15 Liability for unauthorised transactions
S 15.1 An issuer shall provide an effective and convenient means including having a
dedicated contact number by which a cardholder can notify the issuer of any
lost, stolen or unauthorised use of his credit cards. The issuer shall also
implement procedures for acknowledging receipt and verification of the
notification of the lost, stolen or unauthorised use of the credit card.
S 15.2 An issuer shall not hold a cardholder liable for card-present unauthorised
transactions which require PIN verification, unless the issuer can prove that the
cardholder has:
(a) acted fraudulently;
(b) delayed in notifying the issuer as soon as reasonably practicable after
having discovered the loss or unauthorised use of the credit card;
© voluntarily disclosed the PIN to another person; or
(d) recorded the PIN on the credit card, or on anything kept in close proximity
with the credit card, and could be lost or stolen with the card.
S 15.3 An issuer shall not hold a cardholder liable for card-present unauthorised
transactions which require signature verification or the use of a contactless
card, unless the issuer can prove that the cardholder has:
(a) acted fraudulently;
(b) delayed in notifying the issuer as soon as reasonably practicable after
having discovered the loss or unauthorised use of the credit card;
© left the credit card or an item containing the card unattended, in places
visible and accessible to others, except at the cardholder’s place of
residence. However, a cardholder is expected to exercise due care in
safeguarding the credit card even at the cardholder’s place of residence;
or
(d) voluntarily allowed another person to use the credit card.
Credit Card 9 of 25
Issued on: 2 July 2019
S 15.4 An issuer must ensure that appropriate investigations are carried out on all
unauthorised transactions. Any decision to pass on liability for unauthorised
transactions must be supported by sufficient evidence to prove that one of the
conditions specified in paragraphs 15.2 or 15.3 as the case maybe, has been
met.
S 15.5 An issuer shall have clear processes in place to register any notification of lost,
stolen or unauthorised use of a credit card and take immediate action upon
notification by a cardholder, to prevent further use of the credit card. A
cardholder shall not be held liable for any unauthorised transactions charged to
the credit card after the cardholder has notified the issuer verbally or in writing
of the lost, stolen or unauthorised use of the credit card.
S 15.6 An issuer shall not hold a cardholder liable for losses incurred if the cause of the
losses is due to any of the following:
(a) failure of the issuer to send reminders to the cardholder as per the
requirements in paragraphs 17.10 and 18.7(a);
(b) failure of the issuer to provide customer hotlines which are operational at
all times for a cardholder to notify the issuer of any lost, stolen or
unauthorised use of the credit card;
© a technical breakdown or other deficiency in the issuer’s systems or
equipment;
(d) weaknesses or vulnerability in security features and controls adopted by
the issuer;
(e) a transaction that involved the use of a forged credit card;
(f) for transactions requiring PIN verification, a transaction that occurred
before the cardholder receives the PIN or changes the default PIN for the
first time;
(g) fraudulent or negligent conduct of the employees or agents of the issuer
or merchants; or
(h) a transaction, excluding a recurring transaction, that occurred after the
cardholder has notified the issuer of the lost, stolen or unauthorised use
of the credit card.