“Bank security service” persuaded me to transfer money: what to do under Georgian law

What to do

1. Immediately: contact the bank using the number on your card (block the card and contact the recipient's bank) and report to the police. Obtaining money by deception is fraud (CC Art. 180). Obtain a written certificate of the report (for the bank) (CPC Art. 101). Attachment of the recipient's account is ordered by the court upon the prosecution's motion: ask the prosecutor to act urgently (CPC Art. 151). If you are not granted victim status within 48 hours, file a complaint to the superior prosecutor (CPC Art. 56).
2. The key question is who made the transaction. If you pressed “transfer” yourself, you confirmed it (even under deception): the transaction is authorised (Law of Georgia on Payment Systems and Payment Services, Art. 22). A payment order accepted by the bank cannot be revoked (Law on Payment Systems and Payment Services, Art. 29).
3. If you dictated a code or gave remote access and the fraudster made the transactions: without the client's consent, the transaction is unauthorised (Law on Payment Systems and Payment Services, Art. 22); the bank must prove authentication (Law on Payment Systems and Payment Services, Art. 32); the bank refunds the amount by the end of the following business day (Law on Payment Systems and Payment Services, Art. 33); refusal is allowed only on a reasonable suspicion of the client's intent or gross negligence (Law on Payment Systems and Payment Services, Art. 33). Strong authentication must be linked to the amount and the recipient: check the text of the SMS (Law on Payment Systems and Payment Services, Art. 22¹).
4. Loan taken out on your own initiative at the fraudster's direction: a loan can be disputed on the ground of deception by a third party only if the bank knew or should have known of it (CivC Art. 83); the period is one year from when you learned of the deception (CivC Art. 84). If the fraudster took out the loan using your access, dispute the loan itself.
5. Complaint: a complaint to the bank must be decided within 15 business days (Law on Payment Systems and Payment Services, Art. 41¹); then the Dispute Resolution Commission of the National Bank of Georgia, no later than 6 months from the complaint to the bank (Law on Payment Systems and Payment Services, Art. 41¹).
6. Money from the recipient: a claim against the recipient (money mule) for the return of unjustly received funds (CivC Art. 976); limitation is 3 years from when you learned of the harm or of the offender (CivC Art. 1008). The recipient's details are obtained through the investigation.
7. Where to apply: your bank; police and prosecutor's office; Dispute Resolution Commission of the National Bank of Georgia; court.
8. Evidence: call log, correspondence, bank SMS with codes, statement and receipts, the installed app, a police certificate.
9. Traps: waiting for the bank's response instead of contacting the police, since money leaves the mule's account within hours; telling the bank “I confirmed it myself” when the fraudster made the transaction; “money recovery services” are a repeat fraud; stopping loan payments before the dispute is resolved.

Be sure to check

• immediately: the bank and a police report of fraud; ask the prosecutor to attach the recipient's account
• the fork: a transfer confirmed by the client himself is authorised and irrevocable; the fraudster's operations using a code or remote access are unauthorised, refunded by the bank, with the burden of proof on the bank
• the bank must prove authentication; strong authentication is linked to the amount and the recipient, so check the SMS text against the code
• a loan obtained through a third party's deception can be disputed only if the bank knew or should have known; the period is one year
• complaint to the bank (15 business days) → Dispute Resolution Commission of the NBG (6 months)
• a claim against the recipient of the money; victim status