EU court adviser says banks must immediately refund phishing victims

The Advocate General to the CJEU advised that banks must promptly refund customers for unauthorized payments resulting from phishing under PSD2 unless they have reasonable grounds to suspect customer fraud, while retaining the right to recover losses if they can prove the customer acted with gross negligence or intent; this is an advisory opinion and not a binding court ruling.