Unauthorised Transactions

Unauthorised transactions are payments, transfers or withdrawals carried out on a bank or card account without the account holder's knowledge or permission. They typically arise from fraud, such as a stolen card, a compromised card number used for an online purchase, or unauthorized access to online or mobile banking credentials, and are distinguished from a fraudulent transaction more broadly by the specific fact that the genuine account holder never approved the transaction at all.

Most payment regulations and card network rules give consumers strong protection against unauthorised transactions, typically capping the customer's liability at a small, fixed amount, or removing liability entirely, provided the loss or theft is reported promptly to the bank or card issuer. This differs meaningfully from a scam in which the account holder is deceived into authorising a payment themselves, a category increasingly referred to as authorized push payment fraud, which can carry different liability rules entirely.

If money leaves your account because someone else used your card or login details without your knowledge or consent, that is an unauthorised transaction, and consumer protection rules in most countries exist specifically to limit how much of that loss falls on you personally.

Common causes of unauthorised transactions include a lost or stolen physical card used before it is reported and blocked, card details compromised through a data breach and later used for online purchases, and stolen online or mobile banking login credentials used by a fraudster to initiate transfers directly from the account.

Prompt reporting to the bank or card issuer is critical, since most consumer protection frameworks tie liability limits to how quickly the loss is reported, and the error resolution process that follows typically involves a provisional credit to the customer's account while the claim is formally investigated. Banks generally reserve the right to deny a claim if their investigation finds evidence the transaction was in fact authorised by the account holder, which is why clear communication and documentation matter considerably during the dispute process.

When a customer reports an unauthorised transaction, the bank typically reviews transaction data such as the device and location used, comparison against the customer's normal spending patterns, and whether any security credentials were entered correctly, to assess how likely it is the transaction was genuinely unauthorised rather than simply forgotten or misunderstood by the customer. This investigation process can take anywhere from a few days to several weeks depending on the complexity of the case and whether the payment involved a domestic or cross-border transfer.

Customers can reduce their own exposure to unauthorised transactions by enabling transaction alerts that notify them immediately of any card or account activity, using unique and strong passwords for online banking rather than reusing credentials across multiple services, and reporting a lost or stolen card the moment it is noticed rather than waiting to see if it turns up. Banks increasingly supplement these customer-side precautions with their own fraud detection systems that flag unusual transaction patterns automatically, sometimes blocking a suspicious transaction before the customer has even noticed anything is wrong.

An unauthorised transaction is distinct from a disputed charge where the account holder genuinely made the purchase themselves but disagrees with the merchant over quality, delivery or billing accuracy, since the latter involves a real transaction the customer authorized but is unhappy with, rather than one they never approved at all. Banks generally apply different investigation processes to each category, since proving a transaction was never authorized in the first place requires different evidence than resolving a genuine disagreement between a customer and a merchant they knowingly dealt with.

The specific legal liability framework governing unauthorised transactions differs across countries, with some setting a fixed maximum liability regardless of circumstances and others removing customer liability entirely once a loss is reported within a specified window, reflecting different policy choices about how to balance fraud prevention incentives against consumer protection. Customers moving between countries or using cards issued under a different country's regulatory framework should understand that the specific protections and reporting deadlines applicable to them may differ meaningfully from what they are used to elsewhere.