Money Taken from the Account: Is the Bank Obligated to Return It to the Client? A Lawyer on the EU Court's Decision

The main difference lies in who directly performed the banking operation: the client themselves or the fraudster. European legislation regulates these situations differently, and this affects the bank's obligation to return the stolen funds. ## ## If the Money Was Transferred by a Fraudster — the Bank Is Obligated to Return It A payment is considered unauthorized if the client did not give consent and it was made without their involvement. For example: - a person's bank card was stolen and used; - the client entered their login and password on a fake website, after which the fraudster independently accessed online banking; - the perpetrator gained access to the bank account and independently transferred money to another account. In such cases, the payment is considered unauthorized, as the control over the funds was effectively given not by the account owner. According to European rules, the bank is obliged to return the amount of the unauthorized transaction immediately, but no later than the end of the next business day after it discovered the transaction or received notification from the client. At the same time, the client must report the fraud without undue delay. An important point: the bank cannot simply refuse to return the funds, citing that the client acted with gross negligence and voluntarily provided their banking details to the fraudsters. This issue became the subject of consideration by the Court of the European Union. ## ## If a Person Transferred Money to Fraudsters Themselves — the Situation Is Different The legislation treats cases where a person independently confirms a transfer, even if under the influence of deception, quite differently. For example, a person receives a call from someone claiming to be a bank or police employee, informing them that their money is at risk. They are then persuaded to log into online banking and transfer funds to a so-called safe account. If the person specified the recipient themselves and confirmed the transfer with their codes, such a payment is generally considered authorized. Legally, this means that consent for the operation was provided by the account owner themselves. The mere fact that a person became a victim of fraud does not automatically turn such a transfer into an unauthorized one. Therefore, when considering such cases, it is fundamentally important to establish who exactly initiated and confirmed the banking operation. ## ## EU Court Decision: The Bank First Returns the Money, Then Addresses Client Responsibility On October 15, 2026, the Court of the European Union issued an important ruling in case C-70/25 (Tukowiecka). The circumstances of the case were as follows. A woman from Poland was selling an item online. A potential buyer sent her a link, supposedly intended to confirm the transaction. The woman followed it to a fake website mimicking her bank's page and entered her online banking access details. The fraudster obtained the necessary information, including a one-time SMS code, and transferred 3000 Polish zlotys — about 700 euros — from her account. When the woman contacted the bank, the financial organization refused to return the money. The bank considered that the client had acted with gross negligence as she did not ensure the safety of her personal data. The case reached the EU Court. The Court ruled that in the case of an unauthorized payment transaction, the bank is initially obliged to return the money to the client, even if it suspects them of gross negligence. At the same time, the Court distinguished between two legal situations: 1. Initial return of funds. The bank is obliged to carry it out within the established timeframe, despite suspicions of the client's gross negligence. 2. Final responsibility for losses. If the bank believes that the client acted intentionally or was grossly negligent, it has the right to subsequently seek compensation for damages. However, the corresponding grounds must be proven. Thus, the bank cannot automatically shift responsibility onto the client and refuse the initial return of funds simply because the client became a victim of phishing. There are legally provided exceptions. For example, the bank may suspend immediate return if it has reasonable suspicions of fraud on the part of the client themselves and has reported this in writing to the competent national authority. The decision is based on Articles 69, 73, and 74 of the EU Directive 2015/2366 (PSD2) and is significant for all EU member states, including Latvia. ## ## What Will Change for Those Who Transferred Money to Fraudsters Themselves? The European Union is preparing new rules to protect consumers from payment fraud. This concerns two legislative acts — the Third Payment Services Directive (PSD3) and the Payment Services Regulation (PSR). One of the important innovations relates to cases where a fraudster poses as a bank employee and persuades a person to make a transfer themselves. According to the agreed text of the new rules, under certain circumstances, the bank will have to compensate even such an authorized transfer. However, protection will apply under specific conditions: - the fraudster must pose as an employee of the bank servicing the client, using communication channels associated with that bank; - the client must notify the bank without undue delay; - it is necessary to report the fraud to the police; - exceptions are provided, particularly in cases of fraud or gross negligence on the part of the client themselves. It is important that the new rules do not automatically apply to all cases where a person voluntarily transferred money to fraudsters. As of November 5, 2026, the Council of the EU has already adopted its positions in the first reading on PSD3 and PSR. However, the legislative procedure is not yet complete, and the new norms are not yet in effect. According to the agreed timelines, the majority of provisions are expected to come into effect 21 months after the relevant legislation enters into force. Therefore, the end of 2028 can be viewed as a guideline, but not as a definitively established date. ## ## What to Do If Money Has Disappeared from Your Account? If you discover a suspicious transaction, it is important to act immediately: - Immediately inform the bank about the unauthorized transfer and demand to register your request. - Request the return of the money in accordance with EU rules on unauthorized payments. - Keep correspondence, messages, links, phone numbers, and other evidence of the fraud. - File a report with the police. - If the bank refuses to return the funds, demand a written justification for the refusal. The main conclusion: if money was transferred from your account by a fraudster, you have the right to demand its return from the bank. Even if you inadvertently entered your details on a fake website, this does not mean that the bank can automatically refuse compensation. But if you confirmed the transfer under the influence of deception, the situation is legally more complex. In such a case, it is important to establish the circumstances of the operation and check which protection mechanisms apply specifically to your situation. That is why, in cases of banking fraud, it matters not only how the fraudster gained access to the money but also who is legally considered the initiator of the payment.