Bank scam refund: what your bank must prove and what to document for a complaint
EU law separates the refund from the question of who finally bears the loss, and the facts you can show shape what comes next.
A bank scam refund under EU rules turns on how the payment is classified. For an unauthorized transaction, the bank must refund immediately, provided you notify without undue delay, at the latest by the end of the next business day, and must prove any gross negligence if it later wants the money back (Court of Justice, Case C-70/25, October 15, 2026). A transfer you placed yourself while deceived follows a narrower path. TrueScreen counters bank fraud and the disputes that follow by certifying messages and fake pages with a forensic methodology while they still exist, so your account of events has something behind it when it is contested.
Key takeaways
- A bank cannot refuse an immediate refund of an unauthorized transaction by alleging your gross negligence (Court of Justice, Case C-70/25, October 15, 2026).
- The refund may not be final: the bank can later seek to recover the losses, but it must prove intent or gross negligence (PSD2 Article 72(2), judgment paragraph 40).
- The ruling does not establish how to classify a transfer you placed yourself while deceived, where national law carries much of the weight (PSD2 Article 73, Case C-70/25).
- The Council’s text of the EU Payment Services Regulation would add a refund for bank impersonation, with conditions, and is not in force (Article 60 in the Council’s text, October 29, 2026).
- Complaints start with the bank, which should reply within 15 business days, then move to a national regulator or out-of-court body (PSD2 Articles 99, 101 and 102).
76%
of 100 fraud and compliance leaders at Italian banks say their institution loses over $10 million a year to fraud (declared)
BioCatch vendor survey, 2026
68%
of the same respondents say fraud losses at their institution are rising (declared)
BioCatch vendor survey, 2026
54%
of the same respondents name messaging apps among the most prominent scam channels (declared)
BioCatch vendor survey, 2026
Many bank scams start in a chat or on a phone. In a survey commissioned by BioCatch, an anti-fraud vendor, 54% of 100 fraud and compliance leaders at Italian banks named messaging apps among the leading channels where scams originate.
A bank scam refund depends on how the transaction is classified, however clever the deception was, and in October 2026 the Court of Justice ruled on immediate refunds while the Council adopted its position on a regulation covering bank impersonation. The fake messages and cloned pages behind the loss, meanwhile, keep disappearing. TrueScreen tackles that gap by certifying those traces before they are gone, so you are not left arguing from memory.
An unauthorized transaction is refunded first, with any gross negligence for the bank to prove afterward, while a transfer you placed yourself leans on national law. Either way, you stand on firmer ground if others can check your facts. This article covers EU rules and is general information, not legal advice.
What is a bank scam, and why does classification decide the refund?
The same scam can fall under different rules, depending on who gave the payment instruction and through which channel the deception arrived.
A bank scam is a fraud in which someone uses a fake bank contact, stolen banking credentials or a deceptive payment request to get money out of your account. TrueScreen steps in where that fraud turns into a dispute, putting on record, in a form a third party can check, the message you received and the page you were sent to. Under PSD2, Directive (EU) 2015/2366, a transaction counts as authorized only if the payer has given consent to execute it (Article 64).
Phishing, smishing, vishing and the fake bank agent
Phishing collects your login details through a fraudulent link or email, smishing by text message and vishing by voice call. In spoofing, fraudsters pretend to be your bank and misuse its phone number, website or app, as the Council’s text on the future regulation describes. The label alone settles nothing:
| Situation | Rule | Who proves what | Status |
|---|---|---|---|
| Unauthorized transaction: someone else moves the money | Immediate refund if you notify without undue delay, save for reasonable grounds for suspecting fraud committed by the customer, communicated to the national authority | The bank proves authentication and, to recover the loss later, your intent or gross negligence | In force: PSD2, as interpreted in C-70/25 |
| Transfer you placed yourself after being deceived | The immediate refund rule is written for unauthorized transactions, and C-70/25 does not classify this case | Largely national law, plus the bank’s duties on verification of payee | In force: PSD2, Regulation (EU) 2024/886 |
| Consumer manipulated by someone posing as the bank on its channels, payment authorized | Full refund if the consumer notifies the bank without undue delay and reports to the police, unless acting fraudulently or with gross negligence | The bank carries the burden on fraud or gross negligence | Not in force: Council’s text, may change |
Unauthorized transactions: what the Court of Justice ruled in C-70/25
A bank cannot refuse an immediate refund of an unauthorized transaction on the ground that your gross negligence made it possible.
