The victim as defendant: what does Chilean law owe you after bank fraud, and what will your bank try instead?

A transfer nobody authorized. A withdrawal nobody made. Chilean law gives the cardholder a fast refund on a short clock, and this year the Supreme Court has held the line even where the customer handed over the codes. The fight has moved elsewhere: to the courtroom where the bank sues the customer.

Two weeks ago, on July 13, the Second Chamber of Chile’s Supreme Court granted a disciplinary appeal and let stand a judgment ordering Scotiabank to pay $17,389,624 pesos to a customer. An email dressed up as the bank had asked him to resynchronize his security device. With what he gave, strangers took out a loan in his name and, minutes later, emptied the account in three transfers. The court never reached the question of whether the customer had been careless. It found that the payments went out from an unfamiliar IP address and that the bank neither blocked them nor raised a flag.

Twelve days later, a newspaper column set out the other half of the same picture: before absorbing the cost of a fraud, many issuers sue their own customers.

Between those two items sits most of what there is to know about bank fraud in Chile today. The law protects the customer, the Supreme Court has said so with striking consistency, and people still lose the money. Not because the statute is weak, but because notice went in late, because the criminal complaint receipt is missing, because nobody wrote down the reference number, or because a lawsuit arrived and the response was filed a day too late. This guide is about the steps that preserve the claim and about what can be demanded once the bank decides not to pay.

The rule, in one paragraph

Give timely notice and the issuer must refund. The burden does not sit with the customer. If the bank wants out on the theory that the user acted with willful misconduct or gross negligence, it has to prove that to a court, and until it does, it pays.

The regime lives in Law No. 20,009 (Ley N° 20.009), reinforced first by Law No. 21,234 (Ley N° 21.234) in 2020 and then by Law No. 21,673 (Ley N° 21.673), published in the Official Gazette on May 30, 2024. That last one sets the current state of play: it cut the look-back window for disputing transactions that predate the notice from 120 to 60 days, raised the refund deadline from five to 10 business days, and made a criminal complaint a condition of getting the money back.

What to do about bank fraud: the first four steps

This is the urgent part, and the sequence matters.

Step 1. Notify the bank and freeze the product. Banks must keep free notification channels open every day of the year, at any hour, and must hand over a tracking or reference number with the date and time of receipt. Since October 2025 there is also a single number for this: dial 1212 from any phone in Chile, landline or mobile, and the call is routed to your own bank’s emergency line. The banking association set it up, it is free, it works across every carrier and it runs around the clock. It does not replace each bank’s own number, but it spares you hunting for that number at the one moment you have no time to hunt for anything. Write it down, photograph it, keep it. It is the proof that notice was timely, and much of what follows rests on it. A phone call with no reference number is, in practice, a notice the bank can dispute.

Step 2. File the criminal complaint. Since Law No. 21,673 this stopped being the customer’s choice. Without the receipt, the issuer can withhold the refund, and it will. File with the uniformed police, the investigative police, the prosecutor’s office or any court with criminal jurisdiction, and get the receipt to the bank before the refund clock runs out, not after.

Step 3. Put the claim in writing. The issuer will ask for a simple sworn statement identifying the disputed amount, the product involved (account, card, app) and how the fraud unfolded. That claim is what starts the refund clock, so file it as soon as you hold the notice reference number, rather than waiting to assemble the rest of the file.

Step 4. Freeze the evidence. Emails, text messages, screenshots, the incoming call log, the statement showing the disputed movements, and every later exchange with the bank. If this escalates, that folder is the case. What gets deleted on day one does not come back in month three.

How long does the bank have?

The statute sorts the answer by amount:

• Up to 35 UF: charges must be reversed or funds returned within 10 business days of the claim.
• Up to that same threshold, where the fraud involved cash withdrawals or advances: the deadline stretches to 15 business days.
• Above 35 UF: the portion within the threshold follows the deadlines above, and for the excess the issuer gets 7 business days more.

The threshold is neither fixed nor arbitrary. The 2024 amendments empowered the Ministries of Finance and Economy to set it anywhere between 15 and 35 UF, and even to draw different limits by transaction type, payment method and product. By Exempt Decree No. 473, published in the Official Gazette on January 30 of this year, both ministries chose to leave it at 35 UF, reasoning that there is not yet a long enough track record under the new rules to justify moving it. The banking industry had pushed for 15 UF. It did not get it.

One practical warning. Plenty of websites, law firm pages among them, still quote a deadline of five business days. That was the regime before Law No. 21,673. The numbers today are 10, 15 and 7.

