Imagine checking your bank account and discovering that ₦2 million has been transferred without your permission. You immediately report the transaction to your bank and request a reversal. The bank investigates and tells you that the transaction was successfully authenticated. It then refuses to refund the money. At this point, two important questions arise: Can you sue a bank for an unauthorised transaction in Nigeria? And if the bank refuses to refund the money, what can you do to recover it? The answer is yes, a bank can be sued where the facts establish a valid legal claim against it. However, the mere fact that a customer did not personally initiate a transaction does not automatically make the bank liable. The circumstances surrounding the transaction must be examined carefully. This includes how the transaction was initiated, what authentication was used, whether the customer’s credentials were compromised, whether the customer disclosed any security information, what the bank’s systems detected, how quickly the transaction was reported and what the bank did after receiving the complaint. This article explains when a bank may be liable for an unauthorised transaction, whether a bank is required to refund the money, what evidence you need, what to do if the bank refuses to reverse the transaction and when legal proceedings may be appropriate. What Is an Unauthorised Bank Transaction? An unauthorised bank transaction is a transaction carried out on a customer’s account without the customer’s authority. It can include: Unauthorised bank transfers. Unauthorised ATM withdrawals. Unauthorised POS transactions. Unauthorised card payments. Unauthorised online payments. Unauthorised debits. Transactions resulting from compromised banking credentials. The circumstances differ from case to case. For example, a person may gain access to a customer’s banking application, obtain the customer’s card details through fraud, compromise the customer’s account or use other means to initiate a transaction. The legal consequences depend substantially on how the transaction occurred. Can You Sue a Bank for an Unauthorised Transaction? Yes. A customer can sue a bank where the facts establish a legally recognisable claim. However, the customer must establish the basis of the claim. A court will not simply order a bank to refund money because the customer says, “I did not authorise the transaction.” The evidence surrounding the transaction must be examined. Relevant questions include: How was the transaction initiated? What authentication was used? Was the customer’s device compromised? Was an OTP used? Was the customer’s PIN used? Did the customer disclose any security credentials? Did the bank detect unusual activity? Did the bank comply with applicable security requirements? When did the customer notify the bank? What action did the bank take after receiving the complaint? Can the recipient of the funds be identified? These questions can determine whether a claim against the bank is likely to succeed. Will a Bank Refund an Unauthorised Transaction? Not automatically. Whether a bank is required to refund an unauthorised transaction depends on the circumstances in which the transaction occurred and whether the bank breached a legal, contractual or applicable regulatory obligation. A bank is entitled to investigate a disputed transaction before deciding whether to reverse or refund it. However, the bank should not treat the fact that a transaction was successfully authenticated as automatically ending the customer’s claim. The relevant questions include: How was the transaction initiated? Was the customer’s PIN, OTP, password or other authentication credential used? Did the customer disclose any security credentials? Was the customer’s device or account compromised? Did the transaction display unusual or suspicious characteristics? Did the bank’s systems detect or respond appropriately to the transaction? How quickly did the customer report the transaction? What steps did the bank take after receiving the complaint? Therefore, the answer to “will a bank refund an unauthorised transaction?” depends on the evidence. Where the evidence establishes that the bank was responsible for the loss or breached a duty owed to the customer, the customer can pursue appropriate reliefs, including recovery of the money and, where justified, damages or other consequential relief. On the other hand, where the evidence establishes that the customer’s own conduct caused or materially contributed to the loss, the bank may rely on that conduct in defending the claim. The correct approach is therefore to establish how the transaction occurred and who bears legal responsibility, rather than assuming that either the bank or the customer is automatically liable. What If the Bank Says the Transaction Was Authenticated? This is one of the most common responses from banks. The bank may say that: Your PIN was correctly entered. Your OTP was successfully used. Your mobile banking application was used. The transaction came from your registered device. The transaction passed the bank’s authentication system. That evidence is relevant, but it does not necessarily end the dispute. Authentication establishes that the bank’s system received the required credentials. It does not, by itself, answer every question concerning who actually initiated the transaction or whether the transaction resulted from fraud, compromise or another circumstance for which the bank may bear responsibility. The particular facts must therefore be examined. What If You Gave the Fraudster Your OTP? This can significantly affect the case. Suppose a fraudster impersonated your bank and persuaded you to disclose an OTP. The fraudster then used the OTP to transfer money from your account. The bank may argue that you authorised the transaction or were negligent in disclosing the OTP. Whether that argument succeeds depends on the circumstances. The customer’s conduct is important, but so are the bank’s security, fraud-detection and customer-protection obligations. A customer should therefore provide the complete facts when reporting the incident rather than withholding information that may later become relevant. What If You Did Not Give Anyone Your PIN or OTP? That can strengthen the customer’s position, particularly where the evidence indicates that the transaction occurred despite the customer’s security credentials not being disclosed. The bank may still investigate how the transaction was completed. However, where there is evidence of a compromised account, security failure, unusual transaction activity or other
What to Do When a Bank Refuses to Reverse an Unauthorised Transaction in Nigeria
