The President of the Office of Competition and Consumer Protection raised doubts about the banks' approach to examining applications for the so-called unauthorized transactions. These are situations in which funds have been withdrawn from the customer's account without his consent or knowledge, e.g. as a result of a cyber attack or data theft.
According to the office, ING Bank Śląski, Bank Ochrony Środowiska, Nest Bank and Plus Bank refused to return the funds in many such cases. Meanwhile, according to the law, after reporting an unauthorized transaction, the bank should immediately, i.e. no later than the end of the next business day, return the stolen amount to the consumer. The exceptions are situations when there are documented grounds to suspect fraud on the part of the client himself or when more than 13 months have passed since the transaction - explained the Office of Competition and Consumer Protection.
Banks refused to return the stolen money
However, according to the office, the four mentioned banks suggested to consumers that the mere correct authentication of the transaction, e.g. entering the PIN code or authorization in the application, exempts them from liability and automatically means that the customer has consented to the transfer.
Banks also unjustifiably shifted the burden of proof to the consumer and claimed that any recovery of money was possible only through the actions of law enforcement agencies - it was pointed out.
As emphasized by the President of the Office of Competition and Consumer Protection, Tomasz Chróstny, quoted in the statement, financial institutions cannot avoid liability by automatically rejecting complaints and shifting the entire burden of proving guilt to the injured consumer.
The bank's mere demonstration that the transaction was correctly authenticated is not enough to refuse a refund. The bank must prove that the customer independently and consciously authorized the operation or was grossly negligent, Chróstny noted.
Pursuant to his decision, ING Bank Śląski, Bank Ochrony Środowiska, Nest Bank and Plus Bank are to change their current practices and eliminate their negative effects. This means that banks will implement new rules according to which the correct authentication of a transaction will not be the only basis for considering that the customer himself authorized it.
Banks must reconsider complaints. There is a deadline for a refund
The above-mentioned banks are also to re-verify the responses to complaints from current customers, provided since November 16, 2022. In justified cases, they are to refund the lost money to consumers, which will be done no later than December 31, 2027, the office said.
ING Bank Śląski, Bank Ochrony Środowiska, Nest Bank and Plus Bank are also to inform former customers whose complaints were rejected and were reported after November 15, 2022, about the possibility and method of submitting an application for re-verification of the case.
In addition, banks were obliged to inform about the decisions of the President of the Office of Competition and Consumer Protection on their websites and to notify their customers via mobile applications. By April 30, 2028, they must also inform the office about how they have fulfilled their obligations.
These are not the first decisions of this type by the President of the Office of Competition and Consumer Protection regarding banks' rejection of complaints regarding unauthorized transactions. In September this year the office obliged Alior Bank, mBank, BNP Paribas and Bank Millennium to change their practices in this area and re-examine customer reports that were rejected.
