The Polish competition authority issued decisions requiring four banks—ING Bank Śląski, Bank Ochrony Środowiska, Nest Bank and Plus Bank—to change their procedures for handling complaints about unauthorised payment transactions. These are transactions made without a customer’s consent or knowledge, for example following a cyberattack or theft of payment data.

Under the rules described by the authority, a bank must refund the disputed amount without delay and no later than the end of the next business day after the customer reports the transaction. The stated exceptions are documented grounds to suspect that the customer is acting fraudulently, or a report made more than 13 months after the transaction.

The authority found that the banks had often refused refunds on the basis that a transaction had been correctly authenticated, such as by entering a PIN or approving it in an app. It said correct authentication alone does not prove that the customer consented. The banks had also allegedly shifted the burden of proof to consumers and suggested that recovering the money depended solely on law-enforcement action.

The decisions require the banks to revise their internal procedures so that correct authentication is not treated as the sole basis for concluding that a customer authorised a transaction. They must reassess rejected complaints made from 16 November 2022 onward by people who remain customers and refund them where justified, no later than 31 December 2027. Former customers whose complaints made after 15 November 2022 were rejected must be informed how to request a reassessment.

The banks must publish information about the decisions on their websites, notify customers through mobile apps, and report to the authority on compliance by 30 April 2028. The authority says its position was confirmed by the EU Court of Justice’s October ruling in case C-70/25, Tukowiecka. According to the article, the ruling confirms that a bank must first refund an unauthorised transaction; if it believes the customer acted with gross negligence, it must pursue recovery through court proceedings and bear the burden of proving its case. The authority also states that a bank may withhold a refund only where it has justified suspicion that the customer is attempting fraud, which must be promptly reported to law enforcement.