You check your bank account and discover that ₦500,000 has been transferred without your authorisation. You immediately contact your bank, report the transaction and ask for your money to be returned. Then the bank tells you: “The transaction was successful.” Or: “You authorised the transaction.” Or simply: “Our investigation shows that the transaction was valid.” What should you do next? A bank’s refusal to reverse an unauthorised transaction does not necessarily mean that you have no further remedy. Nigerian bank customers have access to internal complaint mechanisms, regulatory escalation and, where appropriate, legal remedies. The important thing is to act systematically and preserve your evidence. First, Understand Why the Bank Refused the Reversal Before deciding what to do next, obtain the bank’s position in writing. The bank may argue that: The transaction was properly authenticated. Your PIN, password, OTP or other credentials were used. You disclosed your banking credentials. The transaction originated from your registered device. The transaction was authorised by you. The bank’s investigation did not establish a system failure. The recipient has already withdrawn or transferred the funds. Do not rely solely on a verbal explanation from a customer-service representative. Ask the bank to provide its response formally and retain it. Does the Bank Have a Right to Reject Your Complaint? A bank is entitled to investigate a disputed transaction and determine whether it is liable. However, a customer also has a right to have a complaint properly considered. The Central Bank of Nigeria states that bank customers have a right to a complaints-management system through which they can seek redress. Customers also have a right to be kept informed about the resolution process and the basis of the bank’s decision. Where a customer is dissatisfied, the CBN states that the customer has a right of review by the bank, the CBN or the courts. Therefore, a bank’s rejection of your complaint is not necessarily the end of the matter. What Should You Do After the Bank Rejects Your Complaint? If the bank has refused to reverse the transaction, take the following steps. 1. Request the Bank’s Final Position in Writing Ask the bank to provide a written explanation of why it rejected your complaint. Your request should identify: The disputed transaction. The date and amount. The transaction reference. Your complaint reference number. The reason given for rejecting your complaint. The action you want the bank to take. Keep a copy of the correspondence. 2. Ask for the Complaint Tracking Number Make sure you have the bank’s complaint or tracking reference. The CBN’s current complaints process requires customers to first lodge their complaint with the financial institution and obtain a complaint reference/tracking number. This number becomes important if you later escalate the complaint. 3. Preserve All Evidence Keep all documents and communications relating to the transaction. These can include: Bank statements. Transaction alerts. SMS messages. Emails. Screenshots. Transaction references. The recipient’s account details. Your complaint to the bank. The bank’s response. Communications with the suspected fraudster. Police or other law-enforcement reports. Do not delete or alter potentially relevant electronic evidence. Can You Escalate the Complaint to the CBN? Yes. If the bank fails to resolve the complaint within the applicable period, you can escalate the matter to the Consumer Protection Department of the Central Bank of Nigeria. The CBN’s official guidance states that customers should first complain to their financial institution. Where the complaint remains unresolved within the applicable timeline, the customer can escalate it to the CBN. The CBN’s current complaints portal also requires the customer to first lodge the complaint with the financial institution and obtain a tracking number before using the escalation process. How Long Should You Wait Before Escalating to the CBN? This is an area where you should be careful about relying on outdated information. Older CBN guidance refers to a two-week period for unresolved complaints, while more recent CBN materials refer to the timelines stipulated under the applicable Consumer Protection Regulations. The safest approach is to lodge the complaint formally with the bank, obtain the tracking number and follow the current CBN escalation process applicable to your complaint. Do not simply send a complaint to the CBN without first complaining to your bank. What Should You Include in a CBN Complaint? Your complaint should clearly explain: Your name and contact details. The name of the bank. The disputed transaction. The date and amount involved. Your account details, without disclosing your PIN or password. What happened. When you discovered the transaction. The complaint you made to the bank. The bank’s response. The resolution you are requesting. Supporting documents. The CBN specifically advises complainants not to include sensitive credentials such as PINs and passwords in their complaint. Can the CBN Order the Bank to Refund Your Money? The CBN has a consumer-protection and complaints-resolution role in relation to financial institutions under its regulatory purview. Its Consumer Protection Framework requires financial institutions to have customer compensation policies addressing categories including unauthorised or erroneous debits and financial loss resulting from staff negligence or fraudulent activities. However, a CBN complaint should not be treated as an automatic guarantee that the customer will receive a refund. The regulator will consider the complaint, the bank’s response and the available evidence. Where the dispute involves issues that require judicial determination, court proceedings may become necessary. What If the Bank Says You Authorised the Transaction? This is one of the most important situations to address. The bank may argue that the transaction was authorised because: An OTP was entered. The customer’s PIN was used. The transaction came from the customer’s device. The customer’s password was used. The transaction passed the bank’s authentication process. But the existence of authentication does not necessarily answer every question concerning liability. The circumstances in which the credentials were obtained and used, the security systems involved, the customer’s conduct and the bank’s own obligations can all be relevant. For example, a customer may have been deceived through phishing, social engineering or another form of fraud. The
What to Do If Money Is Stolen From Your Bank Account in Nigeria
