What to do if fraudulent charges appear on your card: What the rulings of the CJEU and the Supreme Court teach
The CJEU ruling of 1 August 2025: the duty to notify without delay
When a business owner, self-employed person, or individual detects an improper charge on their bank card, the immediate reaction may be concern, but the key is knowing how to act accurately and quickly.
Recent rulings by the Court of Justice of the European Union (CJEU) and the Spanish Supreme Court have reshaped how to deal with this type of computer fraud , such as phishing or SIM swapping.
The CJEU, in its judgment of 1 August 2025, established that a user of payment services may lose their right to a refund if they notify unauthorized charges late , even if they are within the general thirteen-month period provided for in the regulations.
The reason?
The obligation to communicate “without undue delay” is autonomous and failure to comply may be interpreted as gross negligence.
This criterion has important practical consequences: if the bank demonstrates that the cardholder acted late or failed to detect the charges despite them being available on their statement, it could deny the refund.
The support of the Spanish Supreme Court (judgment of April 9, 2025)
In this regard, the Spanish Supreme Court ruled that, unless the financial institution proves that the client acted with intent or gross negligence, it must assume the loss resulting from unauthorized transactions.
In the case being tried, Ibercaja had to return almost all of the more than 80.000 euros stolen through a computer scam , as it was unable to prove that the customer had provided data or acted imprudently.
What steps should a company or individual take when faced with card fraud?
Periodic review and immediate alert
The first defense is active surveillance.
In business environments, it is advisable to set up automatic alerts and frequent review of the statement.
At the slightest hint of irregularity, the account holder should contact their bank without delay.
Speed is now more relevant than ever.
Formal communication to the bank
The unrecognized charge must be reported in writing , detailing the transaction, the date on which the fact was known and the measures taken.
This immediate notification is key: if it is unjustifiably delayed, as occurred in the Veracash case analyzed by the CJEU, the bank can deny the refund.
Card blocking and security reinforcement
It is advisable to cancel the affected card, change passwords, and check other devices or systems that may have been compromised.
In companies, this should include reviewing internal IT security policies.
Gathering evidence and filing a complaint
All documentation must be kept : emails, screenshots, statements, communications with the bank.
It is also advisable to file a complaint with the authorities.
This step not only strengthens the legal position, but may also be necessary for certain insurance procedures.
Formal claim and legal advice
If the bank does not issue a refund, a complaint should be filed with the bank's Customer Service Department, and if no favorable response is obtained, with the Bank of Spain.
In any case, having legal advice from the very beginning can make the difference between recovering the money or losing it permanently.
The Veracash case: a lesson in lost diligence
In the case analyzed by the CJEU, the holder of a Veracash platform card was the victim of unauthorized withdrawals.
Although he notified within the thirteen-month period, he did so almost two months late with respect to the first charge.
The courts considered that delay to be gross negligence.
The CJEU supported this argument and established a clear doctrine: diligence is not measured solely by formal time, but also by effective speed.
It is not enough to act: you have to act well, and on time.
These rulings show that time is a determining factor.
Both companies and individuals must have clear protocols in place to address this type of fraud.
A proactive, well-documented, and legally sound approach not only strengthens the chances of success in your claim, but also conveys an image of professionalism to financial institutions.
At RRYP Global, we advise both companies and individuals on the recovery of amounts stolen through electronic fraud.
We have experience in claims against banking institutions, defending in legal proceedings, and designing compliance strategies to prevent future risks.
If you've been the victim of an improper charge on your card, act immediately.
And if you need legal support, we're here to help.
Frequently Asked Questions. FAQs
According to the CJEU ruling of August 1, 2025, users may lose their right to a refund if they notify the charge late, even within the general 13-month period. The obligation to notify without undue delay is independent, and failure to do so may be considered gross negligence.
The Supreme Court, in its ruling of April 9, 2025, determined that the bank must assume the loss unless it can prove that the customer acted with intent or gross negligence. In the resolved case, the bank had to return almost all of the stolen money because it failed to prove the customer's negligence.
Review your statement and notify your bank immediately. Speed is essential to avoid the bank denying your refund due to late notification.
In writing, detailing the operation, the date it was detected, and the measures taken. This immediate communication is key to protecting the right to reimbursement.
Block the affected card, change passwords, and review the security of other devices or systems. In companies, this includes reviewing internal IT security policies.
Because they serve to strengthen the claim and, in some cases, are necessary for dealing with insurance companies. This includes emails, screenshots, statements, and communications with the bank.
File a complaint with the bank's Customer Service Department and, if there is no favorable response, contact the Bank of Spain. Legal advice can make all the difference in the outcome.
Late notification, even within 13 months, can be considered gross negligence. In that case, the CJEU upheld the refusal to refund the money due to a delay of almost two months in reporting the first charge.
Not always. The entity is only obligated if it cannot prove that you acted with gross negligence or willful misconduct. If you prove that you acted diligently and quickly, your chances of recovering your money increase.
Phishing is a fraud technique in which a cybercriminal impersonates a legitimate entity to obtain your data. If they use this data to carry out unauthorized transactions, you could be charged fraudulent fees.
It's a technique in which the scammer duplicates your SIM card to intercept messages and calls, including verification codes. This allows them to authorize payments in your name.
RRYP Global.