62023CJ0665_RES
Case C‑665/23
IL
v
Veracash SAS
(Request for a preliminary ruling from the Cour de cassation (France))
Judgment of the Court (Fourth Chamber) of 1 August 2025
(Reference for a preliminary ruling – Payment services in the internal market – Directive 2007/64/EC – Article 56(1)(b) – Obligation for the payment service user to notify the payment service provider ‘without undue delay’ of the loss, theft, misappropriation or unauthorised use of his or her payment instrument – Article 58 – Notification of unauthorised payment transactions – Rectification of such a transaction by the payment service provider subject to the obligation for the user of those services to notify that transaction ‘without undue delay … and no later than 13 months after the debit date’ – Articles 60 and 61 – Respective liabilities of the payment service provider and of the payer for unauthorised payment transactions – Successive unauthorised payment transactions resulting from the loss, theft, misappropriation or unauthorised use of a payment instrument – Delayed notification without intent or gross negligence – Scope of the right to a refund)
Approximation of laws – Payment services in the internal market – Directive 2007/64/EC – Payment service provider’s liability for unauthorised payment transactions – User not having notified those transactions to the provider without undue delay, despite having notified them within 13 months after the debit date – Deprivation, in principle, of the right to obtain rectification of the transactions
(European Parliament and Council Directive 2007/64, Art. 58)
(see paragraphs 37, 40-44, 46-51, 56, operative part 1)
Approximation of laws – Payment services in the internal market – Directive 2007/64/EC – Payment service provider’s liability in the case of unauthorised payment transactions – Unauthorised transaction resulting from the use of a lost, stolen or misappropriated payment instrument or any unauthorised use of such an instrument – User having notified that transaction to the provider within 13 months after the debit date – Delayed notification of the transaction with intent or gross negligence – Deprivation of the right to obtain rectification of that transaction – Whether permissible
(European Parliament and Council Directive 2007/64, Arts 56(1)(b), 58, 60(1) and 61(2))
(see paragraphs 62-65, 67-71, 76, and operative part 2)
Approximation of laws – Payment services in the internal market – Directive 2007/64/EC – Payment service provider’s liability in the case of unauthorised payment transactions – Successive unauthorised payment transactions resulting from the loss, theft, misappropriation or unauthorised use of a payment instrument – User having notified these transactions to the provider within the time limit of 13 months after the debit date – Individual transactions notification of which was delayed with intent or gross negligence – Deprivation of the right to obtain rectification only for those transactions – Whether permissible
(European Parliament and Council Directive 2007/64, Arts 56(1)(b), 58, 60(1) and 61(2))
(see paragraphs 82-85, 87-90, operative part 3)
Résumé
In the context of a dispute concerning the refusal to refund an individual for allegedly unauthorised withdrawals of money, on account of a notification which was held to be delayed, the Court clarifies certain aspects of liability for unauthorised transactions carried out by means of a payment instrument, in accordance with Directive 2007/64, (
1
) taking into account the balance established by the legislature between the interests of the payer and those of the payment service provider.
IL is a natural person who holds a deposit account with Veracash. On 24 March 2017, Veracash sent to IL’s address a new cash withdrawal and payment card.
On 23 May 2017, IL notified Veracash that daily withdrawals had been made from that account between 30 March 2017 and 17 May 2017, while he had neither received the new payment card nor authorised those withdrawals.
For that reason, he initiated legal proceedings in order to obtain, inter alia, a refund of the sums corresponding to those withdrawals.
Following the dismissal of his action by the cour d’appel de Paris (Court of Appeal, Paris, France), which held that the notification to Veracash of the withdrawals at issue was delayed, since it was made almost two months after the first contested withdrawal, IL brought an appeal on a point of law before the Cour de cassation (Court of Cassation, France), which is the referring court.
The referring court states that the outcome of that dispute depends, inter alia, on whether the payment service provider can refuse to refund the amount of an unauthorised transaction where the payer, despite having notified that transaction before the expiry of the 13-month time limit after the debit date, as provided for under Article 58 of Directive 2007/64 and under national law, (
2
) delayed in doing so, without that delay having been intentional or the result of gross negligence on his or her part.
Noting that the relevant provisions of national law must be interpreted in the light of Directive 2007/64, the referring court has referred questions to the Court of Justice for a preliminary ruling on the interpretation of that directive.
Findings of the Court
In the first place, the Court considers that the payment service user is, in principle, deprived of the right to obtain rectification of a transaction if he or she did not notify his or her payment service provider without undue delay on becoming aware of an unauthorised payment transaction, even though he or she notified it to that payment service provider within 13 months after the debit date.
According to the wording of Article 58 of Directive 2007/64, the payment service user is subject to a twofold temporal condition: the user must both notify his or her payment service provider without undue delay on becoming aware of an unauthorised payment transaction – an obligation which is triggered when that payment service user becomes aware of that transaction and compliance with which must be assessed in the light of the circumstances in which he or she finds him or herself – and make that notification within 13 months of the debit date.
