By Grace Kim, Global Law Wire

The European Union's top court has ruled that banks must refund phishing fraud victims first and prove customer negligence afterward. The decision reverses the practical burden of proof that many lenders had applied in unauthorized payment disputes across the bloc.

The court held that a customer reporting a phishing loss is entitled to reimbursement without first demonstrating that they took reasonable care. The bank, not the customer, carries the burden of establishing gross negligence or fraud by the account holder before it can deny a refund.

What does the ruling change?

Until now, banks in several EU jurisdictions routinely demanded evidence of customer caution before processing refunds. Victims of phishing scams — where fraudsters impersonate legitimate institutions to steal credentials — often faced weeks of delay or outright denial.

The ruling ends that sequencing. Refund first, litigate negligence second.

Practically, this means payment service providers must now:

• Reimburse the disputed amount at the outset of a claim
• Gather their own evidence of customer fault before withholding funds
• Absorb the loss where negligence cannot be established

For bank compliance teams, the decision forces a rethink of claim-handling procedures. Documentation standards will tighten. Banks that cannot show concrete proof of customer negligence will bear the financial loss themselves.

For consumers and their counsel, the ruling strengthens the position at the first point of contact with the bank. A refusal to refund pending an internal negligence review now sits on weaker legal ground.

Takeaway: the fraud loss now sits with the bank unless the bank itself can prove the customer's fault.

Why does the burden of proof matter here?

Phishing fraud presents a distinctive evidentiary problem. The victim holds the credentials. The fraudster holds the deception. The bank holds the transaction records.

In practice, only the bank commands the data needed to reconstruct what happened — device fingerprints, transaction logs, timing patterns. Courts have increasingly recognized that the party with the evidence should carry the burden of proving fault.

The ruling aligns with the consumer-protective logic of EU payment law, which treats unauthorized transactions as the bank's problem by default. Narrow exceptions exist, but the bank must invoke them with proof, not presumption.

Takeaway: procedural order now favors the customer, and banks must build fault cases before withholding money.

What should practitioners do next?

Bank-side lawyers should audit current refund workflows against the ruling. Any procedure conditioning reimbursement on a customer's proof of diligence requires revision.

Consumer-side lawyers should cite the ruling when banks delay refunds pending negligence investigations. The decision gives claimants a direct answer to procedural stonewalling.

Regulators across member states will likely examine complaint-handling data in coming months. Banks with high denial rates on phishing claims should expect scrutiny.

Takeaway: refund procedures that put the customer on trial first no longer withstand the court's approach.