Banks held liable for unauthorized transactions and fraud

Legal precedents and court rulings are clarifying the responsibility of financial institutions regarding fraudulent transactions. In Brazil, the Superior Court of Justice (STJ) has established through Precedent 479 that banks are objectively liable for damages caused by internal fortuity related to fraud and crimes committed by third parties within banking operations. This means institutions may be held responsible if a fraud is linked to the inherent risks of financial activities or failures in service provision, such as failing to identify transactions that deviate significantly from a consumer's habitual pattern.

In the European Union, the Court of Justice of the European Union (CJEU) ruled that banks must immediately reimburse customers who are victims of unauthorized payment operations, even in cases where the bank alleges gross negligence by the client, such as falling victim to phishing. Under this ruling, banks must provide the refund first and can only seek restitution from the client later if they can prove gross negligence. This decision clarifies the application of the European Payment Services Directive, ensuring that the obligation to reimburse is not automatically waived due to a customer's failure to protect security data.