Unauthorised transactions from a card or account are usually discovered in the most unpleasant way: a notification on your phone at two in the morning, a payment at an unfamiliar online shop or a transfer to an account you have never seen. At such a moment panic is understandable, but it is precisely the first few hours that determine how easily you will get your money back. The law is on the consumer's side, but only if they act quickly and leave a written trail.
In this article we explain what to do in the first 24 hours after you discover an unauthorised payment transaction, what the bank's obligations are under the Payment Services and Payment Systems Act (ЗПУПС), up to what amount you may be liable and when you are not liable at all. Separately, we look at phishing and vishing scams, in which the customer has entered a code or confirmed a transfer themselves.
What is an "unauthorised" transaction in law?
Under Art. 70 of the Payment Services and Payment Systems Act, a payment transaction is authorised if the payer ordered it or consented to its execution. Without consent, the transaction is unauthorised. Typical examples are:
- payments with a stolen or lost card;
- online payments using copied card details (number, expiry date, CVC code);
- transfers from online banking ordered by a third party who gained access to your profile;
- cash withdrawals from an ATM with a cloned card.
The situation is different where you yourself ordered the transfer, albeit under the influence of a fraudster (for example an "investment" or "saving your money" on the instructions of a fake bank employee). In that case, formally, you gave your consent and the protection is more limited – we look at this distinction below.
Unauthorised transactions: what to do in the first 24 hours
The "24 hours" is not a statutory deadline but a practical one: the law requires notification without delay, and every hour lost gives the fraudsters time to move the money.
- Block the card immediately. Use the mobile app or the bank's 24-hour phone line. The card issuer must make it possible to notify it at any time (Art. 76(1)(4) of the Payment Services and Payment Systems Act). If online banking is affected, ask for access to be blocked as well and change your passwords.
- Notify the bank in writing. A phone call stops the card, but it does not replace written notification. Send an email or file an application at a branch, stating expressly which transactions you dispute (date, amount, payee) and that you did not authorise them. Ask for a reference number.
- Report it to the police. The report is filed at the nearest police station or online with the Chief Directorate for Combating Organised Crime (ГДБОП), which has a specialised cybercrime unit. You will need the case number for the bank and for any court case.
- Keep the evidence. Take screenshots of text messages, notifications, emails, call history, messages from the fraudster and links you clicked. Do not delete anything, even if it is embarrassing.
- Ask for proof of notification. On request, the bank must provide you, for up to 18 months, with proof that you notified it (Art. 76(1)(5) of the Payment Services and Payment Systems Act).
The same steps apply where unauthorised transactions are made on the account of a deceased loved one: the heirs notify the bank of the death and ask for the cards to be blocked and for a statement of the account movements. We describe how heirs establish what accounts and claims the deceased had in our article on tracing an estate: accounts, property and company shares.
From our practice: The most common mistake is for the customer to settle for a phone call and a "we'll look into it". Months later the bank claims the notification was late, and the customer has no way of proving otherwise. Written notification on the first day is the cheapest insurance against such a dispute.
When must the bank give you your money back?
The basic rule is in Art. 79(1) of the Payment Services and Payment Systems Act: in the case of an unauthorised payment transaction, the payer's payment service provider refunds its amount immediately, and in any event no later than the end of the following business day after noting the transaction or being notified of it. The account must be restored to the state it would have been in had the unauthorised transaction not taken place, with a value date no later than the date the account was debited.
The law allows one exception: the bank may refrain from refunding the amount within that period if it has reasonable grounds for suspecting fraud and notifies the competent authorities. If the bank relies on this, ask it in writing to state what the suspicion is and to which authority the report was made.
How long do you have to notify the bank?
Under Art. 77(1) of the Payment Services and Payment Systems Act, the bank corrects an unauthorised transaction only if you notified it without undue delay after becoming aware of it, but no later than 13 months from the debit date. You are deemed to have become aware at the latest when you received the information about the transaction (statement, notification). The thirteen months are an outer limit, not a recommendation.
Up to what amount are you liable?
