Banking Fraud

Contract clauses that attempt to shift all liability onto the customer are usually reviewed under the standard of care required of financial institutions, which must ensure robust authentication systems, transaction monitoring, and adequate security controls. Consequently, not every instance of unauthorized access can be attributed to the user; to be released from liability, the bank must show that its infrastructure operated within reasonable parameters and that the customer’s conduct amounts to gross negligence. Courts have consistently held that merely invoking general “duty of care” clauses is insufficient, requiring a specific assessment of the incident. For that reason, the bank’s automatic rejection of a claim does not mean you have lost the right to challenge it in court.

The first step is to dispute the transaction with the bank or issuer through a channel that leaves a record, the moment you detect it. Law No. 20,009 (Ley N° 20.009) governs liability for fraudulent transactions with means of payment and limits the holder’s liability when they have given timely notice; the issuer must refund the disputed amounts within the legal deadlines, unless it proves willful misconduct or gross negligence by the user. Keep the receipts, the complaint or ticket number, and all communications with the bank. If the bank refuses the refund without grounds, you can take the claim to the National Consumer Service (SERNAC) and the courts.

As a general rule, yes. Under Law No. 20,009 (Ley N° 20.009), once the user gives notice disputing a transaction, the issuer must cancel or refund the disputed amounts within the deadlines set by law, and may withhold or charge them back only if it proves willful misconduct or gross negligence by the holder. It is not enough for the bank to claim that the passwords were used: the burden of proving the customer’s improper conduct falls on the institution. If the bank refuses to refund without proving those circumstances, you can file a complaint and sue for restitution, along with any damages that may apply.

What matters most is to notify the bank the moment you detect the fraudulent transaction, since timely notice triggers the protection of Law No. 20,009 (Ley N° 20.009) and limits your liability. Beyond that immediate notice, you retain the right to claim restitution and, where appropriate, to sue for compensation, within the applicable prescription periods. Do not let time slip by: review your account statements regularly, dispute anything you do not recognize right away, and keep the record of the notice. If the bank does not respond or rejects the claim, you can turn to the National Consumer Service (SERNAC) and the courts to demand the refund.

Not necessarily. Fraud under Law No. 20,009 (Ley N° 20.009) does not require any breach of the bank’s own security systems, and through 2026 Chile’s Supreme Court has said so repeatedly: tricking the account holder, including the confidence trick Chileans call the “cuento del tío”, still falls within the statute. In case No. 41,072-2025, decided on March 13, 2026, the Court ordered BancoEstado to refund $453,000 pesos to a customer who had handed over security coordinates to a fake buyer during a sale arranged over Facebook. Surrendering one piece of data under deception is not the same as authorizing the transfers that followed: to escape the refund obligation, the bank has to prove willful misconduct or gross negligence by the user before the local police court (Juzgado de Policía Local), and that burden is the bank’s alone. What matters most is moving quickly: notify the bank at once, file the criminal complaint and put the claim in writing with the sworn statement the law requires.

Yes, and the practice is well documented. To be released from the refund obligation the bank needs a court ruling that the user acted with willful misconduct or gross negligence, so rather than absorb the cost, several institutions sue their own customers before the local police court (Juzgado de Policía Local), alleging inexcusable negligence even over small amounts. The fraud victim ends up as the defendant, sometimes litigating on two fronts at once. Being served does not mean the case is lost, but the procedure is short and letting the summons go unanswered is the one sure way to lose. The defense has solid footing in recent case law under Law No. 20,009 (Ley N° 20.009): each transaction is judged on its own, gross negligence is neither presumed nor established by the bare fact that the passwords were used, and the duty to monitor unusual activity sits with the bank, not the account holder.