Phishing as a security risk in the digital payments ecosystem: A practical approach in light os Spanish case law and the CJEU judgment on 1st August 2025

Abstract

This study takes as its point of departure the judgment delivered by the Court of Justice of the European Union (Fourth Chamber) on 1st August 2025 in Case C-665/2023. In that decision, the Court held that a payment card user is not entitled to the reimbursement of an unauthorised transaction where the user fails to notify the payment service provider without undue delay, whether such delay is deliberate or the result of gross negligence. Notably, the case is distinguished by the fact that the statutory maximum period of thirteen months for reporting unauthorised transactions had not yet expired. The judgment reveals the existence of security gaps within the digital payments ecosystem, placing operations and transactions at risk and, in turn, eroding users’ confidence in electronic environments. Accordingly, and following an initial conceptual examination of the digital ecosystem —within which electronic commerce and new payment methods are framed— this work argues for the need to reinforce the concepts of trust and security, which are called into question by social engineering threats such as phishing. A practical analysis of this phenomenon is therefore undertaken in light of the recent Spanish case law and the aforementioned judgment of the CJEU.