The key change in the Advocate General’s opinion is procedural, not just protective: under PSD2, a bank should refund a phishing victim first and argue about customer negligence later. The only stated basis for delaying reimbursement is suspected customer fraud, and even that requires written notification to the relevant national authority. What the opinion actually […]