EU Court of Justice Case C-665/23 and Unauthorised Payments Under PSD2, What Payment Providers Must Do

The question of refunds for unauthorised payment transactions has become one of the most consequential issues for banks, payment institutions and fintechs operating across the European Union. The Court of Justice of the European Union (CJEU) has consistently emphasised, when interpreting Directive (EU) 2015/2366 (PSD2), that a payment service provider must refund the amount of an unauthorised payment transaction and must not withhold reimbursement merely on the basis of an untested allegation that the payer acted with gross negligence. A provider generally retains a later right of recovery, but, not the customer, carries the burden of proving the conditions that would reduce or exclude its liability.

This principle applies in every Member State and reshapes how refund, chargeback and fraud-claim procedures must operate under PSD2. This article sets out the legal framework, the burden-of-proof analysis, and the practical operational changes compliance and legal teams should consider.

Note: references below to specific CJEU case numbers and judgment dates should be verified against the Court’s official record on CURIA before relying on them, as case citations and procedural stages change over time. The substantive legal analysis in this article reflects the established interpretation of PSD2 by the CJEU and the European Banking Authority.

What the legal framework requires, the holding and PSD2 cross-reference

The core principle is a “refund-first” obligation. Where a payer disputes a payment transaction as unauthorised, the payment service provider must, in accordance with PSD2, refund the amount of the unauthorised transaction and, where applicable, restore the debited payment account to the state in which it would have been had the unauthorised transaction not taken place. The CJEU has been clear that providers may not routinely withhold reimbursement at the outset on the basis of an untested allegation that the customer acted with gross negligence.

This interpretation flows directly from the structure of PSD2. Under Directive (EU) 2015/2366, where a payment transaction is not authorised, the payer’s provider is obliged to refund the amount and, where applicable, restore the debited account to the position it would have occupied absent the unauthorised transaction, in principle no later than the end of the following business day, once the provider is aware of or notified of the transaction (save where it has reasonable grounds for suspecting fraud communicated to the relevant national authority).

The Directive permits the payer to bear losses in narrowly defined circumstances, notably where the payer has acted fraudulently or has failed with intent or gross negligence to fulfil its obligations to keep personalised security credentials safe, but these are exceptions the provider must establish, not conditions precedent to any refund at all.

In practical terms, the framework separates two previously conflated moments. First, the moment of reimbursement: on an assertion of an unauthorised transaction, the provider refunds within the PSD2 timeframe. Second, the moment of liability: if the provider believes the payer acted fraudulently or with gross negligence, it pursues recovery afterwards, bearing the evidentiary burden. The sequencing matters enormously for cash flow, customer treatment and litigation strategy.

Advocate General opinions and the Court’s reasoning

Advocate General opinions in PSD2 payment-services references have repeatedly emphasised that the protective purpose of the Directive would be undermined if providers could neutralise the refund right simply by raising an allegation of negligence. The Court’s judgments have aligned with that analysis, confirming that the refund obligation operates as the default and that exceptions to payer protection must be demonstrated by the provider. Practitioners should read any specific judgment alongside its corresponding Advocate General opinion, both of which are available in full on the CURIA website, for a coherent account of how the burden shifts and when the recovery route becomes available.

Does PSD2 require prompt refund for unauthorised payments? Yes. The provider’s obligation to refund an unauthorised payment transaction is not suspended merely because the provider wishes to allege gross negligence. The refund comes first, within the PSD2 timeframe; the dispute over fault comes later.

Legal analysis, burden of proof, gross negligence, and intent

The legal centre of gravity is the allocation of the burden of proof. PSD2 already provides that where a payment service user denies having authorised a transaction, it is for the provider to prove that the transaction was authenticated, accurately recorded, entered in the accounts and not affected by a technical breakdown or other deficiency. The Court’s case law extends the logic of that allocation to the question of fault: the provider that wishes to reduce or exclude its liability by reference to the payer’s intent or gross negligence must prove it.

