Opinion of the Advocate General — ECLI:EU:C:2026:153
Date: 2026-03-05
Language of the case: Polish

Translation C-70/25 – 1 
Case C-70/25 [Tukowiecka] i 
Request for a preliminary ruling 
Date received: 
3 February 2025 
Referring court: 
Sąd Rejonowy w Koszalinie (Poland) 
Date of the decision to refer: 
23 January 2025 
Party initiating the proceedings before the referring court: 
N.O. 
Other party to the proceedings: 
PKO BP SA 
  
[…] 
O R D E R 
On 23 January 2025 
the Sąd Rejonowy w Koszalinie w I Wydziale Cywilnym (District Court in 
Koszalin, Civil Division I) […] 
following consideration in Koszalin in closed session 
of the case brought by N.O. 
against PKO BP SA in W. 
for payment 
made the following order: 
 
i The name of the present case is a fictitious name. It does not correspond to the real name of any party to the proceedings. 
EN 
REQUEST FOR A PRELIMINARY RULING OF 23. 1. 2025 – CASE C-70/25 
 
2  
(1) to stay the proceedings in the case pursuant to Article 177(1)(31) of the 
Kodeks postępowania cywilnego (Code of Civil Procedure), 
(2) to refer the following question to the Court of Justice of the European 
Union for a preliminary ruling […]. 
[…] 
REFERENCE FOR A PRELIMINARY RULING 
[…] 
Wording of the question: 
Should the provisions of Article 73(1) in conjunction with Article 74(1) of 
Directive (EU) 2015/2366 of the European Parliament and of the Council of 
25 November 2015 on payment services in the internal market (OJ 2015 L 337, 
p. 35, as amended) be understood to mean that a payment service provider can 
refuse to refund to a payer immediately the amount of an unauthorised payment 
transaction if the payer has suffered a loss in connection with the unauthorised 
payment transaction as a result of failing, with gross negligence, to fulfil the 
obligations set out in Article 69 [?] 
Succinct presentation of the facts and procedure in the main proceedings 
1 The parties to the dispute had entered into a current account agreement. The 
claimant N.O. was the victim of a scam in which an unidentified perpetrator 
claimed to be interested in purchasing an object advertised for sale by the claimant 
on an online auction platform. The perpetrator then sent the victim a phishing link 
which appeared to have been sent by the auction platform, asking her to provide 
confirmation of the sale. In response, the claimant clicked on a link which sent her 
to a website spoofing her bank’s website, where she entered her online banking 
login details. After being thus fraudulently obtained, the claimant’s data were used 
by the perpetrator to transfer PLN 3,000 from the claimant’s account to the 
perpetrator’s account. The transaction was authorised by the perpetrator using a 
one-time password obtained maliciously from the claimant after she had received 
it via SMS. 
2 On the following day the claimant (N.O.) realised that fraud had occurred, and 
immediately notified the unauthorised transaction to the defendant (the Bank) and 
the police. The fraudster was not identified. 
3 The defendant (the Bank) refused to refund to the claimant the amount of the 
unauthorised transaction, alleging (among other things) that the harm had 
occurred as a result of N.O.’s failure to fulfil, with gross negligence, the 
obligation to apply due diligence in storing a payment instrument and to prevent 
unauthorised persons from accessing it. 
TUKOWIECKA 
 
3 
4 The claimant (N.O.) brought an action against PKO BP SA in W. before the Sąd 
Rejonowy w Koszalinie (District Court in Koszalin) for payment of PLN 3,000. In 
the statement of reasons for the claim, she stated that the defendant, as a payment 
service provider, was obliged to refund to the payer immediately the amount of an 
unauthorised payment transaction, with the sole exception of cases where it had 
reasonable grounds for suspecting fraud on the part of the payer. The defendant 
(the Bank) however objected that the payer’s failure, with gross negligence, to 
fulfil her obligations also exempted the Bank from the obligation to refund the 
amount of the unauthorised transaction. 
National legislation 
5 Article 46(1) and (3) of the Ustawa z dnia 19 sierpnia 2011 r. o usługach 
płatniczych (Law of 19 August 2011 on payment services) (consolidated text: Dz. 
U. of 2024, item 30, as amended): 
1. Subject to Article 44(2), in the event of an unauthorised payment 
transaction, the payer’s [payment service] provider must immediately, and 
in any event no later than by the end of the following business day after 
detecting the unauthorised transaction debited from the payer’s account, or 
being notified thereof, refund to the payer the amount of the unauthorised 
payment transaction, except where the payer’s [payment service] provider 
has reasonable and duly documented grounds for suspecting fraud and 
communicates those grounds to the law enforcement authorities in writing. 
In the event that the payer uses a payment account, the payer’s [payment 
service] provider shall restore the debited payment account to the state in 
which it would have been had the unauthorised payment transaction not 
taken place. The credit value date for the payer’s payment account shall be 
no later than the date on which the amount was debited.  
… 
3. The payer shall be fully liable for the unauthorised payment transactions if 
he or she acted with intent or failed to fulfil, with intent or gross negligence, 
one or more of the obligations referred to in Article 42. 
European Union law 
6 [Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 
November 2015 on payment services in the internal market, amending Directives 
2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, 
and repealing Directive 2007/64/EC]:  
Article 73(1) Member States shall ensure that, without prejudice to Article 71, in 
the case of an unauthorised payment transaction, the payer's payment service 
provider refunds the payer the amount of the unauthorised payment transaction 
REQUEST FOR A PRELIMINARY RULING OF 23. 1. 2025 – CASE C-70/25 
 
