courts had already been moving in that direction. Spain's Supreme Court has said banks must prove serious negligence, including in a case involving an Ibercaja customer who lost more than €83,000 in one night.
What's being done?
Practically speaking, the main change is in timing. An investigation into possible negligence can't be used to delay reimbursement for an unauthorized transaction. In Spain, that means the next-business-day refund rule remains in place, but the Oct. 15 ruling narrows banks' ability to stall while they investigate blame.
Banks didn't lose the ability to contest a claim altogether. If a bank can later show that a customer acted fraudulently or with gross negligence, it can try to recover the money.
Immediate repayment isn't required in every case. A bank can refuse to pay right away if it has reasonable grounds to suspect the customer was involved in the fraud.
To do that, though, it must provide those grounds in writing to the national authority. In Spain, that authority is the Banco de España. A report made on a Friday afternoon wouldn't trigger a weekend refund, but the money would still have to be returned by the end of the next business day.
Get TCD's free newsletters for easy tips, smart advice, and a chance to earn $5,000 toward home upgrades. To see more stories like this one, change your Google preferences here.