Can providers refuse refunds if the customer acted negligently? Not at the outset. A provider cannot refuse the initial refund on the basis of an unproven allegation. It may only recover sums afterwards if it can satisfy the relevant evidentiary threshold for fraud, intent or gross negligence. PSD2 also provides that the use of a payment instrument recorded by the provider is not in itself necessarily sufficient to prove that the payer authorised the transaction or acted fraudulently or with gross negligence.

How the burden of proof is allocated

The sequence the case law endorses is straightforward in principle, if demanding in practice:

• Step one, refund. On a credible assertion that a transaction was not authorised, the provider restores the payer’s position within the PSD2 timeframe.
• Step two, authentication evidence. If the provider contests the claim, it must first prove the transaction was authenticated and correctly recorded. The mere use of a payment instrument, including as recorded by the provider, is not itself sufficient to prove either authorisation or that the payer acted fraudulently or with gross negligence.
• Step three, fault evidence. To recover, the provider must then establish that the payer acted fraudulently, or failed intentionally or with gross negligence to protect personalised security credentials.

The practical effect of this sequencing is that providers can no longer treat an allegation of negligence as a defensive shield to delay payment. It becomes a positive case the provider must build and prove.

Evidentiary standards and admissible evidence

The distinction between gross negligence and ordinary carelessness is central. Gross negligence implies a serious departure from the standard of care expected of a reasonable user, for example, ignoring explicit, specific and recent warnings. Intent, and fraud, sit at the far end of the spectrum and justify full payer liability. To meet these thresholds, providers will need robust, well-preserved evidence. A practical evidentiary checklist includes:

• Transaction logs. Complete, time-stamped records of the disputed transaction and surrounding account activity.
• Authentication data. Records demonstrating how strong customer authentication (SCA) was applied, including the elements relied upon.
• Device and session data. Device identifiers, browser fingerprints, IP addresses and session metadata linking the transaction to the user’s environment.
• Communication records. Evidence of warnings, alerts or security guidance previously issued to the customer.
• Forensic reports. Where appropriate, independent forensic analysis of the fraud vector and the customer’s conduct.

Action required: compliance teams should map existing data-retention policies against this evidentiary list and confirm that logs are preserved for the period needed to support any later recovery action, subject to data-protection constraints under the GDPR.

Operational implications for payment service providers

The operational consequences reach across banks, payment institutions (PIs), electronic money institutions (EMIs) and fintechs. Implementing a refund-first obligation is not simply a legal interpretation exercise; it requires changes to incident-response workflows, customer communications, dispute handling and supervisory reporting.

Update incident response and fraud workflows

The first operational priority is to build a refund-first workflow with a clear service-level standard consistent with the PSD2 reimbursement timeframe. In practice this means:

• Defined SLAs. Establish an internal deadline for reimbursing disputed unauthorised transactions and align it with the PSD2 standard (in principle by the end of the business day following notification, absent reasonable, reported suspicion of fraud).
• Provisional crediting. Where a transaction is credibly asserted as unauthorised, credit the customer first and preserve all evidence for a separate recovery assessment.
• Separation of functions. Decouple the reimbursement decision from the fault investigation, so that refund timing is never held hostage to a slow fraud review.
• Litigation hold. Trigger evidence-preservation protocols the moment a dispute is logged, capturing logs, device data and communications.

Customer communications templates

Communications must be recalibrated so that refunding does not inadvertently concede the fault question, while still treating customers fairly and transparently. Two messages are essential: one at the point of refund and one if recovery is later pursued. The refund message should confirm the reimbursement without admitting that the transaction was necessarily the provider’s loss to bear. The recovery message should set out, clearly and in plain language, the basis on which the provider believes the payer acted fraudulently or with gross negligence, and the evidence relied upon.

Chargeback vs refund-first, comparison

Operations teams frequently confuse the PSD2 refund obligation with card-scheme chargebacks. They are distinct mechanisms with different triggers, actors and burdens. The table below contrasts the PSD2 refund route, the card-scheme chargeback, and the subsequent recovery route.