Imagine checking your bank account and discovering that ₦500,000, ₦1 million or even your entire savings has been transferred to an account you do not recognise. For many Nigerians, the first reaction is panic. The next question is usually: “How do I get my money back?” If money has been removed from your bank account without your authorisation, you should act immediately. The steps you take in the first few hours can be important in protecting your account, creating evidence and pursuing recovery. This article explains what to do if money is stolen from your bank account in Nigeria, including the steps to take against the bank, the importance of reporting the transaction and the legal remedies available when the money is not recovered. What Counts as an Unauthorised Bank Transaction? An unauthorised transaction is a transaction carried out on your bank account without your approval or authority. It can occur through different methods, including: Unauthorised bank transfers. ATM withdrawals you did not make. Unauthorised debit-card transactions. Mobile banking fraud. Internet banking fraud. SIM-related fraud. Phishing scams. Compromised banking credentials. Fraudulent transfers carried out after your phone or account has been compromised. The circumstances surrounding the transaction are important because they determine the appropriate response and the evidence required. What Should You Do Immediately? If you discover an unauthorised transaction, do not wait to see whether the money will somehow return. Take immediate action. 1. Contact Your Bank Immediately Notify your bank as soon as you discover the transaction. Use the bank’s official customer-service channels and clearly state that the transaction was unauthorised. Ask the bank to: Block or restrict further unauthorised transactions. Secure the affected account. Flag the disputed transaction. Investigate the transaction. Take appropriate steps to trace or place restrictions on the recipient account where possible. Obtain a complaint or reference number and keep it. 2. Change Your Banking Credentials If you suspect that your PIN, password, token, card details or mobile-banking credentials have been compromised, change them immediately. Where necessary, request that your card, online banking profile or other compromised access credentials be blocked or replaced. Do not continue using credentials that you believe have been compromised. 3. Preserve Evidence Do not delete messages or other information connected with the transaction. Keep: Bank transaction alerts. Account statements. SMS messages. Emails. Screenshots. WhatsApp conversations. Phone numbers used by the fraudster. Account numbers to which the money was transferred. Transaction references. Dates and times of the transactions. Any links or messages sent by the fraudster. This evidence can become important during the bank’s investigation or subsequent legal proceedings. Should You Report the Fraud to the Police? Yes, where the transaction involves suspected fraud, you should make an appropriate report to the relevant law-enforcement authority. Depending on the circumstances, this can include reporting to the Nigeria Police Force and its relevant cybercrime units or other appropriate agencies. The report creates an official record of the complaint and can assist in the investigation and tracing of the funds. A police report does not, by itself, guarantee recovery of the money. Recovery requires appropriate action based on the circumstances of the transaction. Can the Bank Reverse the Transaction? The answer depends on the circumstances surrounding the transaction. Where a customer genuinely did not authorise a transaction, the bank has obligations under the applicable regulatory and legal framework concerning unauthorised electronic transactions and fraud. However, banks will investigate the circumstances before determining liability. The bank will consider issues such as: How the transaction was initiated. Whether the customer’s credentials were used. Whether the transaction was authenticated. Whether the customer disclosed their PIN, password or OTP. Whether there was negligence or compromise of the customer’s credentials. The bank’s own security systems and procedures. The circumstances in which the transaction occurred. A customer should therefore make a formal complaint and provide the relevant evidence rather than simply assuming that the bank will automatically reverse every disputed transaction. What If You Received an OTP but Did Not Authorise the Transaction? Receiving an OTP does not automatically establish that you authorised a transaction. The circumstances surrounding the OTP and how the transaction was initiated must be investigated. For example, fraudsters may obtain access to a customer’s device, SIM card or other credentials through social engineering, phishing or other fraudulent methods. The bank should therefore investigate the complete circumstances rather than treating the existence of an OTP as the end of the matter. What If You Were Tricked Into Giving the Fraudster Your OTP? This can make the situation more complicated. If a customer voluntarily discloses an OTP or other security credential to a fraudster, the bank will consider that fact when determining liability. However, the customer’s disclosure does not necessarily answer every legal question surrounding the transaction. The circumstances in which the information was obtained, the bank’s security measures and the nature of the fraud must all be considered. You should therefore report the transaction immediately even if you inadvertently disclosed information to the fraudster. What If the Money Was Transferred to Another Nigerian Bank? This is one of the most important situations in which speed matters. If the money was transferred to an account in another Nigerian bank, notify your bank immediately and provide the recipient’s account details and transaction reference. The banks involved can take appropriate steps within the applicable banking and regulatory framework to investigate the transaction and, where possible, restrict further movement of the funds. The longer the fraudster has access to the money, the greater the risk that the funds will be transferred through additional accounts or withdrawn. What If the Fraudster Has Already Withdrawn the Money? Recovery becomes more difficult once the funds have been withdrawn or transferred elsewhere, but that does not mean that you should abandon the matter. You should: Report the transaction to your bank. Make a formal complaint. Report the matter to the appropriate law-enforcement authority. Preserve all evidence. Identify the recipient account and transaction trail. Obtain legal advice where necessary. Consider appropriate legal proceedings for