The client does not pay for a card breach if the bank has not proved his fault

This position of the Civil Cassation Court of the Supreme Court, set out in its ruling of 15 September 2025, has become a cornerstone for disputes between banks and clients over unlawful debiting of funds. The Court stressed that a client is released from liability if he promptly informs the bank about the transactions and the financial institution fails to provide indisputable evidence of his fault or involvement in the breach.

Legal grounds for protecting the client

Under paragraph 9 of Section VI of Regulation No. 705 on cash operations in the national currency (in force at the time of the case), a user is not liable for payment transactions if the electronic payment instrument has been blocked or if the bank has not proved the user’s gross negligence. The Supreme Court extended this principle, holding that the mere fact of entering a PIN code or other credentials does not prove the client’s fault; the bank must establish a causal link between the client’s actions and the card breach.

In the case No. [number not available in open sources], the Civil Cassation Court clearly formulated the rule that the burden of proof lies with the bank, and only indisputable evidence (logins, IP addresses, geolocation, behavioural patterns of the client) can shift liability onto the victim of fraud. The very fact that 69,342 UAH were debited in May 2022 did not justify charging the client, because the bank failed to prove his involvement in the fraud.

Analysis of the Supreme Court’s position: burden of proof on the bank

The Court emphasized that banks often try to shift responsibility to clients by referring to “correct data entry”. The judges found this insufficient: correct execution of a transaction shows only that someone had technical access to the card, not that the owner consented or acted negligently. The appellate court in this case wrongly accepted new evidence from the bank that had not been presented at first instance, which the Supreme Court viewed as a breach of the principles of good faith and full disclosure of evidence (discovery) under the Civil Procedure Code.

This approach is consistent with EU Directive PSD2, which places primary responsibility for system security and the burden of proving customer fault on payment institutions. In Ukraine, this means that the bank as the card issuer must protect payment information and compensate losses unless and until it proves the opposite.

Practical implications for clients and banks

For clients, the Supreme Court’s position is a powerful shield. If you discover unauthorised debits:

• immediately block the card via the app or the bank’s hotline;
• notify the bank in writing (email or registered mail), demanding an investigation and a refund;
• file a police report for fraud to document your good faith;
• if the bank refuses, bring a claim in court and rely on the Supreme Court ruling.

Banks, in turn, must enhance security by implementing two‑factor authentication, monitoring suspicious transactions, and promptly blocking and investigating them. Practice shows that banks often lose such cases due to the lack of proof of customer fault, which pushes the industry towards better data protection.

In 2024–2025, such disputes increased amid a surge of phishing and scam schemes, with clients losing from a few thousand to hundreds of thousands of hryvnias. The Supreme Court drew a clear line: a bank cannot automatically debit funds from a “suspicious” account without proper proof.

Case‑law: key Supreme Court decisions

In its ruling of 15 September 2025, the Civil Cassation Court allowed the client’s claim and rejected the bank’s demand to recover 69,000 UAH debited by fraudsters. The first‑instance court had sided with the client, the appeal reversed that decision, but the cassation restored it, emphasizing the burden of proof on the bank.

Similar conclusions were reached in rulings No. 235/2054/21 and No. 161/6855/19: a client is not liable if the card was blocked or the bank failed to prove gross negligence. This practice applies to all banks, where typical fraud schemes involve phishing, malware and social engineering. The Supreme Court also barred banks from submitting new evidence on appeal if they had not presented it in the first instance, preventing procedural manipulation and protecting clients.

Risk‑mitigation recommendations

To minimise your risk:

• enable push notifications and two‑factor authentication on all cards;
• never enter card details on suspicious websites or share them over the phone;
• regularly check statements and set transaction limits;
• if a breach occurs, block the card immediately and record all communications with the bank.

Banks should invest in AI‑based monitoring, educate customers and prepare a strong evidentiary base for disputes; otherwise they risk losing in court. The Supreme Court’s stance shifts the balance in favour of clients, making banks accountable for payment system security. Further harmonisation of case‑law and potential NBU regulatory changes aimed at stronger consumer protection are expected.

If you have questions or problems related to challenging unauthorised transactions, recovering funds from a bank, or protecting your rights as a financial services consumer, you should seek qualified legal assistance — timely advice will help you assess the evidence, identify procedural errors and effectively defend your rights.

Author: Ihor Yasko, Managing Partner at Winner Law Firm, PhD in Law.