The payment card user is deprived of the right to obtain a refund of an unauthorised payment transaction of which he or she has become aware if he or she delayed in notifying it to his or her provider with intent or gross negligence (CJEU)

Judgment of the Court of Justice (1.8.2025) in Case C-665/23: Payment services: the payment card user is deprived of the right to obtain a refund of an unauthorised payment transaction of which he or she has become aware if he or she delayed in notifying it to his or her provider with intent or gross negligence This is the case even if he or she notified it to the payment institution within 13 months from the debit date.

A consumer holds a gold deposit account with the company Veracash SAS. In March 2017 Veracash sent him a new withdrawal and payment card. Between March and May 2017, daily withdrawals were made from that account. The consumer in question claims, however, that he never received that payment card or authorised such withdrawals. 

The Regional Court, Évry, (France), followed by the Court of Appeal, Paris, (France), dismissed his request for refund on the ground that the withdrawals at issue had not been notified to Veracash ‘without undue delay’, as required by the Monetary and Financial Code which transposes the Directive on payment services in the internal market, [1] but only in May 2017, that is to say, almost two months after the first contested withdrawal. 

However, that notification had indeed been made within the maximum time limit of 13 months as laid down by law. [2] The consumer brought an appeal on a point of law. It is in this context that the French Court of Cassation has turned to the Court of Justice. It wishes to ascertain whether the directive in question must be interpreted as meaning that it permits the payer to be deprived of the right to a refund of an unauthorised transaction in the event of a delayed notification, even if that was done within the 13-month time limit.

In addition, if so, it asks whether that deprivation presupposes gross negligence or intentional conduct on the part of the payer, and whether it concerns all unauthorised transactions or only those which could have been avoided. 

First, the Court replies that the payment service user is, in principle, deprived of the right to obtain a refund if he or she has not notified his or her payment service provider without undue delay that he or she has become aware of an unauthorised payment transaction, even though he or she has notified it within 13 months after the debit date. 

The Court clarifies that the obligation to notify ‘as soon as possible’ is autonomous and differs from the obligation to notify within the 13-month time limit after the debit date of an unauthorised payment transaction. The objective time limit of 13 months, by its very nature, does not detract from the relevance of the subjective time limit to notify ‘without undue delay’. 

The Court considers, in that regard, that mere compliance with the 13-month time limit, as the sole criterion, is liable to compromise the preventive objective of the obligation to notify an unauthorised transaction ‘without undue delay’ where that has been established. 

Furthermore, to consider that the payment service user is entitled to obtain rectification of an unauthorised payment transaction of which he or she was aware, but which he or she delayed in notifying to his or her payment service provider, would undermine legal certainty and the balancing of the respective interests of the payment service user and his or her payment service provider, envisaged by the EU legislature when it adopted the directive on payment services in the internal market. 

Second, the Court specifies, however, that in the event of the loss, theft, misappropriation or any other unauthorised use of a payment instrument, such as a bank card, the payer is, in principle and unless he or she has acted fraudulently, deprived of his or her right to obtain a refund of an unauthorised transaction only if he or she delayed in notifying it with intent or gross negligence consisting of a serious breach of a duty of care. In essence, the burden of proof lies with the payment service provider, who must prove that the transaction has been authenticated, accurately recorded and entered in the accounts. 

The Court recalls that this preserves the effectiveness of the directive since it provides that the payer does not bear any financial consequences resulting from the use of a lost, stolen or misappropriated payment instrument which occurred after the notification. The payer therefore has no interest in delaying the notification which he or she is required to make. 

Third, the Court replies that in the event of successive unauthorised payment transactions carried out by made by means of the same payment instrument which is lost, stolen, misappropriated or used without authorisation, the payer is, in principle, deprived of the right to obtain a refund only of the losses resulting from transactions which he or she delayed in notifying with intent or gross negligence. It considers that the provision concerning the liability of the payer in the case of unauthorised payment transactions is a derogating provision and must therefore be interpreted strictly. 

Lastly, the Court notes that the requirement of a causal link between the payer’s conduct and the losses for which the payer cannot obtain a refund is consistent with the balancing of the respective interests of payment service users and payment service providers. (curia.europa.eu/ photo:freepik.com)

Full text of the decision is available here

______________

1 Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC. 

2 Article 58 of the directive in question states that ‘the payment service user shall obtain rectification from the payment service provider only if he notifies his payment service provider without undue delay on becoming aware of any unauthorised or incorrectly executed payment transactions giving rise to a claim … and no later than 13 months after the debit …’.