Phishing and the Burden of Proof: The Rule as Consolidated in 2026

The principle that digital fraud is not presumed but must be proven is now the pivot of this field. The question is no longer whether the bank must compensate, but whether it has managed to prove that the account holder acted with gross negligence. The 2026 case law has done little but give concreteness to this shift of the burden.

The burden of proof lies with the bank

In cases of digital fraud the credit institution must demonstrate two things: the technical regularity of the operation, and the adoption of systems suitable for preventing or limiting fraudulent use of payment instruments. Technical regularity alone is not enough: this is the consolidated principle, and the reason why the risk of fraud weighs on whoever runs the system (Art. 64 PSD2).

In other words: if the bank does not prove that it adopted adequate security measures, the fraudulent operation remains attributable to it. The outcome depends on the evidence, not on its subjective good faith.

Client gross negligence: a test, not a presumption

Intent (dolo) or gross negligence of the account holder is the only ground for excluding the bank's liability. Without proof to that effect, the client's liability is excluded.

The test is the technologically sophisticated character of the fraudulent conduct: if the fraud uses techniques that a diligent user could not have circumvented, gross negligence does not exist. This is the principle applied, for instance, by the Perugia Court in judgment no. 1711 of 7 May 2026, which excluded gross negligence in a fraud involving spoofing techniques.

The opposite case deserves attention though: relying on a phishing email may constitute gross negligence. The assessment is always case-specific, and the combination of elements counts.

Multi-channel fraud: phishing, smishing, spoofing and vishing

Fraud no longer arrives through a single channel. We now speak of combined attacks, where voice, SMS and email are strung together to build a credibility no single channel could create alone. This makes the question of the client's diligence more complex, and the judge must assess it as a whole.

The point remains the same: a bank that does not prove the client's gross negligence, or that does not demonstrate the adequacy of its own systems, answers for the loss.

The case law

The ruling that fixed the principle remains judgment no. 3780/2024: phishing is unlawful and the bank answers in contract, save where the fraud was made possible solely by the user's negligence, in the absence of gross negligence. In 2026 the courts of first instance continued along the same line: the Civil Court of Rome, in judgment no. 964 of 21 January 2026, confirmed the obligation to compensate the account holder.

A methodological caveat: case law on this topic has never been entirely settled, and sources partly disagree. Every assessment requires checking the full text of the ruling and its case-law position, not merely a restatement of the principle.