In banking law, unauthorised transactions are among the most critical issues affecting banks and customers. They occur when funds are moved, payments made, or instructions executed without the account holder’s consent or beyond the scope of authority. Understanding the liability framework is essential for banks to manage risk, comply with regulations, and maintain trust in the financial system.
1. Definition of Unauthorised Transactions
An unauthorised transaction is any transaction that:
-
Was not instructed or approved by the account holder;
-
Exceeds the authority granted under a mandate or account agreement;
-
Is initiated fraudulently or negligently; or
-
Breaches regulatory or contractual obligations.
Examples:
-
Payment made by an individual not authorised under a joint account mandate.
-
Cyber fraud or phishing that allows funds to be withdrawn without consent.
-
Bank staff processing instructions without proper verification.
-
Overdraft or credit applied without the account holder’s explicit approval.
2. Legal Framework
A. Contract Law
-
The bank-customer relationship is contractual, and unauthorised transactions constitute a breach of contract.
-
Banks are typically liable to restore funds if they fail to exercise due care or act outside the mandate.
B. Tort Law (Negligence)
-
Liability may arise if the bank fails to exercise reasonable skill and care, resulting in financial loss.
-
Courts assess whether the bank acted as a “reasonably competent banker” in the circumstances.
C. Regulatory Oversight
-
Financial regulators impose mandatory frameworks to address unauthorised transactions, particularly in digital banking, e-payments, and fraud prevention.
-
Examples include PSD2 (Payment Services Directive 2) in the EU and Regulation E in the US, which mandate customer protection and dispute resolution protocols.
3. Bank Liability for Unauthorised Transactions
Banks may be held liable under the following circumstances:
A. Internal Negligence
-
Staff fail to verify identity, signatures, or authority.
-
Breaches of internal controls allow unauthorised withdrawals.
B. System Failures
C. Failure to Comply with Mandate
D. Non-Compliance with Legal or Regulatory Requirements
-
Banks must implement fraud detection, monitoring, and reporting procedures.
-
Failure can trigger regulatory sanctions and customer claims.
4. Customer Liability
While banks have primary responsibility, customers may bear partial liability in certain scenarios:
-
Negligence or Misuse: Sharing PINs, passwords, or security devices.
-
Failure to Notify: Delaying reporting of lost cards or compromised credentials.
-
Fraud Participation: Active collusion in fraudulent transactions.
Most modern laws, however, limit customer liability for unauthorised electronic transactions, provided the customer acted reasonably and promptly notified the bank.
5. Remedies for Unauthorised Transactions
A. Reversal of Transaction
B. Damages
C. Dispute Resolution
-
Internal complaint mechanisms
-
Financial ombudsman services or arbitration
-
Civil litigation in severe or unresolved cases
6. Preventive Measures for Banks
A. Robust Authentication
B. Monitoring & Fraud Detection
C. Staff Training
D. Cybersecurity Measures
E. Clear Communication
7. Regulatory and International Standards
-
EU PSD2: Banks must refund unauthorised electronic payments unless the customer acted fraudulently or with gross negligence.
-
US Regulation E: Limits customer liability for electronic fund transfers and requires banks to resolve disputes promptly.
-
Basel Committee Principles: Require banks to maintain operational risk controls and customer protection measures.
8. Key Challenges
-
Digital Banking Fraud: Rapid increase in phishing, identity theft, and social engineering attacks.
-
Third-Party Payment Providers: Banks remain liable for unauthorised transactions via fintech or e-wallet integrations.
-
Cross-Border Transactions: Jurisdictional complexities in recovering funds and applying local consumer protection laws.
-
Evolving Regulatory Landscape: Continuous updates in PSD2, GDPR, and other frameworks require banks to adapt quickly.
9. Conclusion
Unauthorised transactions and liability are a critical aspect of banking law, balancing bank responsibility, customer protection, and operational risk.
Key takeaways:
-
Banks are primarily liable for processing transactions without proper authorisation or due care.
-
Customers may bear limited liability if they act negligently or fail to report breaches promptly.
-
Effective internal controls, verification procedures, cybersecurity, and staff training are essential to prevent unauthorised transactions.
-
Regulatory frameworks globally impose strict obligations for reimbursement, dispute resolution, and fraud prevention, emphasizing the importance of proactive risk management.
In modern banking, unauthorised transactions represent both a legal and operational challenge, and addressing them effectively is crucial for trust, compliance, and financial stability.