4  
immediately, and in any event no later than by the end of the following business 
day, after noting or being notified of the transaction, except where the payer's 
payment service provider has reasonable grounds for suspecting fraud and 
communicates those grounds to the relevant national authority in writing. Where 
applicable, the payer’s payment service provider shall restore the debited 
payment account to the state in which it would have been had the unauthorised 
payment transaction not taken place. This shall also ensure that the credit value 
date for the payer’s payment account shall be no later than the date the amount 
had been debited. 
Article 74(1) By way of derogation from Article 73, the payer may be obliged to 
bear the losses relating to any unauthorised payment transactions, up to a 
maximum of EUR 50, resulting from the use of a lost or stolen payment instrument 
or from the misappropriation of a payment instrument. 
The first subparagraph shall not apply if: 
(a) the loss, theft or misappropriation of a payment instrument was not 
detectable to the payer prior to a payment, except where the payer has acted 
fraudulently; or 
(b) the loss was caused by acts or lack of action of an employee, agent or 
branch of a payment service provider or of an entity to which its activities were 
outsourced. 
The payer shall bear all of the losses relating to any unauthorised payment 
transactions if they were incurred by the payer acting fraudulently or failing to 
fulfil one or more of the obligations set out in Article 69 with intent or gross 
negligence. In such cases, the maximum amount referred to in the first 
subparagraph shall not apply. 
Where the payer has neither acted fraudulently nor intentionally failed to fulfil its 
obligations under Article 69, Member States may reduce the liability referred to in 
this paragraph, taking into account, in particular, the nature of the personalised 
security credentials and the specific circumstances under which the payment 
instrument was lost, stolen or misappropriated. 
Recital 76 of the preamble to the Directive [last sentence]: 
In any event, the payer should always be protected by the general refund rule in 
the case of unauthorised or incorrectly executed payment transactions. 
Need for the interpretation of EU law 
7 In view of the fact that it was found during the proceedings that the disputed 
transaction was unauthorised, in order to decide the case the Sąd Rejonowy w 
Koszalinie (District Court in Koszalin) must now analyse Article 46 of the Law on 
TUKOWIECKA 
 
5 
payment services, which transposes Article 73 and 74 of Directive (EU) 
2015/2366 of 25 November 2015 of the European Parliament and of the Council 
on payment services in the internal market, in order to resolve the legal dispute 
between the parties regarding the scope of the obligation incumbent upon the 
payer’s [payment service] provider to refund the amount of an unauthorised 
transaction. 
8 The claimant seeks a finding by the court that an exception from the principle 
whereby the amount of an unauthorised transaction must be refunded should be 
granted only in the situation described in Article 73(1) of the Directive, where the 
payer’s service provider has reasonable grounds for suspecting fraud on the part of 
the payer and communicates those grounds to the relevant national authority. If 
there are no such grounds (as in the case in hand), the service provider should 
immediately, and in any event no later than by the end of the following business 
day, refund to the payer the amount of the unauthorised transaction. Only after 
that amount has been refunded and an investigation has been conducted into the 
relevant circumstances can the service provider demand that the payer bear the 
losses caused by gross negligence on the latter’s part. If the payer refuses to return 
the amount of the unauthorised transaction, the bank should file a legal claim to 
recover the funds. 
9 The defendant (the Bank) however argues that the national legislation transposing 
Article 74(1) of the Directive exempts the service provider from the obligation to 
refund immediately the amount of the unauthorised transaction, as provided for in 
Article 73(1) of the Directive, if it determines that the payer acted with gross 
negligence. The defendant (the Bank) asserts that it can make its own judgment as 
to all of the relevant conditions entailing liability for the unauthorised transaction, 
and that it is exempt from the obligation to refund the amount in the event that it 
itself determines that the payer acted with negligence. 
10 The Head of the Urząd Ochrony Konkurencji i Konsumentów (Office of 
Competition and Consumer Protection) in Warsaw has set out an official position 
on the scope of the obligation to make such refunds: 
[…] 
‘Article 46(1) of the Law on payment services should be understood to mean that 
the obligation to refund to a payer the amount of a payment transaction becomes 
incumbent upon the [payment service] provider when the payment service 
provider is notified by the payer that the relevant payment transaction was not 
authorised by the latter. The payment service provider is obliged to refund the 
amount of the transaction whose authorisation is disputed by the payer 
immediately, and in any event no later than by the end of the following business 
day after being notified thereof. The only exception from that principle applies in 
situations where the payment service provider has reasonable and documented 
grounds for suspecting that the payer’s notification constitutes attempted fraud 
and communicates those grounds to the law enforcement authorities, or where 
REQUEST FOR A PRELIMINARY RULING OF 23. 1. 2025 – CASE C-70/25 
 
