Through the court, a resident of Ternopil obtained the return of 109,655 hryvnias, which the fraudsters stole from his bank account. Oschadbank twice refused to compensate losses, referring to confirmation of transactions with passwords and biometrics, but the court found these arguments insufficient. “Sudovo-yuridychna gazeta” writes about it.
Fraudsters gained access to the account of a resident of Ternopil through Oschad 24/7 mobile banking. Чоловік помітив проблеми, коли не зміг увійти до застосунку за своїм PIN-кодом. At the same time, numerous automated calls began to arrive on his phone, during which the voice assistant announced one-time codes. The client decided that the bank was helping him regain access to the account, so he entered the received combinations. In fact, at this time, third parties were registering new devices in the mobile banking system. After gaining access, they began transferring money from the victim’s account.
Крадіжка сталася 24 грудня 2024 року. За чотири хвилини з рахунку чоловіка зникли 109 655 гривень.
О 13:06 шахраї здійснили два перекази по 20 тисяч гривень. Already at 1:07 p.m., they sent another 24,000 hryvnias to another bank’s card, and the transaction fee was 655 hryvnias.
Останній переказ відбувся о 13:10. Then another 45 thousand hryvnias were debited from the account to the internal account.
Наступного дня потерпілий звернувся до Ощадбанку та поліції. The law enforcement officers opened criminal proceedings on the fact of embezzlement. However, the bank twice refused to compensate the man for damages. The financial institution claimed that all transactions were properly verified through the mobile application. In particular, Oschadbank referred to the use of one-time passwords and biometric authentication. In the bank’s opinion, this indicated proper confirmation of payments.
Disagreeing with the refusals, the client appealed to the court with a demand to return the stolen savings.
During the consideration of case No. 607/11756/25, the court found that the bank did not provide sufficient evidence of the client’s deliberate or negligent actions that led to the disclosure of his personal data. The court emphasized that the correct entry of passwords does not in itself prove the guilt of the account owner. In order to impose responsibility on the client, proper evidence of his actions or inaction is required. Окрему увагу приділили обставинам проведення переказів. Suspicious operations occurred one after the other within minutes from the new device after the access settings were changed. According to the court, the bank had the technical ability to react to such activity and stop suspicious payments. The behavior of the victim after the theft was also taken into account. The very next day, he reported the incident to the financial institution and the law enforcement officers, which confirmed the lack of intention to voluntarily transfer the money.
In making its decision, the court took into account legal opinions of the Supreme Court, according to which the use of correct passwords is not conclusive evidence that the account holder himself carried out the transaction or facilitated the fraud. In the absence of convincing evidence of the client’s guilt, doubts about the circumstances of unauthorized transfers should be evaluated taking into account the protection of the rights of consumers of banking services.
As a result, the court satisfied the demands of the victim. Oschadbank was ordered to return all 109,655 hryvnias to the client and pay a court fee. At the same time, the fraudulent scheme was based on the use of one-time codes that were sent to the phone of the account holder. Such combinations cannot be communicated to third parties or entered on the instructions of unknown interlocutors.
Employees of banks, the Pension Fund and other government institutions should not request a card PIN code, three-digit CVV code or one-time passwords over the phone to confirm bank transactions.
