Unauthorized Payment Transactions: New Rules for Banks Handling Customer Reports

On 4 September 2026, the President of the Polish Office of Competition and Consumer Protection (UOKiK) issued four commitment decisions concerning the manner in which banks handle reports of unauthorized payment transactions. The decisions concern Alior Bank S.A., mBank S.A., BNP Paribas Bank Polska S.A. and Bank Millennium S.A. and conclude proceedings that had been pending against these institutions for nearly four years. The approach adopted in the decisions is consistent with the President of UOKiK’s earlier position on liability for unauthorized payment transactions and with UOKiK’s actions and recommendations from 2024 concerning measures aimed at reducing the risk of fraudulent transactions.

Under these decisions, the banks have undertaken, in particular, to amend their procedures for handling reports of unauthorized payment transactions and to take measures aimed at remedying the effects of the practices covered by the proceedings. This also includes the reconsideration of certain consumer reports that had previously been rejected.

The decisions are relevant not only from the consumer perspective, but also for the practices of payment service providers. In particular, they provide insight into how the President of UOKiK assesses the relationship between authorization of a transaction, authentication, the obligation to refund funds and the payer’s liability for an unauthorized transaction.

What practices did the President of UOKiK question?

The proceedings primarily concerned the manner in which banks handled customer reports relating to unauthorized payment transactions. The President of UOKiK questioned practices involving a failure to make a refund within the statutory time limit despite the absence of grounds permitting the refund to be withheld. In practice, this resulted in customers having to wait until the complaint procedure had been completed, even though the law provides for an earlier refund of funds.

One of the key issues concerned the refund obligation under Article 46(1) of the Act of 19 August 2011 on Payment Services (consolidated text: Journal of Laws of 2026, item 623; the “Payment Services Act”). Under this provision, where a customer reports that a particular transaction was not authorized by them, the payer’s payment service provider should, as a rule, refund the amount of the transaction without undue delay and no later than by the end of the following business day after becoming aware of the transaction or receiving the relevant notification. An exception may apply, in particular, where the provider has reasonable and duly documented grounds for suspecting fraud on the part of the payer and informs the competent law enforcement authorities accordingly.

Another important aspect of the decisions is the distinction between authorization and authentication. Authorization means the customer’s consent to execute a specific transaction, while authentication serves to verify the identity of the user or the valid use of a payment instrument. Accordingly, the mere correct use of a password, SMS code, mobile application or card details does not in itself establish that the customer actually consented to the transaction.

How should banks assess reports?

The banks have undertaken to treat as reports of unauthorized transactions all cases in which the consumer disputes having authorized a specific transaction. This also includes situations where a third party used the consumer’s authentication data or card details, or gained access to the consumer’s electronic banking or device.

When assessing authorization, a bank should not limit its analysis to whether the correct authentication data were technically used. It should also take into account possible interference by a third party in the process leading to the execution of the transaction.

Refund of funds and consumer liability

The decisions clearly separate the obligation to refund funds within the time limit resulting from Article 46(1) of the Payment Services Act from the subsequent assessment of the consumer’s liability. Gross negligence on the part of the consumer should not be equated with authorization of the transaction. It may, however, affect the scope of the payer’s liability for an unauthorized transaction.

In certain cases, the bank should first refund the funds and may subsequently, if it considers that there are grounds for holding the consumer liable, pursue recovery of the refunded amount through court proceedings. The decisions also provide for the reconsideration of certain previously rejected reports, under rules determined individually for each bank.

What do the UOKiK decisions mean for other payment service providers?

Although the decisions are formally addressed only to the four banks concerned, the interpretation of obligations relating to unauthorized payment transactions presented in them is also of practical significance for other payment service providers, including small payment institutions (SPIs) and national payment institutions (APIs). This applies in particular to the distinction between authorization and authentication, the timing of refunds and the principles governing the assessment of the payer’s liability.

The significance of the decisions is further reinforced by the fact that 10 additional proceedings concerning similar banking practices are still pending.

From a compliance perspective, payment service providers should therefore review, in particular, their procedures for handling reports of unauthorized transactions, the rules used to determine whether a transaction was in fact authorized, templates of responses sent to consumers, and the timing and legal basis for refunds.

Contact us if you need assistance with reviewing and updating your internal procedures for compliance with the Payment Services Act and the current approach of the President of UOKiK and the Polish Financial Supervision Authority.