A woman was selling an item online. The “buyer” sent a link to confirm the deal. She ended up on a fake bank website — and the fraudster withdrew about €700 from the account.

The bank refused to return the money: in its opinion, the client herself showed gross negligence.

On October 15, 2026, the Court of Justice of the EU clarified: such an argument alone is not sufficient for a refusal.

If money was debited without your consent, the bank, as a general rule, must return it immediately — at the latest by the end of the next working day after it learned about the transaction. You must report the debit without delay.

First the return, then the dispute about who is responsible for the loss.

The bank may later demand the money back if it proves that the losses arose due to your gross negligence.

There is also an exception: a well-founded suspicion of fraud by the client himself, about which the bank has informed the competent authority in writing.

🇨🇾 This is important for Cyprus as well: the Court clarified the general EU rules on payment services.

⚠️ If you yourself agreed to the transfer to the fraudster, this is a different situation — this decision does not promise automatic return. But the use of your data or code by itself does not necessarily prove consent to the payment.

Discovered a foreign debit? Immediately contact the bank through the official channel, block the compromised access and submit a written appeal. Keep the correspondence and the statement. In case of refusal, request a written justification.

📌 The phrase “you yourself handed over the data” does not yet close the question of the return.

Sources: CJEU judgment C-70/25, legislation on the website of the Central Bank of Cyprus.

@legalcyprus