Gross negligence is a serious failure to use reasonable care. In cybersecurity and payment disputes, it may describe conduct such as disregarding clear warnings or failing to protect credentials, but whether conduct meets this legal standard depends on the facts and applicable law.
For unauthorized payments under PSD2, alleged gross negligence may affect a customer’s liability after reimbursement is made; it does not, by itself, allow a payment provider to delay immediate reimbursement while deciding who was at fault. The distinction matters in fraud response: providers must handle restoring funds separately from investigating the transaction and seeking recovery later. A legal finding of gross negligence is not proof of how an attack occurred, such as whether phishing was involved.