.svg)
Consumers may lose their right to a refund for unauthorised card transactions if they do not report them promptly, even when notification is made within the 13-month statutory deadline, the European Court of Justice (ECJ) has ruled.
The decision follows a legal dispute in France involving a customer of Veracash SAS, a company that offers gold-backed deposit accounts.
In early 2017, Veracash issued a new withdrawal and payment card to the customer, and between March and May that year, daily withdrawals were made from the account.
However, the customer later claimed he never received the card and had not authorised any of the transactions.
Although he reported the transactions in May 2017, within 13 months of the debits, lower French courts rejected his request for a refund.
They found that the notification had not been made promptly enough, as required under national law implementing the EU’s Payment Services Directive (PSD2).
The consumer subsequently challenged the decision, prompting the case to be referred to the ECJ for clarification on how the directive should be interpreted.
Acting without delay
The ECJ held that the obligation to report unauthorised transactions without undue delay is a separate legal requirement from the 13-month absolute time limit.
It concluded that meeting the 13-month deadline does not excuse a delay in notifying the provider after becoming aware of the unauthorised activity.
The court also found that allowing late notification, even within that longer time limit, would undermine the regulatory framework intended to protect both consumers and payment service providers.
However, it also addressed situations involving lost, stolen or misused payment cards.
In such cases, consumers can lose their right to a refund only if they delayed reporting with intent or serious negligence. Payment service providers (PSPs) must prove that the transaction was properly authenticated and recorded in order to shift liability to the consumer.
When unauthorised transactions occur in succession using the same payment instrument, the consumer is liable only for those carried out after they became aware of the misuse but failed to report it promptly due to intentional or grossly negligent conduct.
The court said that this exception to the general rule should be interpreted narrowly, and requires a clear link between the consumer’s failure to act and the resulting losses.
Good news for payment firms
The ECJ ruling can be considered a victory for PSPs, given that it tips the balance slightly in their favour, without changing any of the key protections for the consumer provided under PSD2.
It confirms that PSD2 is designed to maintain a balance of responsibilities. Consumers still have solid protections, with the caveat that they apply only if individuals act quickly and responsibly when something goes wrong.
The ruling will give firms greater confidence rejecting refund claims where there has been an unjustified delay in reporting unauthorised transactions, and sets a clearer bar for user responsibility.
In addition, it strengthens PSPs’ ability to manage risk. Firms operating in this space can now rely on the ruling to reinforce user obligations around prompt reporting, and implement more structured processes for assessing refund claims.
This may ultimately improve fraud prevention and reduce misuse of refund mechanisms across the EU payments sector.
