A borrower who finds transactions on a credit account or card that they did not make is protected by two overlapping UK regimes. Sections 83 and 84 of the Consumer Credit Act 1974 deal with misuse of credit facilities and credit-tokens, and regulations 75 to 77 of the Payment Services Regulations 2017 deal with unauthorised payment transactions. Both apply across the UK. This guide summarises them as general information, not advice on a particular dispute.
The starting point in section 83
Section 83(1) of the 1974 Act says the debtor under a regulated consumer credit agreement is not liable to the creditor for any loss arising from use of the credit facility by another person not acting, or to be treated as acting, as the debtor’s agent. Section 83(2) excludes non-commercial agreements and certain cheque misuse.
The limit for credit cards and other credit-tokens
Section 84 qualifies section 83 for credit-token agreements, such as credit cards. Under section 84(1) the debtor can be made liable up to £35, or the credit limit if lower, for loss arising from use of the credit-token by other persons during the period when it is out of the possession of any authorised person. Section 84(2) allows liability to any extent where the user acquired possession of the token with the debtor’s consent.
Several conditions protect the borrower. Under section 84(3), the limits do not apply to use after the creditor has been given oral or written notice that the token is lost or stolen or otherwise liable to misuse. Under section 84(3A) and (3C), they do not apply to use of a card in connection with a distance contract, subject to the exceptions stated. Under section 84(4), the limits apply only if the agreement contains, in the prescribed manner, the name, address and telephone number of the person to be notified. Oral notice can be required to be confirmed in writing within seven days under section 84(5).
A card the borrower never accepted
Section 66 says the debtor is not liable under a credit-token agreement for use made of the credit-token by any person unless the debtor had previously accepted it, or the use constituted acceptance. A token is accepted when it is signed, or a receipt for it is signed, or it is first used by the debtor or a person the debtor authorised. A card intercepted before it reached the borrower can therefore fall outside the borrower’s liability.
The Payment Services Regulations 2017
The 2017 Regulations apply to payment services, including card payments. Regulation 75 says that where a payment service user denies having authorised an executed payment transaction, it is for the payment service provider to prove that it was authenticated, accurately recorded, entered in the accounts and not affected by a technical breakdown. Under regulation 75(3), a recorded use of a payment instrument is not in itself necessarily sufficient to prove authorisation, and regulation 75(4) requires the provider to supply supporting evidence if it alleges fraud or gross negligence.
Under regulation 76, subject to regulations 74 and 75, the provider must refund an unauthorised transaction and restore the account to its previous state, as soon as practicable and no later than the end of the business day following the day it becomes aware of the transaction. That does not apply where the provider has reasonable grounds to suspect fraudulent behaviour by the user and notifies the relevant person in writing.
Regulation 77 lets a provider require the payer to bear up to £35 of losses from a lost, stolen or misappropriated payment instrument, but not where the loss was undetectable before the payment, or was caused by the provider or its agent. The payer is liable for all losses if they acted fraudulently or with intent or gross negligence failed to comply with regulation 72. Except where the payer acted fraudulently, there is no liability for losses after notification under regulation 72(1)(b), or for use in connection with a distance contract, other than an excepted contract.
Practical steps
Because notice ends liability under both regimes, the account provider should be told immediately by phone, and confirmed in writing, so there is a record. The statement should be checked for every transaction, and disputed items listed. If the provider refuses a refund, the complaint route is described in the guide to complaining to the Financial Ombudsman Service. Other protections on card purchases, where goods are faulty or not supplied, are covered in the guide to section 75.
FAQs
Am I liable if a thief uses my credit card before I report it?
Under section 84(1) liability is capped at £35, or the credit limit if lower, for use while the card is out of authorised hands. Regulation 77 of the 2017 Regulations also refers to £35, with exceptions.
Does the limit apply once I have told the card issuer?
No. Section 84(3) says the limits do not apply to use after the creditor has been given notice, and regulation 77(4) removes liability for losses after notification, except for fraud by the payer.
Who has to prove a payment was authorised?
Under regulation 75, it is for the payment service provider to prove that the transaction was authenticated and accurately recorded, and a recorded use is not in itself necessarily sufficient proof.
The bottom line
Under section 83 of the Consumer Credit Act 1974, a borrower is generally not liable for another person’s unauthorised use of a regulated credit facility, and section 84 caps liability for credit-token misuse at £35, or the credit limit if lower, with several exceptions. The Payment Services Regulations 2017 add proof and refund duties for providers. Prompt notice ends liability. This is general information, not legal advice.
Sources
- legislation.gov.uk, “Consumer Credit Act 1974, section 83: Liability for misuse of credit facilities”
- legislation.gov.uk, “Consumer Credit Act 1974, section 84: Misuse of credit-tokens”
- legislation.gov.uk, “Consumer Credit Act 1974, section 66: Acceptance of credit-tokens”
- legislation.gov.uk, “Payment Services Regulations 2017, regulation 75: Evidence on authentication and execution of payment transactions”
- legislation.gov.uk, “Payment Services Regulations 2017, regulation 76: Payment service provider’s liability for unauthorised payment transactions”
- legislation.gov.uk, “Payment Services Regulations 2017, regulation 77: Payer or payee’s liability for unauthorised payment transactions”