The clock does not start when the fraud happens. It starts with the claim. Which is why the notice reference number and the date of the claim are worth more than any later account of how it all went wrong.

What if the customer handed over the password?

It is the most common question, and the answer tends to surprise: the protection can survive.

This year the Supreme Court settled the point in three rulings that are best read together.

January: deception is inside the statute. In case No. 38,510-2025 the Court reversed the Santiago Court of Appeals and set out the reach of the statutory concept of fraud: Law No. 20,009 draws no distinction based on where the deception came from, and does not require any breach of the issuer’s security systems. The confidence trick Chileans call the “cuento del tío” is covered.

February: who has to prove what, transaction by transaction. Here the party bringing the case was a construction company that its bank, Banco de Crédito e Inversiones, had sued for negligence. The First Local Police Court of La Reina threw the bank’s claim out; the Santiago Court of Appeals reinstated it, applying article 5 of the statute on the basis of gross negligence over three electronic transfers made on June 22, 2021, for $1,600,000, $1,700,000 and $5,080,000 pesos. The Supreme Court granted a disciplinary appeal and set that ruling aside: the appeals court had flipped the burden of proof, finding gross negligence without any showing that the dynamic codes had been handed over or that the bank had fallen short of its duty of security. The outcome is a split one, and instructive for exactly that reason: gross negligence was made out on the first transfer, the $1,600,000 one, and not on the two that followed.

March: the case itself. In case No. 41,072-2025, decided on March 13, the Third Chamber reversed the Coyhaique Court of Appeals, granted the protection petition and ordered BancoEstado to refund $453,000 pesos to a customer who had surrendered his security codes after being deceived. The bank had refused on the theory that handing over the data voluntarily put the case outside the statute. The Court disagreed, and added the decisive point: the issuer never took the one route the law gives it to say no.

The reasoning did not appear from nowhere this year. On November 11 last year, in case No. 462-2025, ruling on a claim worth 35 UF, the Court had already held that fraud covers any conduct contrary to truth and fair dealing that harms another, and that a bank which never goes to the local police court to prove willful misconduct or gross negligence has committed an unlawful omission.

A different case, and an increasingly common one, is the fraud where the customer handed over nothing because the phone was never in their hands: the chip was swapped, or the line was ported into somebody else’s name, and the bank’s codes went straight to the criminal. There the carrier that never checked who was asking answers alongside the bank. We cover it in They took the SIM and emptied the account.

Can the bank refuse to pay?

Only with a court behind it, and this is the piece most people miss.

The issuer cannot decide on its own that the customer was negligent and close the file with a letter. To be released, it must sue in the local police court, Chile’s small-claims consumer forum, and prove willful misconduct or gross negligence there. Until that ruling exists, the refund obligation stands untouched, and ignoring it opens three routes at once: a complaint to the consumer protection agency, an infringement action under Law No. 19,496 (Ley N° 19.496) for breach of the duty of security, and a constitutional protection petition, which is the road most of the judgments cited here traveled.

Refusing repeatedly is not free on the regulatory side either. Last November the Supreme Court upheld a 4,000 UF fine against BancoEstado for repeated breaches of the fraud statute.

The bank can sue you, and it helps to know that in advance

On July 25 the academic Francisca Barrientos returned to the point in a column in El Mostrador: rather than absorb the cost, many financial institutions systematically sue their customers in the local police courts for inexcusable negligence, sometimes over amounts near $30,000 pesos. The victim of a scam ends up as the defendant and, often enough, litigating on two fronts at once: the bank’s case against her, and the protection petition she filed herself.

None of which is cause for panic. A lawsuit does not mean the case is lost. It means there are deadlines to meet and a defense to build, and that ignoring the summons is the one reliable way to lose. Three arguments recent case law supports:

1. Each transaction is judged on its own. Handing over a code under deception is not the same as approving everything that came after it. February’s ruling is precisely that: gross negligence was made out on one transfer and rejected on the other two from the same day.
2. Gross negligence is not presumed, and it is not established by the bare fact that the passwords were used. If that sufficed, the statute would mean nothing, because in every impersonation fraud the passwords get used.
3. Monitoring is the issuer’s duty. This month’s judgment says so plainly: fraud monitoring and control obligations rest expressly with the bank, which is supposed to take account of the customer’s behavioral patterns. Three electronic payments worth more than seventeen million pesos from an unfamiliar IP address, with no alert of any kind, is not the account holder’s failure.

What happens above 35 UF?

