A bank client is not liable for unauthorized card transactions if the bank fails to prove their involvement in the unlawful use of payment information – SC CivCC

A bank client is not liable for unauthorized transactions made with a payment card if they promptly informed the bank about such transactions and the bank failed to prove that the client, through action or inaction, contributed to the loss or unlawful use of their personal identification number or other information enabling the initiation of payment operations. The mere fact that the correct data were entered to initiate a banking transaction cannot serve as conclusive evidence of the client’s fault.

These conclusions were reached by the Supreme Court, sitting as a panel of judges of the Third Judicial Chamber of the Civil Cassation Court.

In the case under review, the bank filed a lawsuit against the borrower seeking recovery of debt under a credit agreement. In substantiating its claims, the plaintiff stated that a banking service agreement had been concluded between the parties, under which the bank granted the borrower a loan. The bank duly fulfilled its obligations, whereas the borrower failed to comply with their contractual duties, resulting in indebtedness under the said agreement.

The court of first instance, partially upholding the claim, proceeded from the existence of contractual relations between the parties under the credit agreement. However, the bank provided only partial evidence of the debt relating to the principal amount and did not submit proof substantiating the lawful accrual of interest.

The first-instance court also took into account that a significant amount (UAH 69,342.00) had been withdrawn from the defendant’s account in May 2022 as a result of an unauthorized transaction. The bank did not prove that this occurred through the defendant’s fault, whereas the latter promptly notified both law enforcement authorities and the bank about the incident.

Considering the submitted evidence, including materials from the criminal proceedings, the first-instance court concluded that the claim could be satisfied only in the part concerning funds actually received, used, but not repaid by the defendant—amounting to UAH 4,732.86.

The appellate court modified the district court’s decision, ordering the defendant to pay the plaintiff the debt on the principal loan amount totaling UAH 68,124.22.

Regarding the first-instance court’s failure to take into account the funds withdrawn from the defendant’s card account in May 2022, the panel of appellate judges reasoned that, based on the evidence submitted to the appellate court, the bank had proven the existence of circumstances that unequivocally demonstrated the user’s actions or inaction contributed to the loss or unlawful use of the PIN code or other information enabling payment transactions. Therefore, the unpaid debt amount was to be recovered from the defendant.

The Civil Cassation Court of the Supreme Court agreed with the defendant’s arguments that the bank had failed to prove the defendant’s involvement in the unauthorized withdrawal of funds in May 2022. On the contrary, the case materials contained evidence that the defendant acted promptly and reported the incident. In the absence of proper and admissible evidence, any doubts or assumptions must generally be interpreted in favor of the consumer, who is typically the “weaker” party in such civil relations, as the legal relationship between a consumer and a bank is not one of equal footing.

The SC CivCC reminded that it was the bank’s obligation to submit, specifically to the court of first instance, indisputable evidence proving that the defendant had facilitated the unlawful use of the personal identification number or other information that allowed payment operations to be initiated.

Furthermore, the Court noted that in the appellate court, the bank referred to circumstances and evidence whose existence it had previously denied before the first-instance court. Such conduct contradicts the principles of fairness and good faith, as well as the prohibition of inconsistent behaviour.

Taking these factors into account, the Court established the plaintiff’s bad-faith procedural conduct and determined that the appellate court had unjustifiably and in violation of procedural law accepted, examined, and relied upon new evidence submitted by the bank. This constituted a breach of the procedural rule of full disclosure of evidence (discovery) enshrined in the Civil Procedure Code of Ukraine. Meanwhile, the first-instance court did not commit any procedural violations and correctly applied the substantive law. Therefore, the Court concluded that the appellate court’s judgment should be overturned and the first-instance court’s decision upheld.

Resolution of the Supreme Court of 2 July 2025 in case No. 490/7829/23 (proceedings No. 61-16525св24) - https://reyestr.court.gov.ua/Review/128595059.

This and other legal positions of the Supreme Court can be found in the Database of Legal Positions of the Supreme Court - https://lpd.court.gov.ua.