6  
more than 13 months have passed since the date of the transaction disputed by the 
payer. Suspicions on the part of the payment service provider that the payer 
carried out the unauthorised transaction with intent or failed to fulfil, with intent 
or gross negligence, one or more of the obligations referred to in Article 42 of the 
Law on payment services do not constitute a ground for refusing to refund to the 
payer the amount of the unauthorised transaction. In that case, the payment service 
provider may bring a claim for payment against the payer. If, however, the payer 
does not agree with the payment service provider’s assessment as to whether he or 
she acted with gross negligence, a court should carry out a final assessment of 
these circumstances (and thus of whether the payer is liable for the transaction 
concerned).’ 
11 In the opinion of the Sąd Rejonowy w Koszalinie (District Court in Koszalin), the 
Directive concerned and the national transposing provisions establish a general 
principle whereby the risk of liability for conducting unauthorised payment 
transactions lies solely with the payment service providers. A provider of a highly 
specialised payment service should secure the transactions against fraud and 
protect the funds which service users have deposited with it. 
12 The provisions of the Directive and the national legislation also grant payers the 
right to be refunded the amount of an unauthorised transaction, which is 
equivalent to a right to have any funds lost in that way immediately restored. That 
right is only restricted if there are reasonable grounds for suspecting fraud on the 
payer’s part, which are communicated to the law enforcement authorities. 
13 That principle is reversed by payment service providers’ chosen approach, as 
observed by the court itself in the claims that have passed through the judicial 
system. The Polish courts have seen very few claims brought by banks against 
consumers in relation to the obligation to return the amount of an unauthorised 
transaction on the grounds of gross negligence by the payer. There has however 
been a significant number of cases in which consumers have brought claims 
against banks due to the failure of the latter to refund the amount of an 
unauthorised transaction. 
14 It follows that the payment service providers’ approach to applying the provisions 
governing exemptions from the right to a refund has evolved into a general rule 
for handling unauthorised transactions. The general principle whereby the risk of 
liability for conducting unauthorised payment transactions lies with the payment 
service providers is not being applied in practice. It is commonplace for payment 
service providers to refuse to refund the amount of an unauthorised transaction, 
and to pass onto the payer (particularly if the latter is a consumer) the task of 
bringing a legal claim in this connection. 
15 In view of the fact that the interpretation of the Directive proposed by the 
defendant (the Bank) fails to achieve the goal of protecting the payer in keeping 
with the general principle of refunding unauthorised transactions (as indicated in 
recital 76 of the preamble to the Directive), in the referring court’s opinion the 
TUKOWIECKA 
 
7 
aforecited provisions of the Directive should be interpreted as precluding the 
possibility of a service provider refusing to refund immediately to the payer the 
amount of an unauthorised payment transaction if the payer incurred the loss in 
connection with the unauthorised payment transaction by failing to fulfil his or her 
obligations with gross negligence. In that case, the amount of the unauthorised 
transaction should in the first place be refunded to the payer, and only then can the 
service provider seek to recover that amount in proceedings initiated against the 
payer. 
16 The proposed interpretation means that the burden of bringing an action, initiating 
proceedings, paying court fees, presenting evidence and drafting documents is 
shifted from the payer (often the consumer) to the specialist (the service provider). 
[…]