Computer fraud and unauthorized transactions: the intermediary is not safe if technical proof is missing

A recent decision by the Banking and Financial Arbitrator – Bari Panel (no. 1599570/2022) confirms a fundamental principle in digital payments: the burden of proof of the regularity of the transaction always lies with the intermediary.

In the case in question, the applicant had disputed five unauthorized transactions, for a total amount of 8,393.50 euros, carried out via mobile application. The intermediary (Poste Italiane) had claimed “correct authentication” through a two-factor system, but did not provide complete IT logs, limiting itself to partial screenshots without indications of the authentication factors.

The Panel recalled that:

"Proof of the formal regularity of the transaction is not sufficient to demonstrate the absence of fraud, willful misconduct (dolo) or gross negligence (colpa grave) on the part of the user" (cf. ABF Coordination Panel, no. 22745/2019).

Based on articles 10 and 12 of Legislative Decree 11/2010, and the most recent ABF jurisprudence, liability falls on the intermediary, unless there is rigorous and complete contrary proof. In the absence of adequate technical documentation (e.g., complete logs, traceability of authentication factors), the intermediary is required to reimburse.

The appeal was upheld with an order for full reimbursement and costs to be borne by the intermediary.

OPERATIONAL CONSIDERATIONS

This decision once again highlights the importance for banks and fintech operators to:

• equip themselves with advanced anti-fraud systems;
• store IT logs in a structured and verifiable manner;
• train customers on the risks associated with phishing, spoofing, and vishing;
• intervene promptly in the event of complaints for anomalous transactions.

At the same time, it represents a warning for consumers: disputes must be timely and detailed, even in the absence of immediate technical evidence.

To assess the compliance of your IT security systems with legal requirements and the most recent ABF practices, contact us.