A Kyiv resident sought assistance for IDPs, but found 29,000 hryvnias missing from her Oschadbank account. Here's the court's ruling on the matter.

A woman sought assistance for IDPs on a website where she entered her bank card details and PIN code. As a result, she lost funds from her Oschadbank accounts totaling 29 thousand hryvnias. This was stated in the decision of the Svyatoshynsky District Court of Kyiv, published on October 4, 2024.

On July 23, 2023, the woman followed a link to receive IDP assistance, where she selected a bank for help and entered her bank card information and PIN code. Subsequently, funds in the amount of 4 thousand hryvnias were withdrawn from this bank card. Additionally, 25 thousand hryvnias were withdrawn from the credit card of JSC Oschadbank. The funds were transferred to an unidentified bank account. During the funds withdrawal operation from the bank cards, the bank did not send a consent request for the transaction and proceeded with the banking operation without her approval. She did not give consent for any banking operations with the cards.

"On July 23, 2023, banking operations for fund withdrawals were carried out in the mobile application 'Oschad 24/7' (the new version Flumo). For registration and installation of the new mobile application, a PC and PIN code known only to the client are used, along with one-time OTP passwords provided to the client automatically on the plaintiff's phone number. Access to the 'Oschad 24/7' mobile application was completed correctly, with confirmation through biometrics or access code and using the plaintiff's phone number. The executed operations were also confirmed by biometrics or access code set during the first login to the mobile application. On July 23, 2023, the plaintiff executed a series of transfers, and 29 thousand hryvnias were deducted from the client's card. The plaintiff's actions contributed to exposing financial security to third parties, enabling them to initiate payment operations using the credit card. She did not provide evidence to confirm the defendant's actions or inactions that contributed to the loss or illegal use of her personal identification number or other information allowing the initiation of payment operations with the credit card," - stated Oschadbank.

What was the court's decision?

The court denied the woman's claim. Her actions resulted in the illegal use of information that allowed the initiation of payment operations, leading to the deduction of funds from her account.

"The disputed transfers were made as a result of the plaintiff following a link received in the Viber messenger, where she subsequently disclosed her bank card details and PIN code to third parties, resulting in the deduction of funds. Thus, in this case, the plaintiff executed a payment operation by disclosing to third parties information that allows payment operations to be performed on behalf of the payer using electronic payment means. These circumstances undoubtedly prove that the plaintiff's actions led to the illegal use of information that allows for the initiation of payment operations, resulting in the withdrawal of funds from her account. Only after such an operation did she inform the bank about the unauthorized deduction of funds. Until the bank was notified of the loss of the payment instrument and/or individual account information, the risk of losses from improper payment operations and responsibility for them lies with the user, i.e., the plaintiff. The bank is not liable for the deduction of funds in such situations. Considering the above, assessing the relevance, admissibility, and credibility of each piece of evidence separately, as well as their sufficiency and mutual connection in their entirety, the court concludes that there are no grounds for satisfying the claim," - emphasized the court.