In Case C-70/25, decided on October 15, 2026, the Court of Justice interpreted PSD2 in the case of a Polish customer selling an item online. A supposed buyer’s link led her to a site imitating her bank, where she entered her login details. A third party moved about €700, she told the bank the next day, and it refused to pay.
The refund comes first, negligence is argued later
Suspected gross negligence does not entitle a bank to refuse, the Court held in its judgment. According to press release No 147/26, the money is due immediately, at the latest by the end of the business day after the bank noted or was notified of the transaction, provided you notify it without undue delay. If banks could refuse up front, the Court reasoned, customers would have to start proceedings themselves, with the costs and inconvenience involved. Because the timing of your notice matters, TrueScreen can certify the content and date of the email as it receives it when you add its dedicated address in Cc.
When a bank can still decline to refund after phishing
Reasonable grounds for suspecting fraud committed by the customer, communicated in writing to the national authority, are the only exception to immediate payment. A bank scam refund may also not be final: the bank can later seek to recover the losses if it establishes that they resulted from your deliberate or grossly negligent breach of your obligations.
That burden is on the bank (paragraph 40 of the judgment, citing PSD2 Article 72(2)), and a log showing your payment instrument was used is not necessarily enough to meet it. PSD2 Article 71 asks you to notify without undue delay and no later than 13 months after the debit date.
In the Council’s text of the EU Payment Services Regulation, which is not in force and may change, Article 57 would allow a wider exception than the one the Court identified under PSD2: the next-business-day refund would not apply where the bank has objectively justified reasons to suspect that the payer failed with intent or gross negligence to meet their obligations, and tells the payer those grounds in writing, or to suspect that the payer acted fraudulently. The bank would then have 15 business days to refund or refuse with reasons.
What the ruling does not say
The Court of Justice interprets PSD2 and leaves the case to the Polish court. Its answer presupposes an unauthorized transaction and does not establish how to classify a transfer ordered by a deceived customer, or a payment validated with a one-time passcode the customer handed over.
Transfers you made yourself: the rule today and the one on the way
A customer tricked into placing a transfer has a narrower path to a bank scam refund today, and the Council’s text would strengthen it for only one kind of scam.
Authorized push payment fraud is the usual name for this type of bank transfer scam: you send the money yourself, to someone posing as a genuine payee.
What EU law says today
PSD2’s immediate refund is written for unauthorized transactions, so a bank scam refund on a transfer you placed yourself rests largely on national law and national bodies. Regulation (EU) 2024/886 added verification of payee: before you authorize a credit transfer, your bank checks the account identifier against the payee’s name and warns you of a mismatch. Euro-area banks had to comply by October 9, 2025, and others have until July 9, 2027. A bank that provides the service correctly is not liable for a transfer reaching an unintended payee, and the check cannot tell you whether the person behind a name is honest.
The UK is outside the EU: its Payment Systems Regulator has set separate mandatory reimbursement rules for this fraud since October 7, 2024, which this article does not cover.
Instant transfer scams: can you get the money back?
Recovery from an instant transfer is never guaranteed. Under PSD2 Article 80, you cannot in general revoke a payment order once your bank has received it, unless you and the providers involved agree, and Regulation (EU) 2024/886 requires the money to reach the payee’s account within 10 seconds. Ask your bank to attempt a recall of the transfer at once and keep a record of when you asked.
What the EU Payment Services Regulation would add for bank impersonation
In the text the Council adopted on October 29, 2026, Article 60 (the numbering may change) would have the bank refund a consumer in full for an authorized payment when a third party posing as that bank, on channels attributed to it, manipulated the consumer into making it, provided the consumer notified the bank without undue delay and reported to the police, and unless the consumer acted fraudulently or with gross negligence. Within 15 business days of the notice and police report, the bank would refund or give reasons for refusing.
