Unauthorised payment: blocking access, complaining to your bank and evidence

Open the banking application yourself or call the number from the card and the official website. Report a suspicious transaction and ask to restrict the appropriate access: card, internet banking or other compromised tool. If the attacker controls the phone, use another device.

Do not transfer the balance to a "protected account" at the caller's request and do not install a remote control application. Tell the bank what exactly happened: loss of the card, data entry on the website, confirmation in the application, unknown transfer. Save the number of the registered request.

Compare recipient, date and amount with purchases, subscriptions, hotel deposits and deferred charges. An unauthorized transaction means no consent from you. If you transferred money to the fraudster yourself, the legal assessment is different from transferring without consent; state the facts, without choosing an advantageous name artificially.

According to the Rzecznik Finansowy, the verification of a password or code is not the same as proof of consent to a specific transaction. But this is not a promise of unconditional return for any deception. The content of the confirmation and the sequence of actions are important to the bank.

• The date, amount, currency and identifier of each disputed transaction.
• A summary history of calls, messages and actions in the app.
• Screenshots of suspicious messages, website address and recipient details, if visible.
• The number of the first request to the bank and information about already blocked instruments.
• A specific request to refund the amount of a transaction that you did not agree to.

Send the complaint to the bank through its official channel and save the confirmation. If there are signs of a crime, contact the police with the same materials; a police report does not replace contacting the bank. Do not delete the correspondence with the fraudster, even if it is unpleasant.

For unauthorized transactions, the legislation provides for the obligation to return under the D+1 rule – by the end of the next business day after receipt of information, with specified exceptions. The Ombudsman separates this duty from the final allocation of responsibility. If the bank has refused, ask for the reasons and the evidence on which it relies.

Read the answer for each operation: do not limit yourself to the line "the correct code was used". Indicate which facts of the answer are incorrect, attach proofs. Once the complaints procedure has been exhausted, it is possible to apply to the Ombudsman for intervention or the dispute resolution procedure provided for. On its website there is a description of the channels and required applications.

Put the contract, the complaint, the receipt and the answer in one folder. When changing passwords, first protect the email and phone number through which access is restored. Ask your bank to check unknown trusted devices and limit settings; successfully blocking one card does not mean that all access to the account is removed.

• Consent, D+1 rule and responsibility
• Appeal and defence of the client in a dispute

• PESEL: why you need a Polish identification number
• First steps after moving to Poland: documents, address, work and medicine
• Received a PIT-11? Check your tax return in Twój e-PIT
• Protecting bank savings in Poland: how to check BFG cover