Imagine checking your bank account and discovering that ₦2 million has been transferred without your permission. You immediately report the transaction to your bank and request a reversal. The bank investigates and tells you that the transaction was successfully authenticated. It then refuses to refund the money. At this point, two important questions arise: Can you sue a bank for an unauthorised transaction in Nigeria? And if the bank refuses to refund the money, what can you do to recover it? The answer is yes, a bank can be sued where the facts establish a valid legal claim against it. However, the mere fact that a customer did not personally initiate a transaction does not automatically make the bank liable. The circumstances surrounding the transaction must be examined carefully. This includes how the transaction was initiated, what authentication was used, whether the customer’s credentials were compromised, whether the customer disclosed any security information, what the bank’s systems detected, how quickly the transaction was reported and what the bank did after receiving the complaint. This article explains when a bank may be liable for an unauthorised transaction, whether a bank is required to refund the money, what evidence you need, what to do if the bank refuses to reverse the transaction and when legal proceedings may be appropriate. What Is an Unauthorised Bank Transaction? An unauthorised bank transaction is a transaction carried out on a customer’s account without the customer’s authority. It can include: Unauthorised bank transfers. Unauthorised ATM withdrawals. Unauthorised POS transactions. Unauthorised card payments. Unauthorised online payments. Unauthorised debits. Transactions resulting from compromised banking credentials. The circumstances differ from case to case. For example, a person may gain access to a customer’s banking application, obtain the customer’s card details through fraud, compromise the customer’s account or use other means to initiate a transaction. The legal consequences depend substantially on how the transaction occurred. Can You Sue a Bank for an Unauthorised Transaction? Yes. A customer can sue a bank where the facts establish a legally recognisable claim. However, the customer must establish the basis of the claim. A court will not simply order a bank to refund money because the customer says, “I did not authorise the transaction.” The evidence surrounding the transaction must be examined. Relevant questions include: How was the transaction initiated? What authentication was used? Was the customer’s device compromised? Was an OTP used? Was the customer’s PIN used? Did the customer disclose any security credentials? Did the bank detect unusual activity? Did the bank comply with applicable security requirements? When did the customer notify the bank? What action did the bank take after receiving the complaint? Can the recipient of the funds be identified? These questions can determine whether a claim against the bank is likely to succeed. Will a Bank Refund an Unauthorised Transaction? Not automatically. Whether a bank is required to refund an unauthorised transaction depends on the circumstances in which the transaction occurred and whether the bank breached a legal, contractual or applicable regulatory obligation. A bank is entitled to investigate a disputed transaction before deciding whether to reverse or refund it. However, the bank should not treat the fact that a transaction was successfully authenticated as automatically ending the customer’s claim. The relevant questions include: How was the transaction initiated? Was the customer’s PIN, OTP, password or other authentication credential used? Did the customer disclose any security credentials? Was the customer’s device or account compromised? Did the transaction display unusual or suspicious characteristics? Did the bank’s systems detect or respond appropriately to the transaction? How quickly did the customer report the transaction? What steps did the bank take after receiving the complaint? Therefore, the answer to “will a bank refund an unauthorised transaction?” depends on the evidence. Where the evidence establishes that the bank was responsible for the loss or breached a duty owed to the customer, the customer can pursue appropriate reliefs, including recovery of the money and, where justified, damages or other consequential relief. On the other hand, where the evidence establishes that the customer’s own conduct caused or materially contributed to the loss, the bank may rely on that conduct in defending the claim. The correct approach is therefore to establish how the transaction occurred and who bears legal responsibility, rather than assuming that either the bank or the customer is automatically liable. What If the Bank Says the Transaction Was Authenticated? This is one of the most common responses from banks. The bank may say that: Your PIN was correctly entered. Your OTP was successfully used. Your mobile banking application was used. The transaction came from your registered device. The transaction passed the bank’s authentication system. That evidence is relevant, but it does not necessarily end the dispute. Authentication establishes that the bank’s system received the required credentials. It does not, by itself, answer every question concerning who actually initiated the transaction or whether the transaction resulted from fraud, compromise or another circumstance for which the bank may bear responsibility. The particular facts must therefore be examined. What If You Gave the Fraudster Your OTP? This can significantly affect the case. Suppose a fraudster impersonated your bank and persuaded you to disclose an OTP. The fraudster then used the OTP to transfer money from your account. The bank may argue that you authorised the transaction or were negligent in disclosing the OTP. Whether that argument succeeds depends on the circumstances. The customer’s conduct is important, but so are the bank’s security, fraud-detection and customer-protection obligations. A customer should therefore provide the complete facts when reporting the incident rather than withholding information that may later become relevant. What If You Did Not Give Anyone Your PIN or OTP? That can strengthen the customer’s position, particularly where the evidence indicates that the transaction occurred despite the customer’s security credentials not being disclosed. The bank may still investigate how the transaction was completed. However, where there is evidence of a compromised account, security failure, unusual transaction activity or other
