Notification, Blocking and Investigation — the First Steps
If funds have left the account without your consent, or a payment was executed incorrectly, timing plays the decisive role. The law requires the consumer to notify the provider — the bank or payment-service provider with which you have the relationship — without unjustified delay upon discovering an unauthorized or incorrectly executed operation. Fix the notification in a form that can later serve as proof: correspondence recorded in the application, an official chat, or a written statement at a branch.
The blocking mechanism works in parallel: the payment-service provider has the right to block a payment instrument on an objectively justified ground — including where there are grounds to suspect fraudulent or unauthorized use of the instrument — and in doing so it must notify the payer, indicating the reason, where possible before the blocking but no later than at the moment of blocking. You may request the blocking of your card or instrument through exactly this mechanism; and once the grounds for blocking are eliminated, the provider must unblock it or replace it with a new one without unjustified delay.
At the consumer’s request, the provider must take immediate measures to trace the operation and communicate the result to the consumer, and it performs these actions free of charge — except where a foreign payment or messaging system participates in the operation and the non-execution or incorrect execution was caused by the consumer; in that case the commission charged must be reasonable.
The allocation of the burden of proof also matters: where the consumer claims that a payment operation is unauthorized or incorrectly executed, the provider bears the burden of establishing that the operation was authenticated, correctly executed, recorded and posted to the accounts, and that no technical malfunction or other defect of the provider’s service affected it. A record of the use of the instrument is not in every case sufficient proof — particularly where the instrument did not physically participate in the operation. Contract terms that increase the consumer’s burden of proof or reduce the provider’s are void.
The Claim Window and the Reimbursement Deadline
The law fixes the window for the consumer’s claim: corrective measures may be demanded if no more than 13 months have passed since the account was debited with the amount of the unauthorized or incorrectly executed operation, and the consumer notified the provider without unjustified delay after discovering it. If the provider did not supply, in the agreed form, information about the operation or did not make it available, this deadline does not apply against you.
The reimbursement deadline is strict: the provider must reimburse the amount of the unauthorized operation to the payer immediately, but no later than the end of the next business day after the day it learned of the operation or received the notification; where a payment account exists, the debited account is restored to the state it would have been in had the operation not been executed. The value date of the credited amount must be no later than the debit date. In addition, the provider must reimburse the consumer the expenses for which it is responsible, as well as the foregone deposit interest the consumer suffered as a result.
If the window has nevertheless expired, this does not fully release the provider: it remains obliged, within its possibilities, to assist the consumer in recovering the amount.
Cross-Border Card Operations — a Special Rule
For unauthorized cross-border operations performed with a card instrument — where an instrument issued in Georgia is used and the payee’s provider is a foreign payment-service provider — the law adds protection: if the consumer notifies the provider of such an operation without unjustified delay but no later than 75 days from the debit, the provider must ensure reimbursement of the amount, provided third-party fraud is clearly established in connection with the unauthorized operation, or the reported case is materially or circumstantially similar to a case the provider examined within the last 180 days and in which the consumer was reimbursed.
When Liability Passes to the Client
The law also provides for limited liability: for damage caused by a stolen or lost payment instrument, or by its unlawful appropriation or use, the payer is liable up to a maximum of 100 GEL, except where discovery of the theft or loss by the consumer was impossible before the operation, or the loss was caused by an act or omission of the provider, its agent or an outsourcing company. The payer bears liability in full only where the damage results from their own fraudulent action or from an intentional or grossly negligent breach of obligations established by law — in that case the cap does not apply.
If the provider does not require strong authentication from the consumer, the payer bears no liability at all — except where the consumer personally committed fraud. Where the payee or the payee’s provider fails to ensure the receipt of strong authentication, it must reimburse the corresponding amount to the payer’s provider. And after the provider is notified of the theft or loss of the instrument, the payer is no longer liable for any damage caused by that instrument — unless the damage results from the payer’s own fraudulent action.
Our Service — From Claim to Reimbursement
Our team represents clients in unauthorized or incorrectly executed payment-operation cases: we establish the facts and the moment the notification was fixed — a detail that is often decisive; we prepare the structured claim to the provider in line with deadlines and formats; we monitor the statutory reimbursement deadline; and, where necessary, we pursue the complaint routes further — from the bank’s internal complaint procedure to dispute-resolution bodies.
Frequently Asked Questions
Below we answer the most frequently asked questions about unauthorized payment operations.
How quickly must the bank reimburse the amount?
Immediately, but no later than the end of the next business day after the day the provider learned of the unauthorized operation or received the notification. The account is restored to the state it would have been in without the operation.
After how long is the right to claim lost?
Corrective measures may be demanded if no more than 13 months have passed since the debit and the provider was notified without unjustified delay after discovery. Even after the deadline, the provider must still assist you within its possibilities in recovering the amount.
How much am I liable for funds lost through a stolen card?
Under the general rule — no more than 100 GEL. The cap does not apply where discovery of the theft or loss before the operation was impossible or the loss was caused by the provider; full liability arises only in cases of fraud, intent or gross negligence.
Who must prove that the operation was authorized?
The provider. It bears the burden of establishing that the operation was authenticated and correctly executed, while a record of the instrument’s use is not in every case sufficient proof.
What rule applies to cross-border card operations?
If you notify the provider no later than 75 days from the debit, reimbursement is due where third-party fraud is clearly established or the case resembles one examined and satisfied within the last 180 days.
How We Help You on Legal.ge
If an unauthorized amount has left your account or a payment was executed incorrectly — contact us as soon as possible. At the first consultation we will assess your case, fix the moment of notification, prepare the claim and monitor compliance with the statutory deadlines up to reimbursement on Legal.ge.