In a recent ruling by the Spanish Supreme Court, it was determined that banks are liable for unauthorised transactions resulting from digital fraud, such as phishing or SIM swapping, unless they can demonstrate gross negligence on the part of the customer. This ruling reinforces the quasi-objective liability framework established by Directive 2015/2366 on Payment Services, shifting the burden of proof to financial institutions to demonstrate that the transaction was authorised or that the customer acted with gross negligence. The decision is based on the special duty of care that banks must exercise when, among other matters, opening a bank account (e.g. verifying the ID or the contracting party’s information is accurate) or monitoring certain operations (such as unusually timed large transfers by a user). This legal precedent could have significant implications for the insurance sector, particularly regarding policies held by banks. Liability insurers of banks may face an increase in claims related to digital fraud, as banks are more likely to be held responsible. Additionally, insurers should reassess the risks covered and the security measures implemented by banks. Underwriters should consider the adequacy of cybersecurity protocols and banks’ incident response capabilities when evaluating risks.