Bank of Spain pressures banks on fraud refunds following European court ruling
The regulator will study guidance for entities to uniformly comply with the CJEU ruling that requires refunding defrauded money on unauthorised transactions by the next business day.
Bank of Spain prepares guidance following ruling on banking fraud
The Bank of Spain is analysing how to provide guidance to the financial sector to uniformly apply the ruling of the Court of Justice of the European Union (CJEU) that orders banks to refund defrauded money, according to cincodias.elpais.com. The regulator has indicated that it will evaluate the content of the resolution in order to "issue, if it deems appropriate, the guidance that corresponds to the sector with the aim of promoting its uniform, consistent, reasonable and proportionate application".
The ruling of 15 October has transformed responsibility in banking fraud. Until now, many entities slowed down refunds by citing gross negligence by customers in unauthorised transactions. The ruling reverses this order: the bank must refund the money no later than the end of the following business day and only afterwards can it attempt to prove negligent conduct by the customer to claim the amount from them.
The shift in burden of proof
The usual practice of Spanish and European banking was to reject fraud claims, transferring to the affected party the obligation to resort to the courts to recover their funds. According to the Association of Financial Users in Spain (Asufin) and the Organisation of Consumers and Users (OCU), this mechanism forced customers to undertake lengthy judicial proceedings. The CJEU ruling reverses this dynamic: immediate restitution is the right, and the exception is proven suspicion of fraud by the customer themselves, communicated in writing to the national authority.
The case that prompted the ruling
The ruling was based on the case of a customer of a Polish bank who was contacted by a fraudster posing as a buyer of an item published online. The fraudster directed her to a fake website that mimicked her bank's site, where she entered her electronic banking credentials. The criminal transferred approximately 700 euros to his account. When the victim informed the bank the next day, the entity refused the refund claiming that she had failed to comply with her "obligation to keep the payment instrument with due diligence". For the CJEU, this justification was not valid.
The sector's argument on authorised transactions
The banking sector argues that the impact of the ruling will be limited, based on a distinction between authorised and unauthorised transactions. Spanish payment services legislation establishes that transactions are considered authorised when the payer has given explicit consent. A spokesman for the Spanish Banking Association (AEB) argued that "the CJEU analysed the case of a transaction not authorised by the customer" and that "the ruling confirms the current legislation for cases of unauthorised transactions". The sector emphasises that the current framework "does not modify the payer's liability regime for failure to comply with the obligation to protect their data".
The reply from consumer associations
Asufin contests that the difference between authorised and unauthorised is merely a nuance and constitutes a weak argument for avoiding refund when the customer has been deceived by a third party. It cites examples such as parents and grandparents receiving messages from cybercriminals impersonating their children or grandchildren requesting money via Bizum or bank transfer. According to consumers, these cases demonstrate that the formal distinction carries less weight against the reality of fraud.
Previous regulator doctrine
The position of the Bank of Spain, until the ruling, adhered strictly to existing legislation. Its latest complaints report ordered immediate refund of the amount to the payer no later than the end of the following business day, except where fraud was suspected and communicated to the supervisor. However, the entity added a caveat that referred to the burden of proof: it was incumbent on the entity to demonstrate that the transaction was correctly authenticated, "unless it proves that there was fraud or gross negligence on the part of the user". Many banks used that exception to reject claims. Now, the Department of Entity Conduct, under the direction of José Luis Escrivá, is reviewing the application of the new case law.
Estimated economic impact
The ruling opens a considerable economic front for the sector, both for future frauds and for previous claims that could be reopened. Frauds in the European Economic Area—the 27 EU countries plus Iceland, Liechtenstein and Norway—reached 4.2 billion euros in 2024. In Spain alone, frauds exceeded 300 million that year, according to data from the European Central Bank (ECB), the European Banking Authority (EBA) and the Bank of Spain. The final scope of pending claims has not yet been quantified with precision, but the sector anticipates a material impact.
Source: Google News ES — Crime (es)