Financial Fraud and Unauthorized Payments. When Is a Bank Required to Reimburse Funds?
Financial fraud and unauthorized payment transactions are becoming an increasingly common problem. Customers encounter situations where funds are transferred from their accounts without their knowledge, or where they themselves, deceived by fraudsters, authorize a payment transaction. In such cases, an important question arises: when is a bank or other payment service provider required to reimburse the lost funds?
In this article, we discuss when a payment transaction is considered unauthorized, what obligations the bank and the customer have, and in what circumstances it is possible to request a refund of lost funds.
When is a payment service provider required to refund funds?
Complaints from victims of fraud and the practice of the Bank of Lithuania, when examining disputes between payment service providers and their customers regarding funds debited from accounts, show that payment service providers sometimes refuse to refund the funds if the person disclosed personalized security credentials to the fraudsters or, as a result of deception, authorized a payment transaction through which funds were debited from the account and transferred to the fraudsters.
However, payment service providers, as professional market participants whose services involve higher risks, are subject to stricter standards of diligence and care. Therefore, the fact that the data necessary to execute a payment transaction was fraudulently obtained from a person does not in all cases mean that the payment service provider is exempt from the obligation to compensate the customer for losses resulting from unauthorized payment transactions carried out without the payer’s genuine consent.
When is a payment transaction considered unauthorized?
Article 29(1) of the Payments Act provides that a payment transaction is considered authorized only when the payer gives consent to execute the payment transaction. If the payer has not given consent to execute the payment transaction, the payment transaction is deemed unauthorized. Article 39(1) of the Payment Services Act provides that the payment service provider must refund the amount of an unauthorized payment transaction to the payer, except in cases where the payer’s payment service provider has reasonable grounds to suspect fraud on the part of the payer and notifies the supervisory authority of these grounds in writing.
The mere fact that a payment transaction was carried out using personalized data provided by the payment service provider to the customer does not necessarily mean that such a payment transaction was lawfully authorized or that the payment service provider is exempt from the obligation to compensate the customer for any losses incurred.
For example, when third parties obtain personalized security data and/or the taxpayer’s consent through fraudulent means (telephone scams, fake online banking links, fake “Smart-ID” or “Mobile ID” requests, etc.), it is clear that the initiation and confirmation of such a transaction do not reflect the payer’s true intent, even though, formally (based on external characteristics) they do coincide with the form and procedure for giving consent agreed upon by the payer and the payment service provider. On the other hand, a payment transaction carried out without the payer’s intent and without the payer even being aware of the circumstances surrounding the initiation of such a payment transaction—even if personalized security credentials were used to execute the payment transaction—should be considered unauthorized.
The Supreme Court of Lithuania has ruled that the law establishes a system of liability for the payer’s service provider in the event of an unauthorized payment, under which the payer is entitled to a refund of the amount of the unauthorized transaction, and the payer’s service provider is obligated to refund it, except in cases where it is established that:
- The taxpayer is acting in bad faith;
- A payer intentionally or through gross negligence violates one or more of the payer’s obligations set forth in Article 34 of the Payments Act regarding payment instruments and personalized security credentials.
The specified system of the payer’s service provider’s liability for unauthorized payments entails strict liability on the part of the payer’s service provider for unauthorized payment transactions, i.e., strict liability. It is important to note that if the payer denies having authorized a payment transaction, the burden of proving the payer’s fraud or gross negligence falls on the payment service provider, therefore, the provider cannot shift this burden to its customer and require the customer to prove that they did not authorize such a payment transaction. This is particularly relevant for those who, after falling victim to financial fraud, contact their bank in an effort to recover their lost funds.
Under what circumstances can a payment service provider be exempt from liability?
The service provider’s liability without fault does not eliminate the taxpayer’s own obligation to act with due care and responsibility. Therefore, if the taxpayer acts in bad faith or violates the obligations imposed on him or her by law intentionally or through gross negligence, the service provider is exempt from liability.
It should be noted that not every failure by a payer to fulfill their obligations constitutes grounds for exempting the service provider from liability, but specifically the payer’s obligations set forth in Article 34 of the Payments Act, which relate to payment instruments and personalized security credentials. Furthermore, mere negligence on the part of the payer is not considered a condition for exempting the payer’s service provider from liability—the mere fact that the victim trusted a fraudster does not in itself constitute gross negligence.
Article 34 of the Payment Services Act requires a payer who has been issued a payment instrument to use that payment instrument in accordance with the terms and conditions governing its issuance and use, and, upon becoming aware of its loss, theft, misappropriation, or unauthorized use, to immediately notify the payment service provider or the entity designated by it. In addition, upon receiving the payment instrument, the payer must take steps to protect personalized security data (PIN codes, login passwords, “Smart-ID” and “Mobile ID” codes, etc.).