None of this is in force. The European Parliament’s second reading is still to come, the text can change, and it would apply 21 months after entry into force. It would not cover a fake relative or a fake police officer.
Before concluding that you acted fraudulently or with gross negligence, the bank would have to invite your account of events and take it into account. Silence would not settle the matter by itself, and you could not be expected to produce what a consumer cannot reasonably have, such as voice call recordings. The text asks for information, not certified material. Whether the contact came through the bank’s channels is a condition of that rule, so a record of what appeared on your screen is relevant. TrueScreen certifies the thread and the page as you saw them, though that cannot prove the message came from your bank.
Bank scams in Italy: what fraud leaders told BioCatch
The BioCatch survey records what a sample of bank managers report, and it does not measure fraud across banks or across the EU.
Among the 100 leaders at Italian banks surveyed for BioCatch, an anti-fraud vendor, in results published on November 4, 2026, 76% say their institution loses more than $10 million a year to fraud and 68% say losses there are rising. And 73% report planned or current changes to reimbursement policies ahead of new EU rules, which says nothing about whether a given customer will get a bank scam refund.
What to document after a bank scam, step by step
Your bank carries the burden on negligence, while the record of what the scammer said is usually in your hands.
EU texts set no single list of documents for a bank scam refund, so start from the facts your situation turns on:
| Situation | Facts worth documenting |
|---|---|
| Unauthorized transaction | When you noticed and told the bank, plus the message and page that captured your credentials |
| Transfer you placed yourself | The conversation behind it, the payment details given, any verification of payee warning, your recall request |
| Impersonation of your bank, if the Council’s text becomes law | The sender name or number displayed, the message thread, the fake page’s address, your police report |
-
Tell your bank without waiting
Report the transactions you dispute through the channel your bank provides, and ask it to block the payment instruments involved. If you also write by email, adding your workspace’s Mail Certification address in Cc certifies the message as TrueScreen receives it, recording what you said and when.
-
Report it to the police
PSD2’s refund article does not list a police report as a condition, while the Council’s text would. File one anyway: this guide explains how to report an online scam.
-
Save messages, pages and the timeline before they vanish
A text thread can be cleaned up and a fake page taken down overnight, so save those first, then list calls, messages and payments by date. See the guides on certifying WhatsApp chats and capturing clone sites. If a call was recorded, keep it and use it only for your police report and complaint. Do not contact the scammer, share the chat publicly or access anyone else’s account.
-
File the complaint with your bank
State the facts of your bank scam refund claim in date order and attach what you saved. PSD2 Article 101 requires banks to make every possible effort to reply within 15 business days, or within 35 in exceptional situations.
-
Go to the regulator or an out-of-court body
An unresolved bank scam refund complaint goes next to your national regulator or an out-of-court body, which differ by country (PSD2 Articles 99 and 102). A lawyer or consumer association can tell you which applies.
What can TrueScreen help you demonstrate after a bank scam?
TrueScreen secures with a forensic methodology what a scammer tends to delete, so your bank, a regulator or a judge can check how and when that material was acquired.
The decision on a bank scam refund stays with the bank and the competent bodies. A conversation on your phone is certified through a screen recording in the TrueScreen App while you scroll, on the device that received it. Fake pages and web chats such as WhatsApp Web go through the Forensic Browser, which also captures network traffic and attachments. Screenshots you already took can be certified as files, which establishes their content and date from that moment but not how they were acquired, so record the conversation itself while it exists.
A technical report records SHA-256 hashes, certified time and metadata, and a qualified electronic seal and qualified timestamp complete the process. The seal of the certification can be verified without TrueScreen using the European Commission’s public tool, EU DSS. The result can be presented in court with legal and evidentiary value, with the judge deciding its weight.
A certification attests how content was acquired, not that it is true. It does not identify the scammer or prove a message came from your bank, and it replaces neither your notice to the bank nor a police report.
Take an invented example: a text lands in the thread of a customer’s real bank alerts, a supposed bank agent calls, a link opens a cloned page, and money leaves within minutes. Before the thread and the page disappear, she certifies them and attaches the result to her police report and complaint. The bank still decides, now with a sequence of events it can check.
