Fraudsters took money from my card: what to do and how to get it back

What to do in the first minutes

How much you lose and who bears the risk depends on how fast you act. Do not wait until you have “figured out” what happened: stop the debits first, then look into the details.

1. Block the card. The quickest way is in your bank's app. If you cannot access the app, call the hotline using the number on the back of the card or on the bank's official website. Note the exact time: the bank must record the date and time of your notice.
2. Shut the fraudsters out. Change your online banking and email passwords, end sessions on all devices and remove any remote access apps you were asked to install.
3. Dispute the transactions in writing. Submit a statement to the bank listing every debit you did not make, with date, time and amount. Get a reference number or a stamped copy of your statement.
4. Report it to the police. Call 102 or file a report on the cyber police website ticket.cyberpolice.gov.ua. Fraud is a crime under Article 190 of Ukraine's Criminal Code, and the criminal case number will be useful to the bank and possibly the court.
5. Keep the evidence. Screenshots of texts and app notifications, the phone numbers that called you, messages, website links and an account statement.

When the bank must return the money

The rules for cards are set by the National Bank of Ukraine in its Regulation on the issuance and acquiring of payment instruments. Three points in it matter to you.

• You can notify the bank at any time. The bank must accept reports of a lost card or compromised card details free of charge at any time, and must then prevent any use of the card.
• Notice shifts liability. Until you notify the bank, the risk of losses from improper transactions lies with the cardholder; after that, it lies with the bank.
• No fault, no liability. The account holder is not liable for transactions made without their involvement, unless their actions or inaction led to the loss of the PIN or other details needed to make a payment.

It is the bank that has to prove the customer “helped” the fraudsters: that is what the Supreme Court decided in case No. 176/1445/22. If the bank provides no proper evidence, the customer is presumed not to be at fault, and doubts are resolved in the consumer's favour. The fact that correct card details were entered does not in itself prove the cardholder's fault.

If you transferred the money or shared a code yourself

This is the most common scenario in calls from a fake “bank security service” or bogus “buyers” on classified sites: the person transfers money to a “safe account” or reads out a code. Formally the transaction was confirmed by the account holder, so there is no automatic refund. But the steps are the same, and you should take them straight away:

• notify your bank immediately and ask it to contact the recipient's bank: while the fraudsters have not withdrawn the money, it can sometimes be stopped;
• report it to the police: if the fraudsters are found, the money can be recovered from them under a court verdict or in a civil claim;
• if you paid by card for goods you never received, ask the bank to dispute the transaction through the card scheme. Deadlines for such disputes are limited, so do not delay.

How to recognise a fraudulent call and what to do if you have already shared your details is covered in detail in our article on calls from the “bank security service”.

If the bank refuses

1. Ask for a written answer explaining the reason: on what basis the bank concludes that you confirmed the transaction, and what evidence it has.
2. Complain to the National Bank. The NBU considers complaints from financial services consumers about violations of their rights. Attach your statement to the bank, its reply, an account statement and the criminal case number. How to file a complaint is described on the NBU consumer protection page.
3. Go to court. The Supreme Court's position favours the customer if the bank cannot prove their fault. For large amounts, it is worth hiring a lawyer experienced in such cases.

How to reduce the risk in advance

• Turn on notifications for all transactions in your bank's app: the sooner you see a debit, the sooner you can block the card.
• Set limits on transfers and online payments. You can raise a limit in the app in a minute when you really need to.
• Use a separate card for online shopping and keep only the amount you need on it. Keep your main money and savings in another account.
• Never share text message codes, your CVV or PIN, even with “bank staff” or “the police”. A real bank does not ask for them.
• Keep your emergency fund separate. If fraudsters empty your everyday card, savings in another account will tide you over until the money is returned. How to build one is explained in our article on the emergency fund.

In short

• The first step is to block the card and note the time: after you notify the bank, the risk of new debits lies with the bank.
• For transactions made without your involvement, the bank must return the money unless it proves you disclosed your card details or codes yourself.
• It is the bank that must prove the customer's fault: the Supreme Court decided so in case No. 176/1445/22.
• If you transferred the money or shared a code yourself, there is no automatic refund: contact the bank immediately, then the police and, if needed, the court.
• A refusal by the bank can be challenged with the NBU and in court.

Sources

1. National Bank of Ukraine - Regulation on the issuance and acquiring of payment instruments (Resolution No. 164), paragraphs 138-146 (in Ukrainian)
2. LIGA:ZAKON - Supreme Court position in case No. 176/1445/22: the bank must prove the customer's fault (in Ukrainian)
3. Kherson Court of Appeal - what to do if you have fallen victim to online fraud (in Ukrainian)
4. National Bank of Ukraine - protection of financial services consumers

This article is for information only and is not legal advice. Every case has its own circumstances: if the bank refuses to refund a large amount, consult a lawyer.