Card and online banking fraud has become more frequent. After every case the same question comes up: who bears the loss? The answer is in Law No. 55/2020 "On Payment Services", aligned with the European Union (EU) directive on payment services.
The basic rule. When a payment has not been authorised by the client, the payment service provider must refund the amount, unless it has reasonable grounds to suspect fraud by the client. The provider must prove that the payment was authenticated and correctly recorded; the use of the card or the codes alone is not enough as proof.
When the client bears the loss:
- when the client has acted fraudulently;
- when, intentionally or through gross negligence, the client has not kept the card, the codes or the device safe;
- when, intentionally or through gross negligence, the client has not notified the provider without delay after becoming aware of the loss, theft or unauthorised use.
Even then, unless the client acted fraudulently, the provider remains liable for payments made after notification and, as a rule, when it has not required strong customer authentication (SCA).
The difficult case: a payment you make yourself, but under deception. When someone persuades you by phone or message to send money to another account, the payment is usually considered authorised. Here the protection is weaker and depends on the circumstances: what warning signs the provider had and how it reacted.
What to do if it happens to you:
1. Block the card or online access immediately.
2. Notify the provider in writing and keep a copy.
3. Ask for a refund and, if it is refused, for the reasons in writing.
4. Do not delay the notification: a delay can cost you.