A customer selling an item online receives a link from a “buyer”, lands on a page that looks exactly like her bank’s, types in her online banking login, and about EUR 700 leaves her account. The next day she reports it. The bank refuses to refund: she handed over her credentials, so she was grossly negligent. On 15 October 2026 the Court of Justice of the European Union (CJEU) said the bank had the order wrong. Under the EU Payment Services Directive (PSD2), the bank must refund first and argue about negligence afterwards (Case C-70/25). This note explains the ruling and sets it against the Turkish rules, which give providers more room to delay.
What the Court decided
The reference came from a Polish court. The facts are the familiar online-marketplace phishing pattern: a fake buyer, a fake platform page, a spoofed bank site, credentials entered, a transfer of about EUR 700 to the fraudster’s account, and a report to the bank the following day (CJEU press release; LTO report). The bank refused the refund on grounds of gross negligence. The Court held:
- Refund comes first. Where the customer reports an unauthorised transaction without undue delay, the provider must refund it immediately and in any event by the end of the following business day (PSD2 Art. 73(1)).
- Gross negligence is not a reason to refuse or delay that refund. The only exception in Art. 73(1) is where the provider has reasonable grounds to suspect fraud by the customer and communicates those grounds in writing to the competent national authority.
- The loss is allocated afterwards. The provider may then seek to recover the amount if it proves that the loss resulted from the customer’s intentional or grossly negligent breach of her duties, in particular the duty to keep personalised security credentials safe (Arts. 69 and 74(1)). The burden of proof is on the provider.
The Court’s reasoning is practical: if banks could withhold the refund simply by alleging gross negligence, the immediate refund rule would be emptied and customers would have to sue to get their money back. The judgment does not decide whether entering credentials on a spoofed site is gross negligence. That question is left for the later stage, where the bank carries the burden.
The PSD2 rules behind the ruling
| Rule | PSD2 |
|---|---|
| Customer must keep credentials safe and report loss or misuse without undue delay | Art. 69 |
| Provider must prove authentication, correct recording and no technical failure; recorded use alone is not necessarily proof of authorisation or gross negligence | Art. 72 |
| Refund immediately, at the latest by the end of the next business day; exception only for reasonable suspicion of fraud reported in writing to the authority | Art. 73(1) |
| Customer bears up to EUR 50 for a lost, stolen or misappropriated instrument; the whole loss for fraud, intent or gross negligence | Art. 74(1) |
| If the provider did not require strong customer authentication, the customer bears no loss unless acting fraudulently | Art. 74(2) |
See our PSD2 glossary entry for the wider framework.
The Turkish rule: refund, but with an investigation window
For payment services, the liability rules sit in the Central Bank (TCMB) Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers, issued under Law No. 6493. They apply to payment service providers, a term that covers banks, payment institutions, e-money institutions and PTT (Law No. 6493 Art. 13). The structure follows PSD2, but one sentence differs in a way that matters:
- The customer must notify without delay and in any case within 13 months (Regulation Art. 54(1)).
- If the customer denies authorising the transaction, the provider must prove that it was approved, correctly recorded and not affected by a technical failure (Art. 54(2)).
- Once the transaction is shown to be unauthorised, the provider refunds it immediately. However, where there is strong suspicion of fraudulent use, or of an intentional or grossly negligent breach of the customer’s security duties, the provider may first investigate for a reasonable period (Art. 54(3)).
- For a lost or stolen instrument or poorly kept credentials, the customer bears at most TRY 250 of losses in the 24 hours before notification, and nothing after it (Art. 54(4)). The cap does not apply to fraud or to intentional or grossly negligent breaches of the Article 53 duties (Art. 54(5)).
- If the provider did not require the authentication TCMB rules demand, the customer is not liable for those losses unless Art. 54(5) applies (Art. 54(9)).
| Question | EU (PSD2, as read in C-70/25) | Türkiye (TCMB Regulation) |
|---|---|---|
| When is the refund due? | Immediately, at the latest by the end of the next business day | Immediately once the transaction is shown to be unauthorised |
| Can suspected gross negligence delay it? | No | Yes: strong suspicion allows an investigation for a reasonable period first |
| Exception for suspected fraud | Only with written notice of the grounds to the national authority | No notice to an authority is required |
| Customer cap for misuse before notice | EUR 50 | TRY 250 (24 hours before notice) |
| Who proves gross negligence? | The provider | The provider bears the burden of proving authorisation; the cap is lost only for fraud, intent or gross negligence |
Two things follow. First, the Turkish text gives providers a lawful pause that the CJEU has now ruled out in the EU. Second, the pause is narrow: it requires a strong suspicion and a reasonable period. In our view, a standard letter that refuses every phishing claim on the ground that “you shared your password” is not an investigation under Art. 54(3). The provider still has to answer the complaint with reasons within 20 days (Regulation Art. 74(1)).
Cards follow a different track
Law No. 6493 does not apply to matters governed by Law No. 5464 on Bank Cards and Credit Cards (Law No. 6493 Art. 24(1)). If the fraudster used card details rather than online banking credentials, the dispute moves to Law No. 5464. The cardholder bears at most TRY 150 of misuse in the 24 hours before reporting, except for gross negligence, intent or failure to report (Art. 12). That cap is written for a lost or stolen card or card information; whether it covers details handed over on a phishing page is a matter of interpretation. Credit card statements can be challenged within ten days of the payment due date, and the issuer must answer within 20 days (Art. 11). Neither provision imposes a refund deadline like PSD2 Art. 73(1).
