Entered card details on a link — money was debited: what to do under Georgian law

What to do

1. Immediately: block the card — notify the bank without undue delay (Law of Georgia on Payment System and Payment Services, Art. 30); after notification the client is not liable for further debits (same law, Art. 33). Police: computer interference for financial gain is a crime (Criminal Code of Georgia, Art. 286¹); attach the certificate of the report to the complaint to the bank (Criminal Procedure Code of Georgia, Art. 101).
2. The operation was carried out by the fraudster; the client only entered the data. There was no consent to the operation itself, so it is unauthorised (Law on Payment System and Payment Services, Art. 22). If you yourself confirmed the transfer to the recipient, a different regime applies (an authorised transfer).
3. Claim to the bank: no later than 13 months from the debit (Law on Payment System and Payment Services, Art. 32); for a debit by a foreign seller — report within 75 days; the bank refunds in case of clear fraud by a third party (same law, Art. 32); the bank compensates no later than the end of the next business day (same law, Art. 33); the bank must prove authentication (same law, Art. 32); logs alone are not enough — the bank must present evidence of its suspicion (same law, Art. 32); the client’s liability is no more than 100 lari (same law, Art. 33).
4. The argument “you entered the code yourself”: the exception is a reasonable suspicion of fraud, intent or gross negligence on the client’s part (same law, Art. 33). Check: if the bank did not require strong authentication, the client is not liable (same law, Art. 33); the text of the SMS — did it contain the recipient and the amount?
5. Refusal: a complaint to the bank — decision no later than 15 business days (same law, Art. 41¹); then the Dispute Resolution Commission at the National Bank of Georgia — no later than 6 months from the complaint (same law, Art. 41¹); then court.
6. Where to apply: your bank; NBG Dispute Resolution Commission; police; court.
7. Evidence: SMS with the link, screenshots of the page, account statement (amount, recipient, country), time of blocking, police certificate.
8. Pitfalls: accepting that entering data on a fake website was consent; missing the 75-day deadline for a foreign seller; waiting for a criminal case instead of filing a complaint with the bank; “fund recovery services” — repeat fraud.

Be sure to check

• block the card immediately and notify the bank; file a police report
• an operation without consent is unauthorised; the bank refunds by the end of the next business day, and the burden of proof lies with the bank
• the client’s liability limit of 100 lari; the exception is intent or gross negligence, which the bank must prove
• deadlines: 13 months, and 75 days for foreign sellers; bank complaint within 15 business days → NBG Commission within 6 months