Oschadbank withdrew 74,830 hryvnias from accounts without the client's consent. What was the court's ruling on this matter?

A man lost 74,830 hryvnias from his cards at Oschadbank. He blames Sberbank for inadequate protection and safeguarding of his funds. This is stated in the decision of the Pechersk District Court of Kyiv, published on July 30, 2024.

On September 17, 2022, 72,000 hryvnias were withdrawn from the man's credit card, along with a commission fee of 630 hryvnias for the withdrawal, and an additional 2,200 hryvnias from his salary card. He promptly reported the incident to a bank employee and the police, where a criminal case was initiated under part 1 of Article 190 (fraud) of the Criminal Code of Ukraine. From September 17, 2022, to November 1, 2022, 2,885 hryvnias were debited from his account for monthly payments towards credit debt repayment. Furthermore, on September 29, 2022, 24,000 hryvnias were returned to his credit card from the funds that were withdrawn on September 17, 2022.

The man believes that since the funds were withdrawn without the account owner's knowledge and consent, the bank failed to provide adequate protection and security for the funds, and therefore is obliged to refund the money to the client's account. He requests that the Main Directorate for Kyiv and Kyiv Region of Oschadbank be required to cease the violation of the rights of a citizen of Ukraine as a consumer of financial services.

"According to Article 87 of the Law of Ukraine 'On Payment Services', the payer is responsible to the payment service provider servicing them in accordance with the terms of the agreement concluded between them regarding the provision of payment services. The procedure for the issuance/acquiring of issued payment instruments (including electronic payment means, prepaid payment instruments) and the execution of settlements using them is regulated by the Regulation on the procedure for the issuance and acquiring of payment instruments, approved by NBU Resolution No. 164 of February 22, 2020. According to paragraph 140 of Section VII of Regulation No. 164, the user is obliged not to disclose and in any other way not to reveal individual account information and/or other information that allows initiating payment transactions and to immediately inform the issuer in the manner and channels of communication specified in the agreement between the issuer and the user, as soon as they become aware of the loss of such information and/or payment instrument. The completed transactions for transferring funds to another bank's card were confirmed by the plaintiff's biometric data/or access code. Access to the remote banking system (RBS) Mobile Banking 'Oschad24/7' and the transfer operations were carried out correctly, which is only possible with the presence of banking card details, SMS passwords, and push notifications sent to the plaintiff's financial phone, known only to him," - stated Oschadbank.

What did the court decide?

The court denied the man's claim. The transactions using the online resource were conducted correctly with all necessary payment card details, indicating the bank's absence of guilt in executing the client's order to transfer funds from his account.

"The funds transfer operations totaling 74,830 hryvnias (including the commission) were carried out on September 17, 2022, online using the RBS 'Oschad 24/7', with authorization and entry completed using the payment card details, including the CVV code, as well as financial numbers and codes received in messages to the financial number, known only to the cardholder, therefore JSC 'Oschadbank' should not bear responsibility for these operations," - emphasized the court.