The threshold defines how far the fast-refund mechanism reaches, not how far the bank’s liability reaches. Above that figure the argument shifts to the issuer’s duty of security, to Law No. 19,496 and to general liability rules, and the amounts change accordingly.

The case this article opens with shows it. In No. 51,579-2024 the Supreme Court granted the disciplinary appeal and upheld the ruling of the First Local Police Court of Ñuñoa ordering Scotiabank to pay $17,389,624 pesos. The dispute was never about the threshold. It was about whether the bank had met its duty of security in the face of transactions that any sensible monitoring system would have flagged.

Two paths, then, and they do not exclude each other: the threshold mechanism for what has to happen now, and the duty-of-security claim for the rest.

What if the account belongs to a company?

One common misunderstanding is worth clearing up first: Law No. 20,009 does not require the victim to be a consumer, or a natural person. It applies to holders and users of payment cards and electronic transactions, and a company with a current account and the products attached to it sits squarely inside that. February’s ruling proves the point without any need for theory: the party bringing the case was a construction company, its bank had sued it for gross negligence, and the whole thing was fought out in a local police court under article 5 of that same statute.

What does change when the holder is a company comes down to three things.

• The amount. Corporate fraud almost always runs past 35 UF, so the fast-refund mechanism covers a slice and the bulk is argued as a breach of the bank’s duty of security and under ordinary contractual liability in civil law. That works in the company’s favor: once the contractual relationship is established, it is the bank that has to show it performed.
• The consumer route. Where a company contracts for its own business, whether it counts as a consumer is arguable, and with it the infringement and damages route under Law No. 19,496. Better to settle that question before choosing the forum than after the first ruling.
• What is on trial is a procedure, not one person’s lapse. Who was authorized to transfer, under what second approval, what happened when the suspect email arrived. A company defends itself with its own records, or it does not defend itself at all.

On that last point: corporate fraud is rarely one bad click. It is usually a chain, with a spoofed supplier email, changed bank details on an invoice and manufactured urgency aimed at whoever approves payments. Prevention costs a fraction of litigation and it is entirely concrete: define who approves payments and under what second signature, turn on multi-factor authentication across every profile, set movement alerts, verify any change to a supplier’s bank details through a separate channel, and train the team on impersonation tactics. That is the work of our cybersecurity and computer crime practice, and we go through it in more detail in Computer crimes and cybersecurity: key points for your company.

What not to do

• Wait to see whether the money comes back. The clock runs from the claim, and the claim does not file itself.
• Delete the scammer’s messages, emails or call records. That is evidence, however unpleasant it is to look at again.
• Sign the bank’s paperwork unread, particularly a settlement offered below the amount taken.
• Call back the number that called you or hand over more details to “reverse the transaction.” That is almost always the second hit.
• Answer the bank’s lawsuit yourself, at the last minute. Local police court procedure is quick and unforgiving about deadlines.

The documents to assemble

1. The notice reference or tracking number, with date and time.
2. The criminal complaint receipt.
3. A copy of the claim and the sworn statement filed with the bank.
4. The account statement, with each disputed movement marked.
5. Screenshots of the suspicious messages, emails or calls, with their dates.
6. Every written response from the bank, refusals included: the reasoning you will have to take apart later is usually right there.

The deadlines passed and the bank has gone quiet

At that point the phase is no longer the claim. It is enforcement. The notice reference number, the criminal complaint receipt and the filed claim are the three things the statute asks for, and the issuer’s failure is documented by its own silence. From there, a formal complaint to the consumer agency, an infringement action and a court claim are all available, including the protection route where the refusal is not backed by the court ruling that would authorize it. If the bank has also sued, there are deadlines to meet and a defense to mount on arguments that now carry the Supreme Court’s backing.

A protection that exists, and has to be used properly

This year’s line of judgments left little room for doubt on the merits: deceiving the holder does not take the case out of the statute, the burden of proof sits with the issuer, and the only door to refusal runs through a court. What no judgment can fix is the design problem the column identified, which is that the cost of enforcing the right falls on the person who already lost the money, made to litigate in two forums over sums that sometimes do not cover the filing.

While that holds, the difference between recovering and not recovering is decided in the first few hours and in five documents. None of them is hard to obtain. All of them are impossible to manufacture later.

This article is general information and not legal advice on any specific matter. The legislation and case law cited should be checked in their current form before any decision is taken. If a bank has refused to refund you, let the statutory deadlines lapse, or sued you over a fraud, get in touch and we will review your position through our Banking Fraud practice.