A suspicious text message, an email that looks authentic, an alarming phone call: online fraud has become a daily threat, capable of draining a bank account in minutes. When faced with an unauthorized transaction, the first reaction is panic, followed by a crucial question: will the bank refund me? The answer, rooted in European and Italian regulations, is clearer than you might think and leans in favor of the consumer. Understanding when the responsibility falls on the financial institution and how to assert your rights is the first step in turning anxiety into informed action.

The increasing digitalization of financial services, while offering convenience and speed, has expanded the playground for scammers. Techniques like phishing, smishing, and vishing are becoming increasingly sophisticated, making it difficult for anyone to distinguish a legitimate communication from a scam. Fortunately, the law establishes a fundamental principle: the security of transactions is a primary duty of the bank. This doesn’t absolve the customer of all responsibility, but it draws a clear line between an unfortunate oversight and gross negligence, laying the groundwork for a right to a refund that is almost always guaranteed.

The Regulatory Framework: The PSD2 Directive

The cornerstone of consumer protection in digital payments is the European Payment Services Directive, known as PSD2 (Payment Services Directive 2), implemented in Italy by Legislative Decree No. 11/2010. This regulation has revolutionized the banking sector by imposing higher security standards and clarifying responsibilities in cases of fraud. The goal is twofold: to promote innovation and, above all, to strengthen user trust in electronic payments. The directive stipulates that in the event of an unauthorized transaction, the burden of proof falls on the payment service provider, i.e., the bank. In other words, it is the financial institution’s responsibility to prove that the transaction was correctly authenticated and authorized by the customer.

One of the key elements introduced by PSD2 is Strong Customer Authentication (SCA). This security measure requires banks to verify a user’s identity using at least two independent factors from three categories: knowledge (something only the user knows, like a password or PIN), possession (something only the user has, like a smartphone to receive an OTP code), and inherence (something the user is, like a fingerprint or facial recognition). The adoption of these systems is mandatory for the bank; their ineffectiveness or failure to implement them plays a decisive role in assigning liability.

When the Bank Is Liable

In principle, the law states that the bank is always required to refund the customer for an unauthorized payment transaction. Article 11 of Legislative Decree 11/2010 requires the financial institution to refund the stolen amount “immediately” and no later than the end of the next business day after being notified. This liability is almost strict and stems from the “business risk” the bank assumes by offering electronic payment services. The Court of Cassation (Italy’s Supreme Court) has repeatedly affirmed that the possibility of fraud, including sophisticated techniques like phishing, is a foreseeable event that falls within the intermediary’s sphere of control.

The bank’s liability becomes even clearer when it fails to adopt all appropriate security measures to prevent fraud. This includes not only implementing strong authentication systems but also constantly monitoring transactions to detect unusual activity. For example, a large wire transfer to a foreign beneficiary, completely out of character with the customer’s habits, should trigger an alert. If the bank lacks effective alert systems or fails to intervene to block suspicious transactions, its negligence is clear, and the customer’s right to a refund is fully justified.

The Customer’s Obligations: What to Do to Avoid Losing Your Refund

While the law broadly protects the consumer, it also imposes some fundamental duties on them. The first obligation is to safeguard your access credentials (PINs, passwords, codes) with due care. This doesn’t mean being infallible, but rather adopting prudent behavior. For example, you should never share your codes with third parties, not even with someone claiming to be a bank employee. It is also essential to protect your devices with up-to-date security software and be careful not to fall for obvious traps. Awareness of risks, such as those associated with using unsecured public Wi-Fi networks, is part of this due diligence.

The second, equally crucial, obligation is timeliness. As soon as you notice a suspicious transaction or the loss of your credentials, it is imperative to contact the bank immediately to block the payment instrument (card, online account). Afterward, you must formally dispute the transaction in writing, via certified email (PEC) or registered mail, and file a report with the competent authorities, such as the Postal Police. By law, the customer has 13 months from the debit date to dispute a transaction, but acting without delay is essential to strengthen your position and facilitate the recovery of funds.

The Concept of ‘Gross Negligence’ by the Customer

The only exception that can exempt the bank from its refund obligation is the customer’s “gross negligence.” This concept, however, is interpreted very narrowly by case law. A simple oversight, like clicking on a well-crafted phishing link, is not enough. Gross negligence is defined as extraordinarily negligent and inexcusable conduct, a carelessness that goes beyond normal prudence. For example, writing your PIN on your credit card or providing an OTP code over the phone to a supposed bank employee after receiving multiple warnings from the bank could be considered gross negligence.

The burden of unequivocally proving the account holder’s gross negligence always falls on the bank. The financial institution must prove not only that its security systems were adequate but also that the customer acted with such recklessness as to nullify any protective measures. The decisions of the Banking and Financial Arbitrator (ABF) and court rulings often lean toward protecting the consumer, recognizing that scammers’ social engineering techniques are increasingly insidious. In many cases, even when the customer has unintentionally contributed to the fraud, liability is shared, leading to a partial refund.

The Procedure for Requesting a Refund

If you discover a fraudulent transaction in your account, the key is to act immediately. The first step is to call your bank’s toll-free number and request an immediate block on your card or online banking access to prevent further damage. This action is crucial and demonstrates your promptness in mitigating the risk.

Immediately after, you need to formalize your refund request. Send a written complaint to your bank, preferably via Certified E-Mail (PEC) or registered mail with a return receipt. In the complaint, formally dispute the fraudulent transactions, describe what happened, and attach a copy of the report you filed with the Postal Police or Carabinieri. The bank has 15 business days to respond to a complaint regarding payment services.

If the Bank Denies the Refund: The Banking and Financial Arbitrator

What happens if the bank rejects your claim, alleging gross negligence on your part? All is not lost. You have an effective, fast, and inexpensive protection tool at your disposal: the Banking and Financial Arbitrator (ABF). The ABF is an independent and impartial body, supported by the Bank of Italy, that resolves disputes between customers and financial intermediaries without needing to go to court. The appeal is filed online, has a low cost (€20, which is refunded if the case is won), and the procedure is relatively quick.

The ABF examines the documentation provided by both parties and makes a decision based on regulations and established guidelines. Its decisions are often favorable to consumers, especially in cases of phishing and other sophisticated fraud, where the customer’s gross negligence is difficult to prove. Although the ABF’s decision is not as binding as a court judgment, almost all banks comply to avoid being listed as non-compliant intermediaries on the Arbitrator’s website. Filing an appeal with the ABF is a strategic move that significantly increases your chances of getting a refund.

Conclusions

In the digital age, financial security is a shared responsibility. While it is essential for customers to adopt prudent behaviors, such as using complex passwords and enabling two-factor authentication systems, the law places the primary burden of protection on the banks. The European PSD2 directive and Italian case law confirm a clear principle: in case of fraud, the bank is required to issue a refund unless it can prove the customer’s gross negligence. This regulatory framework provides a solid safety net for consumers.

Being a victim of fraud is a stressful experience, but knowing your rights is the first step to reacting effectively. Acting promptly by blocking payment instruments and filing a report, and formalizing the refund request are crucial actions. If the bank denies the refund, the Banking and Financial Arbitrator offers an accessible and authoritative way to assert your rights. Remember: the law is on your side, and the tools to defend yourself exist and are effective.

Frequently Asked Questions