Banks are required to immediately refund victims of phishing for the amount of any unauthorised payments, even where there has been ‘gross negligence’. The Court of Justice of the European Union ruled as much on Thursday. If gross negligence is indeed established—for example, if the customer has handled their banking details carelessly—the bank may subsequently seek compensation. However, the bank bears the burden of proof.