The CJEU endorses our strategy in court: banks can no longer withhold money from phishing scams

At LVG Legal, we have long been actively defending consumers against online banking fraud. In fact, our firm already had a track record of successful cases, such as the one handed down in Verbal Trial 630/2021, in which we successfully obtained a court order compelling a financial institution to fully reimburse our client the €4,500 stolen through social engineering techniques and mobile banking cloning.

At that time, the bank used the standard automatic response of financial institutions: blaming the user, claiming they had carelessly provided their passwords to avoid immediate reimbursement. However, the Spanish courts ruled in our favor, determining that phishing scams are potentially so effective that the victim's conduct cannot automatically be classified as gross negligence.

Today, the Court of Justice of the European Union (CJEU) elevates this criterion to a binding rule and definitively endorses the legal strategy that we defend at LVG Legal.

The recent and historic ruling of the European court (case C-70/25) confirms our legal argument: banks are obliged to reimburse stolen money immediately and can no longer hide behind the suspicion of customer negligence to withhold their savings.

Europe confirms the banking weaknesses we already uncovered

In the case we won in court, we proved that the financial institution failed to fulfill its due diligence duties by sending confusing SMS confirmation messages that did not disclose the phone number the fraudster was linking to online banking, and also lacked effective anti-phishing technology to detect and shut down fake websites that mimicked its official appearance.

The CJEU ruling reinforces this argument and establishes a strict order of action that financial institutions can no longer circumvent:

1. Immediate refund within 24 hours: When reporting an unauthorized transaction, the bank must reimburse the money by the end of the next business day at the latest.

2. Refund first, investigation later: The CJEU expressly prohibits banks from suspending or postponing refunds on the mere grounds that the user made a mistake. The money must be returned to the citizen's account immediately.

3. The burden of proof lies with the bank: If the bank considers that the client acted with malice or flagrant negligence, it will have to return the funds first and, subsequently, the entity itself will sue the user and prove said guilt before a judge.

A European legal victory that strengthens your case

The fact that the highest European court has validated point by point the line of defense with which we were already able to recover our clients' savings represents a complete paradigm shift. Financial institutions can no longer use bureaucratic labyrinths or standard responses to shirk responsibility for the security of their payment applications.

If you have been a victim of phishing, smishing (fake SMS) or digital identity theft from your bank, you have the unanimous support of European jurisprudence and the real experience of our firm.

Don't accept your bank's refusals. At LVG Legal, we offer you our proven track record of success in compelling banks to return your funds. You can request an online consultation with our lawyers or schedule an appointment in Monforte de Lemos so we can assess the viability of your case.