The Payment Services and Payment Systems Act allocates the risk between the bank and the customer depending on the circumstances. The table summarises it:
| Situation | Who bears the loss | Legal basis |
|---|---|---|
| Lost, stolen or misappropriated card (until notification) | The customer – up to the agreed amount, but no more than EUR 50 | Art. 80(1) of the Payment Services and Payment Systems Act |
| The loss or theft could not have been detected by the customer before the payment | The bank (unless the customer acted fraudulently) | Art. 80(2)(1) |
| The damage was caused by an employee or subcontractor of the bank | The bank | Art. 80(2)(2) |
| Transactions after the bank was notified | The bank (unless the customer acted fraudulently) | Art. 80(5) |
| The bank did not require strong customer authentication | The bank (unless the customer acted fraudulently) | Art. 80(4) |
| The customer acted fraudulently or, intentionally or with gross negligence, failed to safeguard the card and codes | The customer – in full, without limit | Art. 80(3) |
The EUR 50 limit has applied since 1 January 2026 (amendment in State Gazette No. 64 of 2025). Before that, the amount was set in leva. In an ordinary card theft, with no negligence on your part, your risk is up to EUR 50, and after you notify the bank it is zero.
The burden of proof is on the bank
This is perhaps the most important protection for the consumer. When you state that you did not authorise a transaction, the bank bears the burden of proving that the transaction was authenticated, accurately recorded and entered in the accounts, and that it was not affected by a technical breakdown (Art. 78(1) of the Payment Services and Payment Systems Act).
Even more significant is the rule in Art. 78(4): the recorded use of the card or the codes alone is not sufficient evidence that you authorised the transaction or that you acted with gross negligence. The bank must provide evidence of fraud or gross negligence on your part.
What does the absence of strong customer authentication (SCA) mean?
Strong customer authentication (SCA) under Art. 100 of the Payment Services and Payment Systems Act requires at least two independent elements from three categories: something only you know (PIN, password), something only you possess (phone, card) and something you are (fingerprint, facial recognition). For online payments, these elements must link the transaction to a specific amount and payee.
If the bank did not require such authentication, the payer bears no losses unless they themselves acted fraudulently (Art. 80(4)). If the payment went through using only the card details, without additional confirmation, your position improves considerably.
Phishing and vishing: when you "confirmed" it yourself
The most common disputes today concern scams using fake websites, text messages and calls from a "bank employee" or "the police". There are two different scenarios here.
The fraudster ordered the transaction using your details
You entered your card details or the code from a text message on a fake website, and the payment was made by the fraudster. The transaction was not ordered by you, so as a rule it is unauthorised. The bank usually objects that you acted with gross negligence, but the law requires the bank to prove it. Whether disclosing a code is gross or ordinary negligence depends on the facts: how convincing the scam was, what the text message containing the code said, and whether the bank had warned about similar schemes. There is no automatic answer.
You ordered the transfer yourself
If, on a fraudster's instructions, you logged into online banking yourself and ordered a transfer to a "safe account" or an "investment platform", the transaction was formally authorised by you. The immediate refund mechanism under Art. 79 does not, in principle, apply. This does not necessarily mean the money is lost, but the route is different:
- immediately ask your bank to contact the payee's bank to try to recover the funds (the sooner you do, the greater the chance the money is still there);
- report it to the police with all the details of the payee's account;
- check whether the bank has fulfilled its security and information obligations; for euro transfers, Regulation (EU) 2024/886 requires the bank to verify whether the payee's name matches the IBAN and to warn you if there is a discrepancy. The Regulation is directly applicable and applies in Bulgaria without a separate law. If the bank did not carry out this check, it may be relevant to its liability;
- bring a claim against the recipient of the money.
The recipient is often a so-called "money mule" – a person who made their account available in return for payment. A claim can be brought against them for the return of what they received without legal grounds (unjust enrichment, Art. 55 of the Obligations and Contracts Act). We describe how such proceedings run, up to enforcement through a private enforcement agent (ЧСИ), in our article on collecting unpaid claims.
The bank refuses: what next?
A standard refusal citing a "successfully confirmed transaction" is not final.
- Written complaint to the bank. Every bank has an internal complaints procedure. It must give a written decision within 15 business days of receiving the complaint; exceptionally, for reasons beyond its control and with express notice of the delay, the period may be extended, but to no more than 35 business days (Art. 174(3) and (4) of the Payment Services and Payment Systems Act). In the complaint, refer expressly to Art. 78 and Art. 80 of the Payment Services and Payment Systems Act and ask for the evidence on which the bank bases its refusal.
- Conciliation Committee for Payment Disputes. If the bank does not reply in time or its reply does not satisfy you, you can refer the matter to the Conciliation Committee for Payment Disputes (Помирителна комисия за платежни спорове) at the Consumer Protection Commission (КЗП) (Art. 174(5) and Art. 175 of the Payment Services and Payment Systems Act). The procedure is free of charge for the parties (Art. 180), and the application can also be filed online through the Consumer Protection Commission's website. The committee's proposal binds the parties only if both accept it.
