Unauthorised Bank Transfer: When Should the Bank Refund the Money?

An accessible explanation of the rules governing a bank’s liability for transactions which the customer did not authorise.

The starting point: did the customer actually consent to the transfer?

The Payment Services Act[1] links the authorisation of a transaction to the customer’s consent to carry out that transaction, given in the manner specified in the agreement between the customer and the bank.

Under Article 40(1) of the Act, a payment transaction is authorised if the payer has given consent to the transaction in the manner provided for in the agreement with the bank. If such consent was not given, the transaction is unauthorised.

This distinction is of practical importance. A customer may personally perform certain actions in electronic banking — for example, “order a transfer”. This does not automatically mean, however, that the customer authorised the particular transaction.

Authorisation is not the same as authentication

In the event of a dispute, the bank may demonstrate that the customer logged into the banking application or used the appropriate payment instrument. This does not, however, in itself establish that the customer authorised the transfer.

Authentication primarily serves to verify the identity of the user. Authorisation, on the other hand, means consent to the execution of a specific transaction.

In its position of 16 November 2022, the President of the Polish Office of Competition and Consumer Protection (UOKiK) indicated that authorisation requires both elements: the customer’s consent and proper authentication. Merely demonstrating that the payment instrument was used is not sufficient.

What exactly does the customer authorise?

In electronic banking, a customer does not normally approve a transfer merely by entering the recipient’s account number and the amount.

The form will usually also require the recipient’s details, such as their name or business name. In some cases, it may additionally require the payment reference or other information.

Typically, the Internet banking transfer form is designed so that the “Confirm” button only becomes available once all mandatory fields have been completed. Otherwise, even after successful authentication — that is, after logging into one’s own online banking account — the transfer cannot be submitted.

If, therefore, the customer identifies a particular company as the recipient while the account number entered belongs to an entirely different person, the question arises: what exactly was the content and scope of the customer’s consent?

In our view, it cannot automatically be assumed that the customer accepted “any” transfer made to the indicated account number. After all, the customer also identified a specific recipient.

What matters is the customer’s statement as a whole, rather than merely one element of it.

Example: a substituted bank account number

Let us imagine a simple situation.

A customer wants to pay a business partner. The customer receives the necessary information from that partner: the partner’s identification details, bank account number and invoice number.

Someone then interferes with the correspondence and replaces the bank account number. Unaware of this, the customer enters the transfer into the bank’s application.

In the transfer form, the customer enters the details of the business partner to whom the payment is intended, but, unknowingly, also enters a bank account number controlled by cybercriminals.

Did the customer authorise the transfer?

In our view — no.

The customer agreed to a transaction in which the intended recipient was the business partner.

The customer did not consent to transferring the money to the person who actually received it: a person whom the customer did not know, with whom the customer had no outstanding transactions or other relationship, and whom the customer did not identify as the recipient.

Put as simply as possible: the customer did not agree to finance cybercriminals at their own expense.

Why does the design of the banking application matter?

This is one of the most important elements of the argument.

If the bank itself has designed a form in which the customer must provide specific parameters of the transfer — in particular, the recipient, account number, amount and payment reference — it is difficult to argue later that, when assessing the customer’s consent, only the account number matters.

Let us recall that, in the circumstances discussed here, under the agreement between the customer and the bank — or, more precisely, under the terms and conditions governing the payment service used by the customer to make the transaction — the customer was required to provide all the relevant information: to identify the recipient by providing their name or business name, indicate their bank account and specify the payment reference.

The application itself did not allow the transaction to be effectively confirmed without these details.

If the bank therefore requires the customer to provide the recipient’s details, those details form part of the statement by which the customer gives consent to the transfer — that is, authorises it.

Two possibilities — neither amounts to consent to a transfer to a cybercriminal

In the situation described above, two possibilities can be considered.

First: the customer authorised the transaction in favour of their business partner, rather than the cybercriminals, because the business partner was the only person identified by the customer as the recipient.

Second: the customer’s statement was internally inconsistent because it simultaneously identified the business partner and an account belonging to another person. On that view, it cannot be said that the customer effectively consented to a transfer containing such internally contradictory parameters.

In either case, one thing remains clear: the customer did not consent to the transfer of the money to the person who actually received it.

Two different issues should not be confused

In cases of this kind, a bank may rely on the statutory principle under which a transaction carried out to the bank account number indicated by the customer is regarded as having been carried out for the appropriate recipient, potentially excluding the bank’s liability for the payment transaction.

That, however, is a different question from whether the customer actually authorised the transaction in the first place.

The rules concerning the proper execution of a transfer govern the bank’s liability for the performance of the transaction.

The rules concerning unauthorised transactions regulate a different situation altogether.

The mere fact that the bank transferred the money to the account number entered in the payment instruction does not, therefore, automatically establish that the customer consented to that particular transaction.

What happens if the transaction was unauthorised?

If the transaction was indeed unauthorised, Article 46(1) of the Payment Services Act imposes an obligation on the payment service provider to refund the amount of the transaction.

As a general rule, the refund must be made without undue delay and no later than by the end of the business day following the day on which the customer notified the bank that the transaction had not been authorised.

The Act provides for certain exceptions. These include, among other things, a situation in which the bank has reasonable and duly documented grounds to suspect fraud on the part of the customer and notifies the law-enforcement authorities, or where more than 13 months have elapsed since the transaction was executed.

This obligation is statutory and arises where the bank fails to demonstrate that the transaction was effectively authorised or that statutory grounds excluding its liability apply.

In cases involving the substitution of a bank account number, therefore, the central issue is not whether the customer technically clicked to approve the transaction.

The crucial question is whether the customer actually consented to the execution of a transfer corresponding in substance to the transaction that was ultimately carried out.

If, as a result of criminal manipulation, there was a discrepancy between the payer’s actual intention and the content of the transaction executed, there are strong arguments for concluding that the bank has failed to establish effective authorisation within the meaning of the Payment Services Act.

In such circumstances, the obligation to refund the funds without undue delay under Article 46 of the Act may apply.

The consequences of treating a transaction as unauthorised

The consequences of the absence of authorisation are set out in Article 46 of the Payment Services Act.

Under that provision, where an unauthorised payment transaction occurs, the payment service provider is required, without undue delay and no later than by the end of the business day following the day on which the unauthorised transaction was identified or reported, to refund the payer the amount of the unauthorised transaction and restore the debited payment account to the state in which it would have been had the unauthorised transaction not taken place.

The key principle

In cases concerning unauthorised transactions, it is worth starting with a simple question:

“What exactly did the customer consent to?”

It is not enough to answer:

“The customer approved the transfer.”

It is necessary to establish what the consent actually consisted of, what information the customer provided, what requirements followed from the agreement and the bank’s terms and conditions, and whether all the elements of the payment instruction identified the same recipient.

The central argument in the case analysed here is precisely this: the customer did not give the bank a blanket authorisation to transfer money to whoever happened to control a particular bank account number.

The customer authorised a transaction with specific parameters, one of which was the identification of their business partner as the recipient.

This publication presents the legal arguments set out in the material provided and should not be construed as an independent legal opinion in any specific case.

[1] Ustawa z dnia 19 sierpnia 2011 r. o usługach płatniczych; Dz.U.2026.623, tekst jedn. z 11 maja 2026 roku