Disputing an unauthorised bank payment in Ireland: refund and FSPO
If money has left your bank or card account and you did not authorise the payment, Irish law puts the burden on the bank, not on you. The European Union (Payment Services) Regulations 2018 (S.I. 6/2018), which implement the second Payment Services Directive, require your bank or payment provider to refund an unauthorised transaction by the end of the next business day after you report it, unless it has reasonable grounds to suspect fraud on your part and reports those grounds to the authorities. Your own liability for a lost or stolen card or phone is capped at €50, and is nil where the bank did not use strong customer authentication or where you could not have noticed the loss before the payment.
The position is different where you authorised a payment yourself, for example a card purchase where the goods never arrived, a direct debit that was larger than expected, or a transfer you were tricked into making. Then the routes are a card chargeback, a direct debit refund within 8 weeks, or a complaint about how the bank handled the fraud.
This guide explains how to raise a dispute with your bank (whether PTSB, AIB, Bank of Ireland or a fintech provider), what deadlines apply, how to escalate a rejected complaint to the Financial Services and Pensions Ombudsman (FSPO) free of charge, and when a court claim makes sense.
Key facts
Deadline
Report an unauthorised or incorrectly executed payment without undue delay, and in any event no later than 13 months after the debit date (reg. 95 of S.I. 6/2018). A refund request for an authorised direct debit or other payee-initiated payment must be made within 8 weeks of the debit (reg. 101), and the provider must answer within 10 business days. The bank must reply to a payment services complaint within 15 business days (35 business days in exceptional cases). A complaint to the FSPO must be made within 6 years of the conduct complained of (s. 51(1) of the Financial Services and Pensions Ombudsman Act 2017), and the clock stops while the bank's internal complaints process runs. An appeal against an FSPO decision goes to the High Court within 35 days.
What to do
- Block the card or app and stop further losses. As soon as you notice an unfamiliar transaction, freeze the card in your banking app or ring the bank's 24-hour lost and stolen line, and change your online banking passcode. Under reg. 98(6) of the Payment Services Regulations you bear no loss for payments made after you have notified the bank of a lost, stolen or misappropriated payment instrument, unless you acted fraudulently. If a phone, wallet or laptop was stolen, report it to An Garda Síochána and note the PULSE incident number. If you suspect that someone has your login details or that you were the victim of a scam call or text, say so at once: speed matters both for your refund and for any chance of recalling the money from the receiving bank.
- Work out what kind of payment it is. Download the statement and, for each disputed item, note the date, amount, merchant or payee name, and whether it was a card payment, a credit transfer, a direct debit or an instant payment. Then sort the items into three groups. First, payments you did not authorise at all (cloned card, account takeover, unknown merchant): these fall under regs 95 to 98. Second, payments you authorised but which went wrong (goods not delivered, amount higher than agreed, duplicate charge, subscription you cancelled): these are chargeback or refund cases. Third, payments you made yourself to a fraudster after being deceived: these are authorised push payment cases, where the rules are less favourable and the arguments focus on how the bank handled warnings and recovery.
- Raise the dispute with the bank in writing. Use the dispute form in the app or online banking (PTSB, AIB, Bank of Ireland and most fintech providers have a "dispute a transaction" option), and follow it up with an email or letter to the bank's complaints unit. State clearly that you did not authorise the listed transactions, that you are notifying them under reg. 95 of S.I. 6/2018 and that you expect a refund under reg. 97 by the end of the next business day. Attach the statement extract, the Garda reference and any screenshots of texts or calls. Keep the reference number and the date and time you reported. Ask the bank to confirm in writing whether it treats the complaint as a payment services complaint, because that triggers the 15 business day reply deadline.
