Colombian regulator mandates banks reimburse unauthorized debit withdrawals

The Superintendencia Financiera de Colombia issued a landmark ruling that clarifies when financial institutions must return funds lost through unauthorized debit‑card withdrawals. The decision arose from a lawsuit filed by Alfonso Herrera Cedeño, who demanded the return of 9,664 million pesos withdrawn from his savings account without his consent. Banco Davivienda argued the transactions were made using the client’s physical card and PIN, attributing responsibility to the customer’s alleged negligence.

The regulator rejected that narrow view, stating that banks must be evaluated on whether they complied with security and monitoring standards required by law. It emphasized the need for mechanisms that detect atypical transaction patterns and trigger alerts or blocks. Citing Supreme Court jurisprudence, the Superintendencia affirmed that a bank cannot escape liability merely by proving it acted diligently, and must compensate customers when security obligations are not met.