When the Bank Picks Up the Bill, Who Actually Solves the Problem?

Security - Blog - Compliance - phishing / 29 October 2026

This blog is part of our series on sustainable compliance, on building frameworks that work not only on paper, but in practice. In this blog, we apply that thinking to a pressing societal question: the growing pressure on banks to reimburse phishing victims, even when the customer made serious mistakes. Not to challenge the outcome of court rulings, but to think through the behavioural effects and search for the real root cause.

The scale of the problem: the figures speak for themselves

Payment fraud in the Netherlands rose by 30 per cent in 2025 to approximately 658,000 cases. Total losses reached 198 million euros, an increase of 22 per cent compared to 2024. Of all daily payment transactions in the Netherlands, around 27 million per day, an average of 1,800 were fraudulent. That equates to over 540,000 euros in fraud losses every single day^[1].

Bank transfer fraud saw the sharpest rise: 55 per cent more cases, accounting for 148 million euros in losses. At the same time, the Fraudehelpdesk (the Dutch national fraud reporting centre) received more than 100,000 reports in 2025, a 60 per cent increase, with nearly 69 million euros in losses as a result^[2].

These are not abstract statistics. Behind each case is a consumer who has lost money, often through social engineering that can catch even a critical and digitally savvy person off guard. At the same time, the scale of the losses raises a fundamental question: are the measures we are taking proportionate to the cause, or are we treating the symptom?

A ruling that raises questions

Against this backdrop, the Antwerp court of summary proceedings confirmed in early June 2025 that banks must reimburse phishing victims promptly, and on a provisional basis, even where the customer was grossly negligent. Only afterwards may the bank attempt to prove that the customer bears responsibility for the loss.

In the Netherlands, a similar line had already emerged at Kifid, the financial complaints institute: in October 2024, Kifid ordered Knab to reimburse nearly 49,000 euros to a customer who had personally installed remote access software, shown his passport to the fraudster, and allowed six transactions to proceed.

At EU level, on 5 March 2026, Advocate General Rantos delivered his Opinion in Case C-70/25^[3]. His conclusion: a bank cannot refuse the immediate reimbursement of an unauthorised payment transaction solely on the ground that the customer was grossly negligent. Reimburse first, pursue liability later. On 15 October 2026, the Court of Justice of the European Union delivered its judgment, following the Advocate General's Opinion in full^[4].

The legal direction is clear. But is this the right solution to the real problem?

The legal framework: where does bank liability come from?

PSD1 (2007), The first European Payment Services Directive (2007/64/EC) established that banks are in principle liable for unauthorised payment transactions. The underlying rationale, widely recognised in case law and legal commentary, is that consumers are in a weak position relative to professional payment service providers. Banks hold the technical infrastructure, the detection capabilities and the authentication tools. Whoever is best placed to prevent fraud should also bear the liability when that fails. PSD1 still included a maximum consumer excess of €150 for loss or theft of a payment instrument, even in the absence of gross negligence.

PSD2 (2018), Article 73 of Directive 2015/2366/EU tightened this: payment service providers must refund unauthorised transactions immediately, and no later than the end of the business day following notification by the customer. Two exceptions apply: the bank may withhold or reclaim reimbursement if it proves the customer acted fraudulently, or if it has objectively justified grounds to suspect fraud by the customer, provided those grounds are communicated in writing to the competent national authority. The burden of proof for authentication and authorisation lies explicitly with the bank^[5], not with the consumer. PSD2 also introduced stronger requirements for Strong Customer Authentication (SCA): better security at the front end would reduce fraud. PSD2 reduced the consumer excess to €50.

In practice, things proved more resistant to change. Banks routinely departed from the immediate reimbursement obligation by invoking gross negligence as a front-end refusal ground, while the burden of proof was legally theirs to bear. The Belgian financial ombudsman Ombudsfin (2025), research by the Federation of German Consumer Organisations (vzbv), and rulings by Kifid all confirm this pattern. That is precisely what the recent rulings, and the CJEU judgment of 15 October 2026, directly address: consumers were forced to defend themselves, when it was the bank that was required to prove its case.

PSD3 and the PSR, what changes? In April 2026, a political agreement was reached on the texts of PSD3 and the new Payment Services Regulation (PSR); formal adoption is expected in 2026. Entry into force is expected by late 2027. The key changes:

Direct effect. The PSR will be a regulation with direct effect in all EU Member States, reducing national differences in the interpretation of concepts such as "gross negligence".
Broader reimbursement obligation. PSD3/PSR explicitly extends reimbursement obligations to authorised push payment (APP) fraud, situations where a consumer personally authorises a transfer on the basis of deception. A significant extension beyond PSD2.
Mandatory IBAN name check. Every credit transfer must include a check that the payee's name matches the IBAN. This already existed under the Instant Payments Regulation (IPR) and is now extended to regular transfers.
Regulated fraud data sharing. The PSR explicitly provides payment service providers with the ability to share fraud-related information within a structured framework, subject to GDPR safeguards.