Conclusion
After a bank scam, the first questions are legal ones: who authorized the payment, when you told the bank, and through which channel the deception arrived. EU law now puts the immediate refund of an unauthorized transaction ahead of any argument about negligence, while a transfer you placed yourself still depends largely on national law and on rules that are not yet in force. TrueScreen does not decide whether a refund is due. It leaves less room for argument about what happened, and gives the bank and the bodies that review its decision a record they can check.
FAQ: bank scam refunds under EU rules
Can you claim money back if you have been scammed?
A bank scam refund depends on how the payment is classified. Under PSD2, an EU bank must refund an unauthorized transaction immediately if you notify it without undue delay. A transfer you placed yourself while deceived falls outside that wording, so national law matters more, and no result is guaranteed.
When does a bank have to refund you after phishing?
When phishing leads to an unauthorized transaction, the Court of Justice held in Case C-70/25 that the bank cannot refuse an immediate refund by alleging your gross negligence. The only exception is reasonable grounds for suspecting fraud committed by the customer. The bank may later seek to recover the losses by proving intent or gross negligence.
What is the bank responsible for in a phishing case?
Under PSD2 Article 72, when you deny authorizing a payment, an EU bank must prove it was authenticated, accurately recorded and not affected by a technical breakdown. Its record that your payment instrument was used is not necessarily enough to show authorization, fraud or gross negligence.
Can a bank transfer be reversed once it has been credited?
You cannot reverse a bank transfer on your own. PSD2 Article 80 says a payment order cannot in general be revoked once your bank has received it, unless you and the payment service providers involved agree. Ask your bank immediately to attempt a recall, and treat recovery as possible but never guaranteed.
How can you file a complaint against a bank after a scam?
To pursue a bank scam refund, start with the bank’s own complaint procedure: PSD2 Article 101 calls for a reply within 15 business days, or 35 in exceptional situations. The national regulator or out-of-court body comes next, and differs by country. TrueScreen certifies the messages and pages you attach, so whoever reads the complaint can check how they were acquired.
Sources and verification
Every figure and principle cited here links to its source, listed with type and date. Links checked on the publication date.
| Source | Type | Date | What it supports |
|---|---|---|---|
| Court of Justice of the EU, Case C-70/25, judgment (provisional text) | Case law | 15/10/2026 | A bank cannot refuse an immediate refund by alleging gross negligence; burden of proof on the provider |
| Court of Justice of the EU, press release No 147/26 | Document | 15/10/2026 | Refund deadline, only exception, later recovery of losses, the Court’s reasoning and the facts of the case |
| PSD2, Directive (EU) 2015/2366, Articles 64, 71, 72, 73, 80, 99, 101, 102 | Law | 2015 | Consent, notification, burden of proof, refund, revocation, complaints and out-of-court procedures |
| Regulation (EU) 2024/886 | Law | 2024 | Verification of payee and the 10-second instant transfer rule |
| Council of the EU, position at first reading on the EU Payment Services Regulation, doc. 8543/1/26 REV 1 | Document | 2026 | Article 57 on the wider exception to immediate refund, Article 60 on impersonation fraud, recitals on spoofing and on the consumer’s information, application after 21 months |
| Council of the EU, statement of reasons, doc. 8543/1/26 REV 1 ADD 1 | Document | 29/10/2026 | Adoption by the Council and the pending second reading in the European Parliament |
| BioCatch, survey of 100 leaders at Italian banks (vendor press release) | Survey | 04/11/2026 | Declared figures on fraud losses, scam channels and reimbursement policies |
| UK Payment Systems Regulator, APP fraud reimbursement protections | Document | 2024 | The UK’s separate regime, in place since October 7, 2024 |
A record of the scam you can show
TrueScreen certifies messages, pages and emails with a forensic methodology, so your bank and the bodies that review its decision can check how and when they were acquired.
TrueScreen editorial team
Published on · Updated on
This section is edited by the TrueScreen editorial team, which brings together expertise in digital forensics, the law of digital evidence and regulatory compliance. Every article is checked against primary sources: legislation, published rulings, technical standards and official documentation, always cited in the text.
Editorial Team and Methodology →