Reporting to supervisory authorities and internal controls

Where a provider identifies a systemic fraud pattern or a large-scale remediation obligation, it should assess notification duties to its competent authority and update internal controls accordingly. PSD2 and EBA guidelines also impose major-incident and fraud-reporting obligations. A process map with escalation triggers, for example, a surge in unauthorised-transaction claims, or a specific phishing campaign, allows the compliance function to coordinate refunds, evidence preservation and supervisory engagement without disrupting the refund-first timeline.

Recovery options after refund, civil claims, set-off and contractual remedies

The legal framework preserves the provider’s economic interest by leaving the recovery route intact. After refunding, a provider that can prove the payer acted fraudulently, intentionally or with gross negligence may seek to recover the sums reimbursed. The available mechanisms include:

• Civil claims against the payer. Where the evidentiary threshold is met, the provider may bring a claim to recover the refunded amount.
• Claims against third parties. The provider may pursue the fraudster or recipient of funds, including through subrogation to the customer’s claims where national law allows.
• Contractual set-off. Subject to national law and the framework contract, the provider may rely on set-off or contractually agreed recovery rights.
• Injunctive and freezing measures. Where funds can be traced, freezing or injunctive relief may assist recovery, particularly in cross-border scenarios.

Timelines and limitation under national law

Recovery actions are governed by national procedural and limitation rules. In Poland, limitation periods for civil claims are set by the Civil Code and the procedural route is governed by the Code of Civil Procedure; these will shape how quickly and effectively a provider can act. Cross-border enforcement adds further complexity where the recipient of fraudulent funds sits in another Member State. Providers should obtain local advice to confirm the applicable limitation period and the most effective procedural vehicle before committing to a recovery strategy. The guiding principle is that recovery is a separate track that must never be used to justify delaying the primary refund.

Consequences for phishing, authorised push payment (APP) scams and prevention

One of the most frequently asked questions concerns authorised push payment (APP) scams. The analytical dividing line remains authorisation. An unauthorised transaction is one the payer did not consent to; the PSD2 refund obligation applies squarely to these. An APP scam, by contrast, typically involves a payer who is deceived into authorising a payment to a fraudster, the payment is, on its face, authorised, and PSD2 does not currently impose the same mandatory reimbursement regime for such cases at EU level.

The practical effect is that the characterisation of a transaction as authorised or unauthorised is decisive. Where deception vitiates the integrity of the authorisation process, for example, where credentials were captured through a spoofed interface rather than knowingly used to approve a specific payment, providers will need to analyse carefully whether the transaction is properly characterised as unauthorised under PSD2, in which case the refund logic applies. Industry and regulatory attention to APP fraud continues to evolve, and providers should monitor developments at both EU and national level.

Enhanced KYC, SCA and real-time monitoring

Prevention becomes commercially critical as reimbursement defaults tighten. Providers should strengthen:

• Strong customer authentication. Robust SCA implementation consistent with the EBA Regulatory Technical Standards on SCA and common and secure communication reduces both fraud and the ambiguity around authorisation.
• Transaction monitoring. Real-time behavioural analytics to flag anomalous payments and trigger step-up checks.
• Red-flag intervention. Automated holds, confirmation prompts and payee-verification checks for high-risk transfers.

Customer education and dispute routing

Clear, documented warnings serve two purposes: they reduce fraud, and they build the evidentiary record a provider may later rely upon in a recovery action. Dispute-routing should be designed so that a customer reporting fraud reaches the refund workflow quickly, while the provider simultaneously captures the data needed to assess fault.

