The Office of Competition and Consumer Protection (UOKiK) initiated 6 proceedings against Alior Bank, Bank Handlowy, Bank Ochrony Środowiska (BOŚ), Pekao, PKO Bank Polski and Plus Bank, the Office announced. The allegations concern banks’ reactions when consumers report unauthorized transactions. Most often, they occur as a result of cyberattacks, e.g. fraudsters extorting electronic and mobile banking passwords, transfer authorization codes, and card details.
Pursuant to the law, banks are obliged to refund the amount of an unauthorized transaction or restore the account to the state before such a transaction occurred – by the end of the next business day after reporting. There are two exceptions: the consumer’s report was made later than 13 months after the transaction or there is a reasonable suspicion of fraud on the part of the consumer, about which the bank notified the police or prosecutor’s office.
“Banks do not always fulfill their obligation to return money to injured consumers”
“Banks do not always fulfill their obligation to return money to injured consumers. They refuse or return it after the deadline. Another problem is misleading information provided in response to submitted complaints. We have brought further charges against banks that do not settle accounts with consumers when an unauthorized transaction is reported. and are misleading. Our actions already concern a total of 15 banks. I would like to remind you that for violating the collective interests of consumers, we can impose a fine on an entrepreneur of up to 10% of turnover,” said Tomasz Chróstny, president of the Office of Competition and Consumer Protection, quoted in the release.
So far, the Office has announced charges against 9 financial institutions (5 of them were announced in July 2022, 4 of them in November 2022).
What does the Office of Competition and Consumer Protection question?
In the latest six proceedings, the Office questions:
- No refund within D+1. Pursuant to the Payment Services Act, the bank should return the stolen amount to the consumer within D+1, i.e. by the end of the next business day after reporting the unauthorized transaction.
- Misleading responses to reports of money theft.
- Imposing a limit on possible complaints and shortening the time for reporting them.
“The bank’s obligation does not end with demonstrating the correctness of authentication when executing a transaction. It is important that financial institutions provide security measures that will limit the activities of fraudsters. A transaction is authorized only if its authentication took place with the knowledge and consent of the consumer. We hope that the sector will adapt its activities to the law that has been in force for years – to the benefit of consumers,” concluded the President of the Office of Competition and Consumer Protection.