The Supreme Court of Lithuania has ruled that gross negligence is manifested by an unreasonable or exceptional lack of care, where a person is not as careful as is clearly necessary under the circumstances. Gross negligence on the part of the payer can be established only if the payer acted with extreme carelessness. It is up to the payment service provider to prove that the payer acted with extreme negligence by presenting specific evidence supporting such conduct. This burden of proof cannot be shifted to the payer.
Assessing the degree of a taxpayer’s negligence involves evaluating the totality of the individual, specific circumstances of the particular case. Therefore, the mere fact that a person, fell into the trap of fraudsters and disclosed personalized security data does not, in and of itself, allow for the conclusion that the taxpayer acted with gross negligence and that, as a result, the payment service provider is exempt from liability. Thus, a conclusion regarding the payer’s ordinary or gross negligence—as a circumstance of an evaluative nature—cannot be drawn in isolation, without considering the full context of the execution of the unauthorized payment transaction and the related circumstances.
In order to assess whether a payment service user has been negligent or grossly negligent, the payment service provider should take all circumstances into account. However, while negligence implies a breach of the duty of care, gross negligence should imply more than mere negligence and encompass extremely careless conduct, such as storing security credentials used to authorize payment transactions on the payment instrument in an unencrypted format that is easily accessible to third parties, and so on.
The Obligation of Banks and Payment Service Providers to Monitor Transaction Risks
Even in cases where the taxpayer acted with gross negligence—for example, by handing over their payment card and payment card PIN to fraudsters, or by entering the PIN1 and PIN2 codes in the “Smart-ID” app to authorize a payment transaction, etc., this does not relieve the payment service provider of its obligation to implement security measures that would help reduce the risk of fraud and prevent unusual transactions that may have been initiated fraudulently.
The preamble to Commission Delegated Regulation (EU) 2018/389 states that the authentication procedure should include transaction monitoring mechanisms capable of detecting attempts to use a payment service user’s personalized security features that have been lost, stolen, or unlawfully misappropriated, and ensure that a payment service user who by providing their personalized security features in the usual manner, is the legitimate user and, as such, has given their consent to transfer funds and receive information about their account.
Under the provisions of the regulation, payment service providers are required to have transaction monitoring mechanisms in place that would enable the detection of unauthorized and fraudulent payment transactions, based on an analysis of the user’s typical behavior and security factors. These mechanisms must, at a minimum, assess risk factors such as stolen or compromised authentication credentials, the transaction amount, known cases of fraud, signs of malware, and unusual use of the tools provided by the service provider.
The Bank of Lithuania has also developed Fraud Prevention Guidelines, which aim to encourage financial market participants to improve their management of financial fraud risks. One of the key measures outlined in these guidelines is effective monitoring of operational risks, by implementing appropriate technological and organizational measures to increase the effectiveness of fraud prevention and reduce the risk of losses for both the bank and the customer.
In accordance with the provisions of the regulation and the recommendations on operational risk monitoring set forth in the Bank of Lithuania’s guidelines, effective operational risk monitoring should be based on the observation of atypical client behavior, i.e., deviations from the client’s usual financial habits, business model, and nature of transactions. For example, the following should be assessed:
- a specific type of customer and their typical payment habits,
- Steps to be taken before the operation begins,
- the client’s past behavior, as compared to their current behavior,
- a sudden change in behavior over a short period of time,
- the sequence of actions performed, their number, and intensity,
- the timing of the transactions and their consistency with the taxpayer’s previous actions, etc.
Thus, in cases where payment transactions carried out using the payer’s personalized data are not isolated incidents, they are atypical for the customer (for example, payment transactions are executed at times of day that are atypical for the payer, in atypical or unusually large amounts, etc.), the payment service provider should take this into account when assessing the unusual nature of subsequent payment transactions, and take proactive steps to verify that the customer is the one initiating the transactions on the payment account (for example, by contacting the customer for additional confirmation).
If it is determined that the payment service provider’s operational risk monitoring measures were not effective and that obvious fraud risks were not identified and prevented in a timely manner, this could serve as grounds for proportionally reducing the payer’s liability for losses incurred as a result of unauthorized payment transactions and for seeking partial compensation from the payment service provider.
Have you been a victim of financial fraud or an unauthorized payment transaction?
The team at the “Leagus” law firm is ready to help you.
Tadas Kuzminskas, tadas.kuzminskas@leagus.lt, “Leagus” Law Firm