- Insist on the burden of proof. If the bank says the payment was authorised because your card or app credentials were used, remind it of reg. 96: where you deny authorising a transaction, the bank must prove that it was authenticated, accurately recorded and not affected by a technical breakdown. The use of your card or password is not, by itself, proof that you authorised the payment or that you acted with gross negligence. Ask for the authentication log: the device used, IP address, whether one-time passcodes were sent and to which number, and whether strong customer authentication was applied. Under reg. 98(4), if the bank did not require strong customer authentication, you bear no loss unless you acted fraudulently. Gross negligence is a high bar; carelessly clicking a convincing link is not automatically enough.
- For card purchases, ask for a chargeback. Where you authorised a card payment but the merchant did not deliver, charged the wrong amount or went out of business, ask your card provider to raise a chargeback under the Visa or Mastercard scheme rules. Chargeback is a scheme right rather than a statutory one, and card schemes usually require the dispute to be raised within about 120 days of the transaction or of the expected delivery date, so act quickly and check your provider's terms. Supply the order confirmation, delivery promise, your correspondence with the merchant and proof that you asked for a refund. For a direct debit that was larger than you could reasonably have expected, request a refund under regs 100 and 101 within 8 weeks; SEPA core direct debits are refundable on request within that period.
- If you were tricked into sending the money, press for recovery and review. Where you authorised a transfer to a fraudster, the bank is not obliged to refund under reg. 97, but under reg. 111(3) it must make reasonable efforts to recover the funds and the receiving bank must cooperate; on written request it must give you the information you need to pursue the recipient. Ask the bank to contact the receiving bank immediately. Since 9 October 2025 banks in the euro area must offer verification of payee on euro transfers; ask whether a name mismatch warning was shown. Your complaint can then focus on whether the bank acted reasonably: unusual payment patterns, ignored warnings, delays in freezing the account or in contacting the receiving bank.
- Escalate within the bank and get a final response. Under reg. 124(4) the bank must answer all points of a payment services complaint within 15 business days, or within 35 business days in exceptional circumstances with an explanation for the delay. The Central Bank's Consumer Protection Code, made under s. 48 of the Central Bank (Supervision and Enforcement) Act 2013, also requires regulated firms to acknowledge complaints promptly, update you regularly and give a final response letter that tells you about the FSPO. If the reply is a refusal, ask for the reasons in writing and for the evidence relied on. Do not sign any release or accept a goodwill payment described as full and final settlement unless you are content to end the dispute.
- Complain to the Financial Services and Pensions Ombudsman. If the bank refuses, does not answer within the time limit or offers too little, complain to the FSPO online at fspo.ie under s. 44 of the 2017 Act. The service is free and open to consumers, sole traders and businesses with annual turnover of €3 million or less. Include the final response letter, your timeline and all evidence. The FSPO normally expects you to have used the bank's internal process first (s. 54), but it can waive this where the bank is stalling. It will usually try mediation first (s. 58); if that fails, it investigates and issues a legally binding decision. Under s. 60 it can direct the bank to rectify the conduct and pay compensation of up to €250,000.
- Appeal, enforce or go to court. Either side can appeal an FSPO decision to the High Court within 35 days of notification (s. 64); if nobody appeals and the bank does not comply, you or the FSPO can apply to the Circuit Court for an enforcement order (s. 65). The FSPO will not investigate a matter that is already before a court, so choose your route. For larger or complex losses, or where the FSPO declines jurisdiction, a court claim against the bank for breach of contract or of the Payment Services Regulations remains open: the District Court deals with claims up to €15,000 and the Circuit Court up to €75,000. Take advice from a solicitor before issuing proceedings, because the costs risk is real.
What to watch out for
- Waiting too long. After 13 months from the debit date you lose the statutory right to rectification under reg. 95, unless the bank never gave you the transaction information it was required to give. Chargeback and direct debit refund windows are much shorter.
- Admitting gross negligence by accident. Statements such as "I gave them the code" or "I wrote my PIN on the card" may be used to shift the whole loss to you under reg. 98(3). Describe what happened accurately, but do not speculate about your own fault.
