# Dutch banks must repay phishing victims first, EU court says

> Customers hit by phishing and similar fraud must be paid back immediately, even if they were seriously negligent, the European Court of Justice has ruled. Dutch banks will each assess what it means for their procedures.

Economy · published 2026-10-21 09:59 · https://nlnow.nl/a/banks-must-refund-phishing-victims-first-eu-court-rules/

The European Court of Justice ruled last week that customers who fall victim to phishing and similar fraud must be compensated immediately. This applies even if the customer was seriously negligent. The bank has to refund the amount first.

Afterwards the bank can try to recover the loss from the customer. To do so, it must show that the loss arose because the customer intentionally or through gross negligence failed to meet their obligations.

The Dutch banks' association, the Nederlandse Vereniging van Banken (NVB), says the ruling concerns the moment of repayment. "And that does not change who ultimately has to bear the loss," a spokesperson said. "Banks will each assess the consequences of the ruling for their own processes and procedures."

The ruling followed a case in which a customer of a Polish bank fell victim to a phishing attack. She was misled on a sales site and clicked a link to a website that closely resembled her bank's. €700 disappeared from her account.

## Background

- **NVB (Nederlandse Vereniging van Banken)**: The Dutch Banking Association is the trade organisation of banks operating in the Netherlands. It represents the sector's shared interests, coordinates joint arrangements between member banks, and speaks on their behalf to government, regulators and the public on policy and industry matters. Its statements are often the sector's official position on new rules or court decisions that affect banking customers.

From NLnow, news from the Netherlands in English. How stories are made: https://nlnow.nl/about/