Fraud Law: Bill Proposes Changes to the Liability of Banks and Users

Currently, Law No. 20,009 imposes on users the duty to inform themselves and take the necessary measures to prevent misuse, fraud, or other risks associated with payment methods and their authentication mechanisms. However, for a breach of these duties to result in the user being held liable, current regulations require proof of willful misconduct or gross negligence.

The bill lowers that threshold. Users would now be held liable even for slight negligence in breaching their duty of care, and, accordingly, the reference to gross negligence is removed from the provisions governing the issuer’s right to oppose reimbursement.

In practice, the issuer would no longer have to prove intent or gross negligence on the part of the user to oppose restitution, but rather a failure to meet the standard of ordinary care characteristic of slight negligence. The change therefore broadens the circumstances in which the user’s conduct may influence the decision regarding who should bear the cost of a fraudulent transaction.

The bill establishes that the user will be presumed to be slightly at fault when the unauthorized transaction was carried out using strong authentication, regardless of the type of factors used. This presumption will apply for the purposes of proceedings before the local police judge.

Under current regulations, not all strong authentication automatically gives rise to a presumption. It depends on which factors were used:

• If strong authentication with biometrics—fingerprint, facial recognition, among others—was used, the law presumes intent or gross negligence; and
• If strong authentication without biometrics—for example, a password plus a code sent to a cell phone—was used, there is no such automatic presumption; it can only serve as a basis for the judge to establish a presumption.

The bill eliminates this distinction. If the transaction was conducted using any form of strong authentication, slight negligence would be presumed, regardless of whether biometrics were used.

This does not mean that the issuer can automatically reject the claim simply because strong authentication is in place. The presumption applies before the local police judge; therefore, the issuer must continue to file claims with that court to maintain the suspension of charge cancellations or refunds.

The bill also introduces significant changes regarding the allocation of liability among the various entities involved in the payment chain.

Currently, liability toward the user rests with the issuer. The bill maintains this rule but expressly recognizes that an issuer who has reversed charges, refunded funds, or compensated for damages has the right to seek recourse against the other entities that contributed, by action or omission, to the occurrence of the fraud or to the inability to prevent it.

In turn, the bill expands the scope of entities subject to the security obligations established in Law No. 20,009, expressly including sub-acquirers, payment processing service providers, certain payment industry support companies, payment card brand holders, entities that administer or operate payment or clearing systems, and participants in the Open Finance System.

This right of recourse adds a contractual dimension to the fraud regime: the allocation of obligations and liabilities among issuers and the other participants in the payment chain may become a determining factor in establishing who will ultimately bear the cost of the fraud. The bill itself makes an exception for actions taken in accordance with the contractual terms and conditions binding these entities.

The bill also provides for a series of modifications to the procedure applicable to unauthorized transactions:

• It extends the general deadline for canceling charges or refunding funds from 10 to 15 business days and, in the case of cash advances or ATM transactions, from 15 to 20 business days.
• It establishes a standard format for the affidavit, to be set by the Ministry of the Treasury, and prohibits issuers from requiring additional documentation at the time of application.
• It allows the complaint required by law to be filed electronically, recognizing the corresponding electronic receipt as sufficient proof.
• It eliminates the prohibition that currently prevents issuers from offering insurance to cover risks or claims they are required to assume under Law No. 20,009. The amendment thus reopens the possibility of offering coverage for this type of transaction, without altering the liabilities that the law continues to place on the issuer.