PSD3/PSR therefore presents a mixed picture: broader protection for APP fraud victims, but Article 56 PSR simultaneously introduces a new mechanism allowing banks to delay immediate reimbursement for unauthorised transactions where they have "objectively justified reasons" to suspect gross negligence by the customer. Whether this strengthens or weakens consumer protection on balance will depend on how courts and supervisors interpret that new exception in practice, particularly given that the CJEU in Tukowiecka confirmed that the 2015 legislature deliberately excluded that ground from the directive. Furthermore, fraud data sharing is a facultative option, not an obligation, and it carries real risks in terms of privacy and unjustified suspicion based on algorithmic bias.

Behaviour follows incentives, on both sides of the line

If you think in systems, you know this: incentives drive behaviour. Not intentions, not awareness alone, but above all incentives. Against that background, it is defensible for the CJEU to place stronger incentives on banks: whoever controls the infrastructure and benefits from digital payments should also internalise the cost of prevention and residual losses. Without that incentive, a perverse pressure arises to shift responsibility and its consequences onto consumers rather than investing in measures that address the underlying causes.

On the consumer side. When a bank is required to reimburse, even where the customer acted carelessly, the consumer's risk calculus changes. Not consciously, not maliciously, but genuinely. Behavioural economists call this moral hazard: reduced caution because the consequences of risky behaviour are borne by someone else. A consumer who knows the bank will reimburse anyway has less incentive to scrutinise phishing messages carefully or to refuse requests to install remote access software. This is not a reproach, it is a predictable consequence of the structure of the incentive.

On the criminal side. Phishing is organised crime with a business model. If banks reimburse systematically, the net return on phishing increases: more harm that "works", less societal resistance, and indirectly more capital flowing back into the criminal ecosystem.

The costs are socialised. When banks are required to structurally cover phishing losses, the costs are not borne by the fraudsters or the careless consumer, but by all customers collectively. With 198 million euros in payment fraud in 2025 and an expected further increase driven by the extension of reimbursement obligations under PSD3, this is not a marginal item. The fraudster profits, the careless customer is made whole, and the bill is distributed across millions of customers who did nothing wrong.

The real root cause lies elsewhere, and that is where the problem lies

Phishing works for three reasons. Criminals can largely operate unhindered because they work across borders and are difficult to trace. Approximately 70 per cent of all online fraud now starts on social media, a figure the Dutch Banking Association (NVB) used in its public call to social media platforms to take greater action in April 2026^[6]. Consumers are insufficiently protected at the moment an attack takes place. And relevant data cannot be shared between the parties who could together detect and disrupt fraud in real time.

That last point is crucial. Banks, telecoms providers and other parties each hold pieces of the puzzle. A telecoms provider can see that a number is being used for spoofing. A bank can see an unusual transaction pattern. Another bank can see that a recipient account was previously linked to fraud. Together, they could detect and disrupt an attack in real time. At the same time, it is worth noting that combining multiple haystacks does not increase the number of needles: more data is not automatically better detection. Targeted, proportionate and quality-driven data sharing is what matters.

The sharing of data runs into principled privacy objections. Blacklists of fraudulent account numbers cannot be shared widely due to GDPR constraints. Coordinated real-time information exchange between the telecoms and financial sectors has been advocated for years by industry consortia, but has stalled against the positions of supervisors such as the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and political considerations around data sharing and surveillance.

This is not a criticism of the AP or of policymakers. These are genuine tensions between two equally legitimate values: privacy protection and fraud prevention. But it is a pressure point that needs to be named. PSD3/PSR offers a first concrete opening through structured fraud data sharing, whether that is sufficient to break the deadlock with the telecoms sector and supervisory authorities remains to be seen.

Conclusion: reimburse the loss, but solve the problem

The rulings requiring banks to reimburse phishing losses stem from a legitimate sense of fairness, and from a considered legal choice: by placing liability with the strongest party, the law corrects an asymmetry. Banks are best positioned to design systems, processes and customer interactions securely, and can invest in prevention and recovery at scale. Consumers are in a weak position, fraud is sophisticated, and banks have greater capacity to bear risk.

But feeling fair and being effective are two different things.

The trade-off between privacy protection and fraud prevention must be made explicit, and the opening provided by PSD3 must be used. Measures must be designed to shift behaviour in the right direction: increase consumer alertness, increase the risk for fraudsters, reduce losses. And if the reimbursement obligation is intended as a temporary lever to push banks to invest more seriously in prevention, make that explicit policy, link it to demonstrable prevention efforts, and build in an evaluation moment.

The figures speak for themselves: 198 million euros in losses in 2025, 30 per cent more than the year before, despite years of public awareness campaigns and existing reimbursement frameworks. As long as the real causes remain unaddressed, we are collectively paying the bill for a problem we are not solving.

This blog addresses a complex societal issue on which legal, political and ethical views diverge widely. The aim is not to take a political position, but to think through the behavioural dimension and identify the underlying causes.

Do you have questions, a different perspective, or would you like to explore how your organisation navigates the balance between privacy protection and fraud prevention? Get in touch with us. We are happy to think it through with you.