A Kyivstar subscriber lost 59,500 hryvnias from her bank account—here’s the court's ruling on the matter.

A woman accessed a Telegram bot via a link she received from a number associated with Oschadbank. Then, she received a call on her Kyivstar number from someone who claimed to be a bank representative and asked her to provide four digits from a message she had received from the bank, but she refused. Subsequently, 59,500 hryvnias were withdrawn from her account. This was stated in the decision of the Obolon District Court of Kyiv, published on January 15, 2025.

On August 20, 2023, unknown individuals used a chat bot to seize the funds belonging to the woman, which were in her account at the State Savings Bank of Ukraine in the amount of 59,500 hryvnias. To activate her Kyivstar card, the subscriber called the bank's hotline, where she was informed that technical work was being carried out, and she needed to log into the mobile application and follow the instructions. In the "Oschad24" mobile application, she performed a series of actions, including through the Telegram chat bot. Since the operation could not be completed, the client requested a callback from the bank; she received a call and was asked to provide four digits from the message, but she declined. However, after this, she noticed that funds were withdrawn from her account, first 12,000 hryvnias and then 48,000 hryvnias, after which the bank blocked her card.

"The transactions were carried out using the client’s account after registration in the 'Oschad 24/7' system. The login to the system was executed correctly. The Telegram chat bot used by the plaintiff does not contain any special mark of verification and is not the official chat bot of JSC 'Oschadbank.' The bank's website contains a message emphasizing the necessity of using only the official chat bots of the bank, which are marked with a blue official checkmark, and it states that entering information such as card PIN, login, password, CVV2/CVC2 is strictly prohibited. The chat bot asked the plaintiff for her phone number and the last four digits of her card. She was sent a code via SMS for setting/changing the card's PIN. When contacting the call center, the plaintiff mentioned that she had been chatting in the bot for an hour and entered all the passwords; then she was asked to provide four digits that the robot specified, and after that, 12,000 hryvnias were withdrawn from her account. In response to the operator's messages stating that these were fraudsters, the plaintiff insisted that she accessed this chat bot through a link from the 'Oschad24/7' application. Thus, it was the actions of the plaintiff, as the account holder, that led to the loss and illegal use by others of the information that allowed the initiation of payment operations," Oschadbank stated.

According to the court ruling dated May 27, 2024, it was decided to conduct the case with the summons of the parties to the court session and to grant the bank's request for evidence from JSC 'Kyivstar' and JSC 'Tascombank.' On June 21, 2024, information from JSC 'Kyivstar' was received by the court in compliance with the ruling. On June 25, 2024, the court received the requested information from JSC 'Tascombank' regarding the recipient of the funds from the woman's account.

What was the court's decision?

The court granted the woman's claim. The State Savings Bank of Ukraine will be required to pay her 59,500 hryvnias.

"The court notes that since the defendant introduced the method of obtaining banking services through a Telegram bot, it is the defendant's responsibility to ensure the security of using this type of communication, including protecting clients from fraudulent Telegram bots. The plaintiff received the link to the Telegram bot specifically from the defendant, which is not disputed, and the plaintiff asserts that she accessed it via this link, which the defendant has not refuted. The court rejects the bank's arguments that the plaintiff should be aware of the information posted on the bank's website regarding the distinctions of Oschadbank's chat bot, as the plaintiff is not obligated to systematically familiarize herself with the bank’s website," the court emphasized.