The obligation to notify ‘without undue delay’ therefore differs from the obligation to notify within the 13-month time limit after the debit date, as also suggested by the use of the terms ‘should inform … as soon as possible’ in recital 31 of Directive 2007/64.
Furthermore, in the event that the obligation to notify the loss, theft, misappropriation or any unauthorised use of a payment instrument, in accordance with the requirements of Article 56(1)(b) of Directive 2007/64, (
3
) arises simultaneously with the notification obligation laid down in Article 58 of that directive, it would be inconsistent to consider that the notification obligation under Article 58 may be duly fulfilled by mere compliance with the 13-month time limit after the debit date, whereas the obligation laid down in Article 56 must be carried out more expeditiously.
Lastly, the obligation to notify ‘without undue delay’ laid down in Article 58 of Directive 2007/64 has a preventive objective of reducing the risks and consequences associated with unauthorised transactions. That objective would be undermined if that obligation could be deemed to be fulfilled by mere compliance with the time limit of 13 months after the debit date. Moreover, the objective of the obligation to notify within the 13-month period, which is to ensure legal certainty for the parties, (
4
) would also be undermined if the payment service user were entitled to obtain rectification of an unauthorised payment transaction of which he or she was aware, but which he or she delayed in notifying to his or her payment service provider. The existence of two distinct objectives supports the fact that Article 58 imposes two separate temporal conditions.
In the second place, the Court specifies, however, that, in the event of an unauthorised payment transaction resulting from the use of a lost, stolen or misappropriated payment instrument, or from any unauthorised use of such an instrument, and where that transaction has been notified by the payer to his or her payment service provider within 13 months after the debit date, that payer is – in principle and except where that payer has acted fraudulently – to be deprived of his or her right to obtain actual rectification of that transaction only if he or she delayed in notifying it to his or her payment service provider with intent or gross negligence consisting in a serious breach of a duty of care.
In that regard, it is apparent from the first sentence of Article 61(2), Article 56(1)(b) and Article 60(1) of Directive 2007/64 that it is only where the payment service user acts fraudulently or has delayed, with intent or gross negligence, in notifying his or her payment service provider or the entity specified by that provider of the loss, theft, misappropriation or unauthorised use of that payment instrument that the payment service provider is relieved of its obligation to refund to the payer the amount of the unauthorised payment transactions resulting from such an event.
In the third and last place, the Court specifies that, in the event of successive unauthorised payment transactions resulting from the use of a lost, stolen or misappropriated payment instrument or any unauthorised use of such an instrument, the payer may be deprived of the right to a refund only in respect of the losses resulting from the transactions which he or she delayed in notifying to his or her payment service provider with intent or gross negligence.
First of all, the wording of Article 61(2) establishes a causal link between, first, the payer’s conduct and, second, the losses incurred in respect of which he or she cannot obtain rectification. Next, since Article 58 of Directive 2007/64 expressly refers to the notification of individual payment transactions, the delayed nature of the notification must be assessed separately for each transaction.
That literal interpretation is supported by the context in which the relevant provisions of Directive 2007/64 occur and by the objectives pursued by that directive. First, both Article 61(4) (
5
) and Article 61(5) (
6
) of that directive confirm that the payer cannot be held liable for losses which he or she could not have avoided. Second, since that directive requires a causal link between the payer’s conduct and the losses incurred, it balances the interests of payment service users and payment service providers. Thus, the user has an incentive promptly to notify any unauthorised transaction of which he or she becomes aware, whereas the provider must fulfil his obligations to allow the user to be able to become aware of such transactions.
(
1
)	Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC (OJ 2007 L 319, p. 1, and corrigendum OJ 2009 L 187, p. 5).
(
2
)	Article L-133-24 of the Code monétaire et financier (Monetary and Financial Code), in the version resulting from Order No 2009-866 of 15 July 2009 on the conditions governing the supply of payment services and creating payment institutions (JORF of 16 July 2009, text No 13, and corrigendum JORF of 25 July 2009, text No 18).
(
3
)	In accordance with that article, the payment service user entitled to use a payment instrument has the obligation, on becoming aware of the loss, theft, misappropriation or unauthorised use of his or her payment instrument, to notify the payment service provider, or the entity specified by that provider, without undue delay.
(
4
)	See, to that effect, judgment of 2 September 2021, CRCAM, C‑337/20, EU:C:2021:671, paragraphs 48 to 52.
(
5
)	In accordance with that article, except where the payer has acted fraudulently, the payer is not to bear any financial consequences resulting from the use of a lost, stolen or misappropriated payment instrument which occurred after the notification provided for in Article 56(1)(b) of Directive 2007/64.
(
6
)	In accordance with that article, if the payment service provider does not provide appropriate means for the notification at all times of a lost, stolen or misappropriated payment instrument, as required under Article 57(1)(c) of Directive 2007/64, the payer shall not be liable for the financial consequences resulting from use of that payment instrument, except where he or she has acted fraudulently.