Why the ruling still matters in Türkiye
- Turkish groups with EU entities. A Turkish fintech that serves EU customers through an EU-licensed payment or e-money institution must apply C-70/25 now. Refund policies, complaint scripts and fraud playbooks written for the Turkish investigation window cannot simply be copied into the EU entity.
- Turkish disputes. The ruling does not bind Turkish courts or arbitration committees. However, the Turkish Regulation is modelled on PSD2, and the Court’s reasoning is a persuasive argument when a provider uses the Art. 54(3) window as a blanket refusal. Disputes that reach court in Türkiye tend to turn on fault: the provider’s duty as a prudent merchant (Turkish Commercial Code Art. 18(2)) and its monitoring duties, set against the customer’s contributory fault, such as reading out a one-time code (Code of Obligations Arts. 52 and 114).
- Where the EU is going. The PSD3 and Payment Services Regulation (PSR) package is in its final adoption steps; the Council’s first-reading position on PSD3 (doc. 8535/26, dated 21 October 2026) was made public on 23 October. The compromise text extends refunds to some authorised payments where fraudsters impersonated the customer’s own bank, and introduces mandatory payee name checks. Our PSD3 and PSR article covers the package, and our deepfake and APP fraud article explains why authorised payments get no statutory refund in Türkiye today.
What to do
If you are a customer in Türkiye who has been phished:
- Call and write to the bank or payment provider immediately. Unless there was fraud, intent or gross negligence, you bear nothing after notice and at most TRY 250 for the 24 hours before it.
- Ask in writing for a refund of the unauthorised transaction under Article 54 of the TCMB Regulation, or under Law No. 5464 for card misuse, and keep proof of the date.
- File a criminal complaint; fraud through information systems or banks is qualified fraud (Turkish Penal Code Art. 158(1)(f)).
- If there is no answer within 20 days or the answer is negative, use the dispute routes: the arbitration committee of the relevant association, the consumer arbitration committee (mandatory below TRY 186,000 in 2026), or mediation and then the consumer court.
If you run a payment or e-money institution:
- Write a refund-first default for proven unauthorised transactions and treat Art. 54(3) as an exception. Record what the strong suspicion is based on, and set an internal deadline for the investigation.
- Do not equate “the customer entered credentials” with gross negligence. Check whether you required the authentication that TCMB rules (BDDK rules, for banks) demand; if not, the loss is likely yours (Art. 54(9)).
- Keep monitoring and warning logs. Fault-based disputes are won or lost on whether the provider spotted and acted on unusual patterns.
- If you have an EU entity, align its procedures with C-70/25: refund by the next business day and recover later, with any fraud exception reported to the authority.
More in our fintech law hub and our open banking guide.
Frequently asked questions
What did the CJEU decide in C-70/25?
On 15 October 2026 it held that under PSD2 a bank must refund an unauthorised transaction immediately, at the latest by the end of the next business day, even if it believes the customer was grossly negligent. It can recover the money later if it proves intent or gross negligence. The only ground for withholding the refund is a reasonable suspicion of customer fraud reported in writing to the national authority.
Does C-70/25 apply in Türkiye?
Not directly. Türkiye is not bound by CJEU rulings, and the TCMB Regulation allows a provider with a strong suspicion of fraud, intent or gross negligence to investigate for a reasonable period before refunding (Art. 54(3)). The ruling applies directly to EU-licensed entities of Turkish groups.
How much does a phishing victim bear in Türkiye?
For payment services, at most TRY 250 of losses in the 24 hours before notification and nothing after it, unless the customer acted fraudulently, intentionally or with gross negligence (TCMB Regulation Art. 54(4)-(5)). For card misuse, Law No. 5464 Art. 12 sets a TRY 150 cap with the same exceptions.
Is entering my password on a fake bank site gross negligence?
It depends on the facts, and neither the CJEU nor the Turkish rule treats it as automatic. In the EU the bank must refund first and prove gross negligence later. In Türkiye the provider bears the burden of proving authorisation, and whether the customer’s conduct removes the cap is decided case by case.
What if I authorised the payment myself after a fake call?
That is authorised push payment fraud. The unauthorised transaction rules above do not apply, and Türkiye has no statutory refund for it today; see our deepfake and APP fraud article.
Sources. CJEU, Case C-70/25, judgment of 15 October 2026, Press Release No 147/26 (CJEU; LTO); Directive (EU) 2015/2366 (PSD2), Arts. 69, 72, 73, 74; Law No. 6493 (RG 27.6.2013, No. 28690), Arts. 13, 24(1); TCMB Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (RG 1.12.2021, No. 31676, as amended), Arts. 53, 54, 74; Law No. 5464 (RG 1.3.2006, No. 26095), Arts. 11, 12; Turkish Commercial Code No. 6102, Art. 18(2); Code of Obligations No. 6098, Arts. 52, 114; Turkish Penal Code No. 5237, Art. 158(1)(f); Council of the EU, position at first reading on PSD3 (21 October 2026).
This article is general information and not legal advice; a specific situation should be assessed with counsel.
