Situation: an SMS or push notification is received from the bank about a debit from your account, but you are sure that you did not make any payments or send transfers. It is possible that scammers are trying to take over your funds. We tell you how not to lose money in a similar situation.
You need to act immediately — a lot depends on the speed of your reaction. Here's what advises Information security / Bank of Russia make the Central Bank of the Russian Federation:
Then it remains to wait for the investigation and the decision of the bank.
By law, in case of theft, a financial institution is obliged to Federal Law No. 161-FZ dated 06/27/2011 "On the National Payment System" to compensate for the damage. But the bank will do this only if two conditions are met. We have already talked about the first one: it is important to report the theft no later than the next day. If you delay even an extra day, the bank has the right to refuse a refund.
But the second point is no less important: the financial institution must be sure that the victim himself did not transfer his payment details to outsiders. That is, I did not tell anyone the PIN code, I did not write it on the back of the card so as not to forget. And he did not tell the attackers the card number, the name of its owner, the expiration date and CVV/CVC.
For example, such a theft scheme is possible. To pay for some purchase, the scammers ask a person for a card and go with it to the next room — the supposedly working terminal is located only there. And they quickly take pictures of her from both sides. Then, after some time, the scammers call the victim and apply one of the fraudulent scenarios. As a result, the person himself tells them the SMS code that he received from the bank. Knowing all the details of the card and the digital combination, scammers write off money.
If a financial institution proves that the confirmation code was sent, the person received it, and the smartphone is still with him, then he can conclude: the victim herself helped the scammers commit theft. And in this case, the bank will refuse to refund the money.
If you are sure that you did not transfer your payment details to anyone and did not provide any codes, you can hope for a successful outcome of the proceedings.
In addition, it happens that fraudsters are not to blame for the write-off of funds. Perhaps the client forgot that he signed up for a subscription that was free in the first month, and now the service has withdrawn money for the next period. Or connected an autopayment — for example, for utility services. Or the bank withdrew the money through the overdraft procedure.
It is enough to check the debit history in the mobile application to see where the money went. If the scammers have nothing to do with it, the funds will not be returned to the account either.
The financial institution, together with the payment system, conducted an investigation and found that the funds were indeed debited illegally, and the client was not to blame for this. This means that the bank is obliged to return the loss.
It may turn out during the proceedings that the money was debited as a result of a technical error. In this case, you can also count on a full refund.
The official investigation must be completed according to the law Federal Law No. 161-FZ of 06/27/2011 (as amended on 07/24/2023) "On the National Payment System", Article 9 within 30 days if the transaction was in Russia. For international transactions, such as transfers to neighboring countries, the trial time should not exceed 60 days.
If after the expiration of these terms there is neither money nor a reasonable refusal to refund, you can file a lawsuit. If the bank refused, but the client does not agree with this decision, it is also worth going to court.