Twenty years ago, the banking reality was substantially different. Many complex operations required a trip to the bank branch, certain payments were mostly face-to-face, and internet access to bank accounts did not have the reach we know today. We could hardly have imagined that, two decades later, it would be possible to manage practically our entire financial life through a simple mobile phone.

Technological developments have brought undeniable benefits to society, profoundly transforming the way we communicate, work, and, in particular, manage our money. Today, through a simple mobile phone, we can access our bank accounts, make payments, and carry out certain operations.

However, this evolution has also brought new risks and vulnerabilities. The growing digitalization of financial operations has opened the door to new forms of criminality, increasingly sophisticated, which exploit users' trust and the difficulty of identifying fraudulent situations.

Phishing is a particularly concerning example of this reality. Through seemingly legitimate messages, phone calls, or websites, third parties act fraudulently to obtain personal and banking data, allowing unauthorized access to customer accounts.

Technological progress cannot be dissociated from a higher demand for security, prevention, and responsibility. The Law cannot lag behind technological evolution; it must keep pace with it, anticipate its risks, and ensure that progress does not come at the expense of citizens' protection.

It is in this context that the recent decision of the Court of Justice of the European Union (CJEU), delivered on October 15, 2026, in Case C-70/25, Tukowiecka, assumes particular relevance, as it clarified the rights of bank customers who are victims of unauthorized payment operations.

Is the Bank obliged to return the money?

The Court clarified that, in the event of an unauthorized payment operation, the bank cannot refuse an immediate refund to the customer merely because it considers that the customer acted with gross negligence.

In other words, the fact that the customer was deceived by a fraudulent message or accessed a fake link does not, in itself, allow the financial institution to automatically refuse the refund.

The rule is that the Bank must reimburse the amounts corresponding to the unauthorized operations.

Can the Bank demand the money back from the customer later? 

Yes. The CJEU clarified that the duty of immediate refund does not prevent the Bank from subsequently demanding that the customer return the paid amounts, provided it can prove that the customer acted fraudulently or breached, through gross negligence, the legal obligations regarding the use of payment services.

However, such liability cannot be presumed. It will always be up to the Bank to prove the facts that attribute intentional misconduct or gross negligence to the customer, and not the other way around.

Thus, the Bank cannot simply refuse the refund based on a generic allegation of customer carelessness, nor consider that the use of banking authentication mechanisms proves, by itself, that the operation was authorized.

Being a victim of phishing does not necessarily mean the customer has to bear the financial loss.

If you have been a victim of phishing, identified bank transactions you did not authorize, or saw your Bank refuse your refund request, do not automatically accept that the responsibility is yours.

There may be a legal basis to demand that the banking institution restore the funds withdrawn from your account.

This reality also poses a challenge to the Law itself. Technological evolution is often faster than the capacity of legal systems to adapt, making it essential that legislation keeps pace with these transformations by anticipating new risks and creating effective mechanisms to protect citizens. It is not enough to regulate traditional legal relationships when the economic and social reality is changing significantly.

Assessing these situations requires careful legal analysis, taking into account the circumstances in which the fraud occurred, the security duties of the banking institution, and the legal rules concerning the liability of the parties involved.

Legal intervention in this matter is of particular relevance, both in assessing the liability of financial institutions and in defending consumer rights against unauthorized payment operations.

If the last twenty years have profoundly transformed the way we live and relate to technology, the next twenty will certainly pose new challenges to society and the Law. It is therefore important to ensure that technological evolution is always accompanied by a legal evolution capable of protecting citizens. In this context, the role of the lawyer will be fundamental, not only in the interpretation and application of legal instruments, but also in the technical and legal analysis of new realities, contributing to ensuring effective protection of citizens' rights and interests.