UOKiK orders four Polish banks to revisit rejected payment complaints

Poland’s Office of Competition and Consumer Protection (UOKiK) on 4 November 2026 ordered ING Bank Śląski, Bank Ochrony Środowiska, Nest Bank and Plus Bank to change how they handle complaints about unauthorised payment transactions. Under the four decisions linked by UOKiK, the banks must re-examine certain rejected complaints and refund consumers where justified.

The decisions matter because UOKiK says the banks treated successful authentication, such as entering a PIN or approving a payment in an app, as sufficient proof that the customer authorised the transaction. The regulator says that is not enough. A bank must establish that the customer personally and knowingly authorised the operation or acted with gross negligence.

What the decisions require

The decisions, numbered RWR-7/2026, RWR-8/2026, RGD-16/2026 and RKR-4/2026, require each bank to:

- amend internal procedures so correct authentication is not the sole basis for concluding that a customer authorised a transaction;
- re-examine negative complaint responses issued from 16 November 2022 for customers who still use the bank;
- return lost money in justified cases no later than 31 December 2027;
- notify former customers whose complaints submitted after 15 November 2022 were rejected about how to apply for a new review;
- publish information about the decisions on their websites and notify customers through mobile applications; and
- report to UOKiK by 30 April 2028 how they fulfilled the obligations.

The remedy is therefore not an automatic refund for every historic rejection. Current customers’ cases are to be reviewed by the banks themselves, while former customers must be given a route to request review. The banks must then decide whether the circumstances justify repayment.

UOKiK says the normal rule is that a bank must return the amount by the end of the next business day after an unauthorised transaction is reported, known as the D+1 rule. The exceptions identified by the regulator are documented grounds to suspect fraud by the customer and reports made more than 13 months after the transaction.

The authority says the four banks also wrongly told customers that recovering their money depended solely on action by law-enforcement authorities. Its position is that a bank cannot simply reject the complaint and transfer the entire burden of proving fault to the customer.

Authentication is not the end of the inquiry

UOKiK’s announcement says the banks must first refund the customer where the transaction was unauthorised, even if they believe the customer may have acted with gross negligence. The bank may then seek recovery through the courts, where it carries the burden of proving its case.

The regulator says this interpretation was confirmed by the Court of Justice of the European Union in October in case C-70/25, *Tukowiecka*. According to UOKiK, the judgment concerned unauthorised transactions such as those resulting from phishing and rejected the use of alleged gross negligence as an immediate basis for withholding repayment.

The only basis UOKiK identifies for withholding a refund at the outset is a justified suspicion that the customer is attempting to commit fraud, which the bank must promptly report to law enforcement. That is a narrower operational exception than treating a technically authenticated payment as authorised.

Atlas reads the decisions as a supervisory signal against authentication-led complaint triage. Banks will need procedures that distinguish evidence that a security credential was used from evidence that the account holder knowingly consented to the payment.

A second four-bank intervention

The action follows UOKiK’s 7 September decisions requiring Alior Bank, mBank, BNP Paribas and Bank Millennium to change similar unauthorised-payment practices. UOKiK’s latest announcement expressly places the four new decisions after that first group.

The sequence sits within a broader period of intervention against banks. On 12 October, UOKiK fined Bank Pocztowy, Erste Bank Polska, ING Bank Śląski and Plus Bank a combined PLN 147.09m over contract and fee clauses that allowed unilateral changes. That case involved consumer contract terms rather than payment fraud, but it shows the authority continuing to pursue bank practices that it considers structurally unfair or insufficiently transparent.

For the four banks named on 4 November, the immediate compliance task is to revise procedures, identify affected complaints and build a defensible review record. Justified refunds must be completed by 31 December 2027, and each bank’s report to UOKiK is due by 30 April 2028.