On 4 November 2026, the President of the Office of Competition and Consumer Protection (UOKiK) published decisions obliging four financial institutions to change their policies regarding the handling of reports about unauthorized payment transactions. The entities covered by the allegations included ING Bank Śląski, Bank Ochrony Środowiska, Nest Bank, and Plus Bank. Supervisory authorities required these banks to implement new procedures and re-verify complaints rejected by these institutions since 16 November 2022.
A key element of the new obligations is compliance with the D+1 rule, which requires banks to return stolen funds to consumers no later than the end of the next business day from the date of reporting the unauthorized operation. The only legally justified exceptions to this deadline are situations where the bank has documented suspicions of fraud committed by the customer themselves, or when more than 13 months have passed since the date of the transaction. In other cases, refusing to return funds at the stage of preliminary analysis of the report is contrary to applicable law.
Previous bank practices
According to the UOKiK communication, these banks previously applied practices that the regulator deemed defective. These institutions often refused to return money, suggesting that correct authentication of the transaction (for example, by using a PIN code or authorisation in the app) exempts them from liability and automatically means the customer's consent to the transfer. Furthermore, the banks unjustifiably shifted the burden of proof onto consumers, claiming that the recovery of funds is possible only through the actions of law enforcement authorities, and not by the bank itself. UOKiK President Tomasz Chróstny pointed out that such an approach is contrary to the law, which clearly defines the obligations of financial institutions in situations where the customer's funds are taken without their knowledge and consent, e.g., as a result of a cyberattack.
Requirements for banks
By virtue of the issued decisions, ING Bank Śląski, Bank Ochrony Środowiska, Nest Bank, and Plus Bank must carry out a series of specific actions. First and foremost, the banks are obliged to change their internal procedures so that correct authentication of the transaction is not the only basis for determining that the customer authorised it themselves or committed gross negligence. In such a situation, the bank must prove that the customer consciously performed the operation.
The second important obligation concerns the re-verification of complaints. Banks must analyse negative responses given to consumers since 16 November 2022. In justified cases, these institutions will have to return the lost money to the affected customers. The deadline for conducting refunds has been set for no later than 31 December 2027. This applies to both current and former customers. Individuals who no longer use the services of a given bank but whose complaints filed after 15 November 2022 were rejected will be notified of the possibility and method of submitting an application for a re-examination of the case.
The role of the CJEU ruling
The UOKiK decision is based, among other things, on the October ruling of the Court of Justice of the European Union (CJEU) in case C-70/25 (Tukowiecka), which was delivered in 2026. This judgment confirmed the regulator's position that, in the case of unauthorized transactions, e.g., resulting from a phishing attack, the bank has an absolute obligation to immediately return the funds. The CJEU indicated that relying on the consumer's "gross negligence" to refuse payment is an unlawful action. The Court emphasized that banks cannot act as judges in their own cause and have no grounds for mass rejecting complaints of robbed customers.
Information obligation and reporting
Banks are obliged to inform about the issued decisions on their websites and to notify customers through mobile applications. Additionally, these institutions will have to present a report to the President of UOKiK on the manner of fulfilling the obligations imposed on them. The deadline for submitting such a statement expires on 30 April 2028.
It is worth noting that the current decision is a continuation of UOKiK's actions in this area. Previously, the regulator issued similar decisions against Alior Bank, mBank, BNP Paribas, and Bank Millennium, pointing to recurring problems in the industry in the area of protecting consumers from the effects of cyberattacks.