- Report to the Bulgarian National Bank. The Bulgarian National Bank (БНБ) supervises banks and payment institutions. A report may lead to an inspection and measures against the bank, but the BNB does not decide the individual dispute or award sums.
- Claim in court. Only a court can make a final order for the money to be returned. In a claim against the bank, the burden of proof under Art. 78 of the Payment Services and Payment Systems Act again works in the consumer's favour, and statutory interest can be claimed in addition to the principal.
How to prepare a strong claim
A good claim is built in the very first days. Set out a timeline with exact times: when you received the message, when you learned of the transaction, when you notified the bank. Attach the statement, the police report and the correspondence with the bank. Ask the bank in writing for information on which authentication elements were used to confirm each transaction, and from which device and IP address.
Check your insurance policies too: some insurers offer cover for card misuse as an additional risk, and in a burglary compensation may also be sought for what was stolen. More on this in our article on home insurance for flood, fire and theft.
If the amount is significant or the bank persistently refuses, advice from a banking law lawyer can change the outcome. We explain how to judge whether a lawyer is right for a particular dispute in our article on how to choose a good lawyer and what to ask them.
Frequently Asked Questions (FAQ)
How long does the bank have to return stolen money?
Under Art. 79 of the Payment Services and Payment Systems Act, the bank must refund the amount of an unauthorised transaction immediately and no later than the end of the following business day after being notified. The only exception is where there is a reasonable suspicion of fraud by the customer, of which the bank must notify the competent authorities.
Up to what amount am I liable if my card is stolen?
If you did not act fraudulently or with gross negligence, your liability for transactions before you notified the bank is limited to the agreed amount, but no more than EUR 50 (Art. 80(1) of the Payment Services and Payment Systems Act, in force since 1 January 2026). You are not liable at all for transactions after notification.
The bank says the transaction was confirmed with my code. Do I lose the dispute?
Not necessarily. Under Art. 78(4) of the Payment Services and Payment Systems Act, the recorded use of the card or the codes does not in itself prove that you authorised the transaction or acted with gross negligence. The bank must provide evidence of that.
What is the final deadline for disputing a transaction?
The statutory deadline is 13 months from the date the account was debited (Art. 77 of the Payment Services and Payment Systems Act). The law, however, requires notification without undue delay after you become aware of the transaction, so it is best to notify the bank on the very day you discover it.
Can I get my money back if I made a transfer to a fraudster myself?
The transaction is formally authorised, and the immediate refund rule does not apply. What remains is an attempt at recovery through the payee's bank, a report to the police and a claim against the recipient for what they received without legal grounds. We describe how such a claim is collected in our article on collecting unpaid claims, from payment demand to enforcement agent.
Should I report it to the police if the bank is going to refund me?
Yes. The report documents the fraud, allows the perpetrators to be traced and is often required by the bank itself. The case number is also useful before the Conciliation Committee or the court.
How long does the bank have to respond to my complaint?
The bank must give a written decision within 15 business days of receiving the complaint. Exceptionally, if the delay is due to reasons beyond its control and it notifies you of this, the period may be up to 35 business days (Art. 174 of the Payment Services and Payment Systems Act).
What does the Conciliation Committee for Payment Disputes do?
It is an out-of-court dispute resolution body at the Consumer Protection Commission. The procedure is free, and the committee's proposal has the force of a settlement only if both parties accept it. If the bank does not accept it, the court route remains.
Does home insurance cover bank card misuse?
Standard property insurance usually does not cover card misuse. Some insurers offer such cover as an additional risk, so check the general terms of your policy. For more on cover and refusals, see our article on home insurance and claim refusals.
What should I do if there are unauthorised transactions on the account of a deceased loved one?
The heirs notify the bank of the death with the certificate of heirs and ask for the cards to be blocked and for a statement of the account movements. We explain how a deceased person's accounts are identified in our article on tracing a deceased person's bank accounts and property.
When is it worth hiring a lawyer?
When the amount is significant, the bank relies on gross negligence, or the case involves a transfer you ordered under a fraudster's influence. See what to ask a lawyer at the first consultation.
How can we help you?
Mechkova & Dimitrova Law Firm assists clients in disputes with banks and payment institutions over unauthorised transactions: from drafting the written notification and the complaint to the bank, through proceedings before the Conciliation Committee for Payment Disputes, to a claim in court and claims against the recipients of the money.
Every case depends on its specific facts and we cannot promise an outcome in advance, but we can assess your chances and quickly take the right steps. Contact us for a consultation on your case as soon as possible after you discover the unauthorised transaction.