- Treating an authorised payment as unauthorised. If you approved the transfer yourself in the app, the next-day refund rule does not apply, and a dispute framed only on reg. 97 may be refused. Frame the complaint around recovery efforts, warnings and the bank's handling of the fraud.
- Accepting a goodwill gesture in full and final settlement. A small payment offered with that wording can end your right to complain to the FSPO about the same matter.
- Starting court proceedings first. Once a court is seised of the dispute, the FSPO cannot investigate it, and you take on the risk of paying the bank's legal costs if you lose.
- Ignoring follow-up scams. Fraudsters often call again posing as the bank's fraud team or the Gardaí and ask you to move money to a "safe account". Your bank will never ask for that; ring it back on the number on your card.
- Missing the FSPO time limit. The 6-year period under s. 51(1) is suspended only while the bank's internal process is running. Keep dates of every letter so that you can show when the clock stopped and restarted.
Legal basis
Frequently asked questions
How do I raise a dispute with PTSB about a card payment?
Log in to PTSB's app or open24 online banking, select the transaction and use the dispute option, or ring the card services line. If the payment was unauthorised, also freeze the card at once. Follow up in writing to the complaints unit, quote the transaction details and keep the reference number. The same approach works with AIB, Bank of Ireland and other providers.
How quickly must my bank refund an unauthorised transaction?
Under reg. 97 of S.I. 6/2018 the bank must refund immediately, and in any event by the end of the business day after it is notified, and restore the account as if the payment had not happened. The only exception is where it has reasonable grounds to suspect fraud by you and reports those grounds in writing to the relevant authority.
Do I have to pay anything towards the loss?
For payments made with a lost, stolen or misappropriated card or device, your share is capped at €50. You pay nothing where the loss could not have been detected before the payment, where the bank did not use strong customer authentication, or for payments made after you reported the loss. You bear the full loss only if you acted fraudulently or with intent or gross negligence.
What is the difference between a chargeback and a refund for an unauthorised payment?
A refund for an unauthorised payment is a statutory right under the Payment Services Regulations and does not depend on the merchant. A chargeback is a card scheme process used where you authorised the payment but the merchant failed to deliver, overcharged or charged twice. Chargeback deadlines are set by Visa and Mastercard rules and are usually around 120 days.
I was scammed into transferring money. Will the bank refund me?
Not automatically, because you authorised the transfer. The bank must make reasonable efforts to recover the funds and give you the information it holds. You can still complain if the bank ignored obvious warning signs, did not show a verification of payee warning, or was slow to act, and take that complaint to the FSPO.
How long does the bank have to answer my complaint?
For complaints about payment services, the bank must reply to all points within 15 business days of receiving the complaint, or within 35 business days in exceptional circumstances, explaining the delay. Its final response should tell you that you can refer the matter to the Financial Services and Pensions Ombudsman.
Does it cost anything to complain to the FSPO?
No. Complaining to the Financial Services and Pensions Ombudsman is free, and you do not need a solicitor. The FSPO first tries mediation; if that fails, it investigates and makes a decision that is legally binding on both sides, subject only to an appeal to the High Court.
How much can the FSPO award?
Under s. 60(5) of the 2017 Act the Ombudsman can direct compensation of up to €250,000 for complaints other than annuities, in addition to directing the bank to rectify the conduct complained of, for example by refunding the disputed payments. Interest can be added if the bank pays late.
Can a small business use the FSPO?
Yes, if it qualifies as a consumer under the 2017 Act: sole traders, partnerships and incorporated bodies with annual turnover of €3 million or less in the previous financial year, provided a company is not part of a larger group exceeding that limit. Charities and clubs below the threshold can also complain.
What if the bank says my card's chip and PIN were used?
That alone is not enough. Under reg. 96 the bank must prove the transaction was authenticated, recorded and not affected by a technical fault, and the use of the instrument does not by itself prove that you authorised it or were grossly negligent. Ask for the authentication data and challenge any assumption that you must have shared your PIN.
Legal guide – individual how-tos
Analyse my document →Legal guideContract templatesCountry home page