What happens if someone uses your card without permission?

Call your bank and block the card the moment you see a transaction you did not make. Central Bank rules then set how long you have, what the bank must do and when you get your money back.

How long do you have to report it?

At least 30 business days after you were properly informed of the transaction. Your bank must run phone and digital channels 24 hours a day, 7 days a week for reporting loss, theft, fraud or misuse of a card.¹

You will usually be informed straight away: banks must send you a free SMS, or an email if you ask, for every transaction on your account as it happens.¹

What must your bank do when you report?

Record your report with the date and time, tell you your options (block the card while it investigates, close it, or cancel and replace it) and take steps to stop further unauthorised payments.¹ The 2011 credit card rules also require banks to investigate immediately when a customer challenges any item on a statement.²

When do you get your money back?

The bank must reimburse an unauthorised payment within 30 calendar days of the day you first reported it, or when its investigation ends, whichever is sooner.¹ That does not apply where there is evidence you acted fraudulently or with gross negligence.¹

If the bank cannot clearly confirm and document that you authorised the payment and the dispute remains, the complaint must go straight to a complaint resolution mechanism.¹

Can the bank charge you for a dispute?

Some banks charge if the transaction turns out to be genuine. FAB lists a dispute verification charge of AED 105.³ HSBC charges AED 105 on some cards for disputing a transaction later found to be genuine, and nothing on others.⁴

What if the bank refuses?

Make a written complaint to the bank. If you have no answer after 15 calendar days, or you are not satisfied, you can take it to Sanadak, the independent ombudsman unit for banks and insurers that the Central Bank set up in 2023.⁵ The steps are in how to complain about your bank.

Check every statement and SMS against your receipts, and report anything you do not recognise the same day.

The small print

• Unauthorised transaction rules are Consumer Protection Standards clauses 5.1.1.43 to 5.1.1.48. SMS alerts are clause 2.1.1.44. Warnings on sharing security details are clause 2.1.1.39.¹
• The duty to investigate a challenged statement item is Article (5)(d) of Regulation 29/2011.²