Complaints Over Unauthorised Bank Transfers Doubled in 2025, but the Bank of Portugal Saw a Breach in Fewer Than One Case in Ten

Complaints to the Banco de Portugal (Bank of Portugal) from customers disputing transfers they say they never authorised more than doubled last year, from 583 in 2024 to 1,232 in 2025. Yet in only 9.2 percent of the 880 such cases it closed did the supervisor find a sign that the bank had broken the rules. The figures, in the Bank of Portugal's Relatório de Supervisão Comportamental 2025 (Behavioural Supervision Report), come as lawyers predict that an EU court ruling will shift the burden of fraud disputes from customers onto banks.

Público argued on Monday that banks have made the exception to refunding "the rule", and a judge told the paper that victims who go to their bank are usually told to file a police complaint "and then we'll see". The EU Court of Justice has ruled that a bank must refund an unauthorised payment first and argue about the customer's carelessness afterwards.

What the supervisor's numbers show

• Transfers: complaints about the authorisation of payments rose 111.3 percent. The report says they concern transfers allegedly ordered by fraudsters and the banks' responsibility to refund them. The share of closed cases with irregularities rose from 5.8 to 9.2 percent, mainly breaches of strong authentication rules and of liability for unauthorised payments.
• Cards: complaints on the same subject went from 1,184 to 1,245. Here the supervisor found irregularities in 27.9 percent of the 1,173 cases closed, down from 43.5 percent in 2024.
• Fraud overall: 2,577 complaints concerned payments linked to fraud, up 45 percent.

In the first half of 2025, fraudulent transfers averaged 2,564 euros each, a figure the Bank of Portugal called "substantially high", Lusa reported via RTP from its payment systems report. The supervisor said customers carry the loss when they started the payment themselves or when it resulted from misused security credentials or carelessly shared personal data; in other cases the loss falls mainly on the payment firms.

What the law says

Under Decreto-Lei n.º 91/2018, the payment services law, your bank must refund an unauthorised payment by the end of the first business day after learning of it (article 114). The only exception is when it has reasonable grounds to suspect fraud by you and reports them in writing to the judicial authorities within the same deadline. A recorded login is not enough on its own to prove you authorised the payment (article 113). Only gross negligence makes you liable beyond 50 euros (article 115).

Nuno Matos, president of the judges' union, the Associação Sindical dos Juízes Portugueses, told Público that banks may still claim every case is fraud or gross negligence, so "we will have to see in practice" how they respond.

What to do if money leaves your account

• Tell your bank at once through its official channels and block the card or app access. The legal limit is 13 months from the debit (article 112), but delay weakens your case.
• Ask in writing for the refund by the next business day, citing article 114 and the EU court's ruling, and keep proof of when you reported it.
• Report the crime to the police.
• If the bank refuses, complain through the electronic Livro de Reclamações (complaints book), which reaches the Bank of Portugal. A lawyer quoted by Público adds that alternative dispute resolution and, as a last resort, the courts remain open, and that a bank which holds back a refund without reporting suspected fraud normally owes late-payment interest.

Fraud losses were already a leading cause of complaints in DECO's analysis in October.