A Payment Service User's Duty To Act "Without Delay" On Unauthorised Payments

The Court of Justice of the European Union (the "CJEU") examined the right of refunds of payment service users in the event of unauthorised transactions in the case of IL v. Veracash SAS (C-665/23), where it emphasised the relevance of timely reporting of fraud by the users in its ruling delivered on 1 August 2025. In the context of the EU's payment services regime, the key question addressed by the CJEU in this case was: should the payment service provider bear the liability if a customer delays notification of unauthorised payments, despite the notification being made within the legal timeframe?

Since the circumstances subject to the dispute date back to 2017, the CJEU applied the provisions of a repealed EU directive – Directive 2007/64/EC on payment services in the internal market (the "PSD"), which has since been replaced by Directive (EU) 2015/2366 (the "PSD2"). Nonetheless, the provisions of the PSD assessed by the court were practically retained in