What to Do When a Bank Refuses to Reverse an Unauthorised Transaction in Nigeria
You check your bank account and discover that ₦500,000 has been transferred without your authorisation. You immediately contact your bank, report the transaction and ask for your money to be returned. Then the bank tells you: “The transaction was successful.” Or: “You authorised the transaction.” Or simply: “Our investigation shows that the transaction was valid.” What should you do next? A bank’s refusal to reverse an unauthorised transaction does not necessarily mean that you have no further remedy. Nigerian bank customers have access to internal complaint mechanisms, regulatory escalation and, where appropriate, legal remedies. The important thing is to act systematically and preserve your evidence. First, Understand Why the Bank Refused the Reversal Before deciding what to do next, obtain the bank’s position in writing. The bank may argue that: The transaction was properly authenticated. Your PIN, password, OTP or other credentials were used. You disclosed your banking credentials. The transaction originated from your registered device. The transaction was authorised by you. The bank’s investigation did not establish a system failure. The recipient has already withdrawn or transferred the funds. Do not rely solely on a verbal explanation from a customer-service representative. Ask the bank to provide its response formally and retain it. Does the Bank Have a Right to Reject Your Complaint? A bank is entitled to investigate a disputed transaction and determine whether it is liable. However, a customer also has a right to have a complaint properly considered. The Central Bank of Nigeria states that bank customers have a right to a complaints-management system through which they can seek redress. Customers also have a right to be kept informed about the resolution process and the basis of the bank’s decision. Where a customer is dissatisfied, the CBN states that the customer has a right of review by the bank, the CBN or the courts. Therefore, a bank’s rejection of your complaint is not necessarily the end of the matter. What Should You Do After the Bank Rejects Your Complaint? If the bank has refused to reverse the transaction, take the following steps. 1. Request the Bank’s Final Position in Writing Ask the bank to provide a written explanation of why it rejected your complaint. Your request should identify: The disputed transaction. The date and amount. The transaction reference. Your complaint reference number. The reason given for rejecting your complaint. The action you want the bank to take. Keep a copy of the correspondence. 2. Ask for the Complaint Tracking Number Make sure you have the bank’s complaint or tracking reference. The CBN’s current complaints process requires customers to first lodge their complaint with the financial institution and obtain a complaint reference/tracking number. This number becomes important if you later escalate the complaint. 3. Preserve All Evidence Keep all documents and communications relating to the transaction. These can include: Bank statements. Transaction alerts. SMS messages. Emails. Screenshots. Transaction references. The recipient’s account details. Your complaint to the bank. The bank’s response. Communications with the suspected fraudster. Police or other law-enforcement reports. Do not delete or alter potentially relevant electronic evidence. Can You Escalate the Complaint to the CBN? Yes. If the bank fails to resolve the complaint within the applicable period, you can escalate the matter to the Consumer Protection Department of the Central Bank of Nigeria. The CBN’s official guidance states that customers should first complain to their financial institution. Where the complaint remains unresolved within the applicable timeline, the customer can escalate it to the CBN. The CBN’s current complaints portal also requires the customer to first lodge the complaint with the financial institution and obtain a tracking number before using the escalation process. How Long Should You Wait Before Escalating to the CBN? This is an area where you should be careful about relying on outdated information. Older CBN guidance refers to a two-week period for unresolved complaints, while more recent CBN materials refer to the timelines stipulated under the applicable Consumer Protection Regulations. The safest approach is to lodge the complaint formally with the bank, obtain the tracking number and follow the current CBN escalation process applicable to your complaint. Do not simply send a complaint to the CBN without first complaining to your bank. What Should You Include in a CBN Complaint? Your complaint should clearly explain: Your name and contact details. The name of the bank. The disputed transaction. The date and amount involved. Your account details, without disclosing your PIN or password. What happened. When you discovered the transaction. The complaint you made to the bank. The bank’s response. The resolution you are requesting. Supporting documents. The CBN specifically advises complainants not to include sensitive credentials such as PINs and passwords in their complaint. Can the CBN Order the Bank to Refund Your Money? The CBN has a consumer-protection and complaints-resolution role in relation to financial institutions under its regulatory purview. Its Consumer Protection Framework requires financial institutions to have customer compensation policies addressing categories including unauthorised or erroneous debits and financial loss resulting from staff negligence or fraudulent activities. However, a CBN complaint should not be treated as an automatic guarantee that the customer will receive a refund. The regulator will consider the complaint, the bank’s response and the available evidence. Where the dispute involves issues that require judicial determination, court proceedings may become necessary. What If the Bank Says You Authorised the Transaction? This is one of the most important situations to address. The bank may argue that the transaction was authorised because: An OTP was entered. The customer’s PIN was used. The transaction came from the customer’s device. The customer’s password was used. The transaction passed the bank’s authentication process. But the existence of authentication does not necessarily answer every question concerning liability. The circumstances in which the credentials were obtained and used, the security systems involved, the customer’s conduct and the bank’s own obligations can all be relevant. For example, a customer may have been deceived through phishing, social engineering or another form of fraud. The