What to change in contract terms, T&Cs and customer communications

Framework contracts and terms of service should be revisited to reflect the refund-first reality. Recommended drafting elements include a refund-first acknowledgement clause, a subrogation or assignment mechanism enabling the provider to pursue third parties, clear dispute timelines, and, where national law permits, consent and recovery clauses. Three illustrative drafting registers:

• Provider-friendly. “On reimbursement of a disputed transaction, the customer assigns to the provider all rights of recovery against third parties, and acknowledges the provider’s right to recover reimbursed amounts where fraud, intent or gross negligence is established.”
• Balanced. “The provider will reimburse disputed unauthorised transactions within the timeframe required by applicable law. The provider reserves the right to recover reimbursed amounts where it demonstrates fraud, intent or gross negligence, and will communicate the basis for any such claim.”
• Customer-friendly. “You will be reimbursed promptly for transactions you did not authorise. We will only seek to recover reimbursed funds if we can show you acted fraudulently or with gross negligence, and we will explain our reasons.”

Note that under Polish and EU consumer-protection rules, contractual terms that unfairly limit a consumer’s statutory rights may be unenforceable, so drafting must remain consistent with mandatory PSD2 protections.

Supervisory expectations and enforcement in Poland and the EU

CJEU interpretations of PSD2 bind all Member States, and supervisory authorities expect alignment. In Poland, the Polish Financial Supervision Authority (Komisja Nadzoru Finansowego, KNF) is the competent authority for payment services, and its supervisory focus is likely to fall on the timeliness of refunds, the clarity of complaint handling and the fairness of recovery communications. PSD2 has been implemented in Poland principally through the Act on Payment Services of 19 August 2011 (Ustawa o usługach płatniczych), as amended. The Financial Ombudsman (Rzecznik Finansowy) also plays a role in consumer disputes with financial institutions.

At EU level, European Banking Authority (EBA) guidelines and technical standards on strong customer authentication and secure communication remain the reference framework for fraud prevention and will inform supervisory assessments.

Suggested regulatory notification approach

Where a provider anticipates large-scale remediation, for example, reopening historic claims that were refused on negligence grounds, proactive engagement with the KNF is prudent. A short notification should set out the scope of affected customers, the remediation timeline, and the controls being implemented to meet the refund standard going forward.

Practical checklist and next steps for compliance teams

The following ready-to-use checklist translates the PSD2 refund framework into immediate actions:

1. Update fraud and dispute policies to embed the refund obligation and the PSD2 timeframe.
2. Define and document an SLA for prompt provisional crediting of unauthorised transactions.
3. Separate the reimbursement decision from the fault investigation operationally.
4. Implement litigation-hold triggers to preserve logs, device data and communications.
5. Refresh customer communication templates for refund and recovery scenarios.
6. Review framework contracts for subrogation, assignment and recovery clauses.
7. Audit authentication and monitoring systems against the EBA SCA technical standards.
8. Build an evidence pack standard for any recovery action.
9. Train frontline and investigations staff on the burden-of-proof sequence.
10. Map historic refused claims for potential remediation.
11. Assess notification obligations to the KNF for systemic remediation.
12. Establish escalation triggers for fraud surges and phishing campaigns.

Conclusion, key takeaways and recommended timeline

The CJEU’s interpretation of PSD2 delivers three practical effects that every payment service provider must absorb. First, refunds for unauthorised transactions come first, within the statutory timeframe, and cannot be withheld on an unproven allegation of gross negligence. Second, the provider, not the customer, bears the burden of proving fraud, intent or gross negligence before it can recover. Third, recovery is a separate track that must never be used to delay the primary refund. A sensible implementation timeline runs across three horizons: in the near term, update policies, SLAs and communication templates; in the medium term, revise contracts, retrain staff and strengthen evidence preservation; and over the following months, complete authentication and monitoring upgrades and remediate historic refused claims.

Providers that act decisively will convert a compliance obligation into a durable advantage in customer trust and operational resilience.

Sources

1. Directive (EU) 2015/2366 (PSD2), EUR-Lex
2. Court of Justice of the European Union (CURIA)
3. European Commission, Payment services (PSD2)
4. European Banking Authority (EBA)
5. Polish Financial Supervision Authority (KNF)
6. Financial Ombudsman of Poland (Rzecznik Finansowy)
7. European Central Bank