Unauthorised payment refund
What counts as an unauthorised payment?
If money left your account without your approval, that’s an unauthorised payment. It could be because someone got your card details, or took over your internet banking (maybe when your phone or computer was compromised). When this happens your provider, under EU rules from PSD2, normally has to give you that money back and reset your account to its earlier state.
If you sent the money yourself, even if you were scammed, that’s usually an authorised payment instead, so the refund rules are different. If that’s your situation, our authorised push payment fraud guide covers the steps and the possible outcomes.
How to claim your refund step by step
- Let your bank or provider know immediately, as soon as you spot the payment, use its app, the contact number or the secure message option.
- If you’re able to, freeze your card or lock your account to halt more transactions.
- Send written confirmation that you didn’t authorize this payment. List the amount, date and the payee so there’s no confusion.
- Hold on to any evidence you have: screenshots, statement entries, messages from the fraudster, or a police reference if you’ve reported it.
- Once notified, your provider should pay the refund no later than the end of the business day after you reported it, unless there’s a valid reason to suspect fraud.
Did you use a card? In some cases, you might also have access to a chargeback process, which works differently.
Deadlines and the gross negligence exception
You’re expected to report an unauthorised payment without delay. According to PSD2 rules, the maximum time allowed is 13 months from when the payment left your account. That’s the envelope, but acting faster tends to result in better outcomes: it’s easier to track down records, and some banks set stricter limits in their own rules.
Providers can say no to a refund (or reduce it) only if they can prove you were either fraudulent or seriously careless. This covers situations like sharing your PIN, one-time code or password with someone, or ignoring security warnings. They have to back up any refusal with real evidence, you’re entitled to challenge their position by raising a formal complaint.
Frequently asked questions
How long do I have to report an unauthorised payment?
You have up to 13 months from when the money was debited, as set out under PSD2. Your bank or provider can specify a shorter window in its terms, so it’s important to check those carefully. Acting quickly gives you a stronger basis to prove the payment wasn’t yours.
Can my bank refuse an unauthorised payment refund?
Yes, but only in certain situations. Your provider can deny or reduce a refund if it clearly demonstrates that you acted fraudulently, or with gross negligence, for example, if you gave out your login information or one-time access code. If you think this has been decided incorrectly, you should raise a formal complaint. If you’re unsatisfied with that response, you can take the case to an ombudsman or another official dispute service.