The European Court of Justice, based in Kirchberg, issued the ruling in a case linked to so-called LuxTrust fraud cases. It found that the bank must reimburse any unauthorised amount first. Only afterwards may it seek to claw the funds back from the client, if appropriate.
The decision effectively reverses the usual order of liability between banks and their clients.
A bank does not have to issue a refund if the payment service provider has strong grounds to suspect that the client committed fraud themselves.
The ruling follows a case brought by a customer of a Polish bank who fell victim to a phishing scam.
In Luxembourg, several victims of such scams have taken local banks to civil court in similar circumstances.
