Unauthorised card or bank transfer in Poland: refund rights (D+1)
Short answer: Under Polish rules explained by the Financial Ombudsman and UOKiK, a bank must refund an unauthorised transaction by the end of the next business day, unless it suspects fraud by you or you report after 13 months.
Money has left your account and you did not order it. In Poland the law puts a firm duty on the bank to give it back quickly, but banks do not always do so, and the official consumer bodies say so openly. This guide sets out what the Financial Ombudsman (Rzecznik Finansowy, RF) and the Office of Competition and Consumer Protection (UOKiK) publish about unauthorised payment transactions: what to do first, what the bank must do and by when, the two cases where it can refuse, and where to complain. The sources are dated November 2022 and February 2024, plus an RF FAQ page without a date, so confirm the current position with your bank.
What counts as an unauthorised transaction
The RF explains that a transaction is authorised only if you knowingly gave consent and authentication was done correctly. Both conditions must be met together. If a fraudster uses your login details or card data, the authentication may look correct, but you did not consent, so the transaction is unauthorised.
Typical traps listed by RF and UOKiK:
- a call from a fake "bank employee", sometimes showing the real helpline number (spoofing), who asks you to install software supposedly to stop a theft;
- text messages posing as an energy, gas or parcel company, with a link to pay an alleged arrears;
- a "buyer" on a marketplace who sends a link to "receive the money", which leads to a fake payment or bank page.
The four basic rules from the 2022 joint notice:
- never give or send anyone your online banking login and password;
- never click links in text messages and check any arrears yourself with the company;
- if someone calls claiming to be the bank, hang up, find the helpline number yourself and check;
- never install software from links or during a call about your account.
What to do right away
RF says to contact your payment provider as soon as possible, block the card or account and change the login details, and report the matter to the police. First check that the payment is not a standing order, subscription or direct debit that you agreed to. Then make a complaint (reklamacja) to the bank asking for the amount back, and do it promptly after you discover the theft.
What the bank must do
According to the RF Q&A and the UOKiK notice of 14 February 2024, the bank must return the amount of the unauthorised transaction, or restore the account to its state before the transaction, by the end of the next business day after you report it (the so-called D+1 deadline). The RF FAQ adds that the bank cannot refuse just by saying that authentication was correct. A correct login, password and SMS code do not prove that you consented.
When the bank can refuse
The RF and UOKiK name only two exceptions:
- The bank has a justified suspicion that you are attempting fraud, for example reporting a payment you actually made, and it notifies law enforcement in writing. It may then hold back the refund until the authorities decide.
- You report the transaction more than 13 months after the debit.
The RF warns that if you report a transaction you really made, or you gave your login details to a family member who then made the payment, the bank may treat it as attempted fraud and you may face criminal liability. If the bank shows you did authorise the transaction, it can refuse after reporting its suspicion.
Gross negligence
The bank can ask you for the money back later if it shows that fraudsters got access through your gross negligence (rażące niedbalstwo). The RF FAQ gives the example of keeping a card PIN together with the card. In most cases the bank cannot properly judge negligence within the legal deadline, so it should refund first and only afterwards ask you to repay if it finds negligence. If you deny negligence, the bank may go to court, and the court decides. This risk is real, so protect your credentials.
What UOKiK has done
UOKiK says that since July 2021 it has been examining how banks treat consumers who report unauthorised transactions. On 14 February 2024 it announced six more proceedings, against Alior Bank, Bank Handlowy, Bank Ochrony Środowiska, Pekao SA, PKO BP and Plus Bank, bringing the total to 15 banks. The charges concern failing to return the money on time and misleading answers to complaints. UOKiK says a penalty for infringing collective consumer interests can reach 10 per cent of turnover. These are charges and proceedings, not findings against any bank.
If the bank says no
The RF page says that if the bank rejects your complaint you can ask the Financial Ombudsman to examine your case. The Ombudsman can also help when the dispute has reached court. The 2022 notice also points to local consumer advocates and a UOKiK consumer helpline, but the numbers there may have changed, so check the current ones on the RF and UOKiK websites.
Practical checklist
- Block the card or account at once, using the bank's app or helpline, found independently.
- Write a complaint to the bank and keep a copy with the date you sent it.
- Report to the police and keep the confirmation.
- Note the date and time of each transaction and any messages or calls from the fraudster.
- Do not report a transaction you made yourself.
- Check your statements regularly so that you are well within 13 months.
* Photos: Card payment terminal and a card reader at a shop counter, Wikimedia Commons (CC0). Illustrative, not from Poland.
Frequently asked questions
How fast must a Polish bank refund an unauthorised transaction?
By the end of the next business day after you report it or after the bank notes it, according to the Financial Ombudsman and UOKiK. The exceptions are suspected attempted fraud notified to the authorities, and reports made after 13 months.
Can the bank refuse because my SMS code was correct?
Not on that ground alone, says the Financial Ombudsman FAQ. Correct authentication does not by itself prove that you authorised the payment.
What if the bank accuses me of negligence?
It should still refund first. It can then ask for the money back if it shows gross negligence, and a court would decide if you disagree.
Where do I complain if the bank refuses?
Make a written complaint to the bank, then ask the Financial Ombudsman (rf.gov.pl) to examine the case. Also report the incident to the police.
