Liability for bank fraud: proof of gross negligence

1. The facts

   The case came to the attention of the Supreme Court of Cassation after an account holder suffered the unauthorized withdrawal of large sums from their account following a cyber attack. Unlike what happens in other proceedings, the claim for reimbursement had been upheld in the lower courts and the Supreme Court, with order 3780/2024, rejected the appeal by Poste Italiane S.p.A., confirming the order to refund. The plaintiff had challenged the vulnerability of the institution's IT system. The issue of fraudulent messages inserted into the same chain of official bank communications, capable of misleading even a moderately prudent user, constitutes instead a typical scenario highlighted by lower courts and the Banking and Financial Arbitrator (ABF) to exclude gross negligence. Other aspects of the case are covered in dedicated articles in this column.

2. 

   The rules at play

   The regulatory pillar is Legislative Decree 11/2010, which implements European directives on payment services.

   1. Article 10 establishes the burden of proof on the bank: if the user denies authorization, the institution must prove that the transaction was authenticated and did not suffer malfunctions.
   2. Article 12 limits the customer's liability only to cases of fraud or gross negligence in failing to comply with credential custody obligations.
   3. Article 1176 of the Civil Code imposes technical diligence on the banker, a professional parameter higher than that of the average person, requiring the adoption of the best available security technologies to prevent intrusions and spoofing phenomena.

3. What case law says

   Supreme Court case law has clarified that the intermediary must provide proof of the proper functioning of the systems, framing the issue within contractual liability under Art. 1176, paragraph 2, of the Civil Code and Legislative Decree 11/2010. The thesis that qualifies online banking as a dangerous activity under Art. 2050 of the Civil Code currently represents a minority view. The jurisprudential framework is not unequivocally pro-customer, but is divided: while on one hand the mere recording of system logs is not enough to demonstrate the user's gross negligence, on the other hand the Supreme Court, with order 7214/2023, established that handing over credentials to third parties following a deceptive email constitutes gross negligence, exonerating Poste Italiane S.p.A. from all liability.

6. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. For lawyers representing account holders, it is essential to produce screenshots and documentation demonstrating the plausibility of the fraudulent message to downgrade negligence from gross to ordinary.
   2. For institutional lawyers, the defense must focus on producing technical expert reports certifying system compliance with the highest PSD2 standards.
   3. It is always necessary to check whether the bank sent real-time alerts and whether it adopted automatic blocking systems for suspicious transactions to foreign accounts or beneficiaries never previously recorded.

9. Update and rectification note (17 September 2026)

   The previous version of this article incorrectly reported that Supreme Court case law had a consolidated orientation in favor of the account holder and that it qualified online banking as a dangerous activity. Furthermore, it attributed arguments about fraudulent messages in the official chain to the Supreme Court, which instead belong to lower courts and the ABF, and reported an inaccurate procedural history for Poste Italiane. The text has been corrected based on official documents: the Supreme Court frames the issue within contractual liability and presents a divided orientation, having rejected Poste's appeal with order 3780/2024, but having exonerated it due to the customer's gross negligence with order 7214/2023.

10. Developments: the Supreme Court's final decision

    With ruling no. 25013 published on 17 September 2024, the Supreme Court rejected the appeal by Poste Italiane, confirming the institution's liability for sums stolen through phishing. According to outlets such as Il Sole 24 Ore and Altalex, the decision solidifies the burden of proof: demonstrating the entry of codes is insufficient, as positive proof of the user's gross negligence is required. Diritto.it and Quotidiano Giuridico highlighted how the bank's professional diligence includes adopting updated biometric systems to prevent fraud, making reimbursement almost automatic in the absence of inexcusable negligence by the account holder.

References: D.Lgs. 11/2010Art. 1176 c.c.Art. 2050 c.c.Cass. 7214/2023Cass. 3780/2024

Editorial oversight: Avv. Federico Papa·ICAMUpdated 24 September 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction