Hacking e-payment systems, online payment instruments, transactions, apps or websites is a criminal offence punishable by imprisonment and hefty fines

Question: I recently discovered several unauthorised transactions on my UAE bank account. Although I reported the issue to the bank immediately, the investigation is taking longer than expected. What legal protections do consumers have in such situations, and can the bank be held liable for any financial losses?

Answer: Pursuant to your queries, the provisions of consumer protection law issued by the Central Bank of UAE pertaining to the financial institution and the cybercrime laws of UAE are applicable.

In the UAE, it is a crime if anyone hacks the e-payment clones' electronic online payment instruments, transactions, applications or websites, and such crimes may lead to imprisonment and/or payment of huge fines to an individual or group of individuals who are committing such a crime.

This is in accordance with Article 15 of the Federal Decree Law No. 34 of 2021 on Countering Rumours and Cybercrimes (the ‘UAE Cybercrime Law’) related to hacking e-payment instruments, which states,

"Whoever forges, clones or copies any credit card, debit card, or any e-payment, or captures its data or information using any of the ITE ISs shall be punished with imprisonment and/or a fine of not less than (Dh200,000) two hundred thousand dirhams) or more than (Dh 2,000,000 (wo million dirhams.

The same penalties shall be imposed on whoever:

1. Makes or designs any ITE or software with the intention of facilitating any of the acts stipulated in Para. (I) of this Article.

2. Uses without authorisation any credit, electronic, or debit card or any other e-payment instrument, or any of its data or information, with the intention of obtaining for himself or for third parties any funds or properties of others or to utilise the services made available to third parties by these cards or instruments.

3. Accepts using these forged, fake, or copied cards or e-payment instruments or data seized or obtained illegally despite being aware of their illegality.”

Further, financial institutions in the UAE are obligated to create awareness for their customers and the public related to the financial crimes.

This is in accordance with Clause 6.2.2.6 of Consumer Protection Regulation issued by the Central Bank of UAE through its Circular No. 8 of 2020 to all licensed financial institutions in the UAE (the “Consumer Protection Regulations of Financial Institutions”), which states, "Licensed Financial institutions must demonstrate they have carried out sufficient consumer awareness activities related to educating consumers of the need to protect themselves from financial crime."

Financial institutions, in accordance with clause 6.2.2.5 of Consumer Protection Regulations of Financial Institutions, must maintain up-to-date security systems and must be prepared to implement new cybersecurity strategies as needed. This ensures they can effectively protect against evolving threats. “Licensed financial institutions must ensure their security and protection systems are updated and have the capacity to develop and adopt new approaches to cybersecurity as required.”

Further, financial institutions may have to compensate their customers in case of any financial loss to them due to financial crimes.

However, financial institutions are not liable to pay compensation for financial loss arising out of financial crimes if it is due to the gross negligence or fraudulent behaviour of their customers.

This is in accordance with Clause 6.2.2.4 of the Consumer Protection Regulations of Financial Institutions, which states, “Licensed Financial Institutions must compensate Consumers in a timely manner for financial losses and expenses resulting from Financial Crimes, misappropriation, cyber-attacks and misuse of assets and information unless it can be proven that the loss was due to the gross negligence or fraudulent behaviour of the Consumers."

Based on the aforementioned provisions of law, the bank may be held liable to compensate its consumers for losses and expenses caused by financial crimes, cyber-attacks, or misuse of assets and information, unless the loss is due to the consumer's own gross negligence or fraud.

If you are sure about the fact that you have not interacted with any fraudulent site and can also provide proof that the said loss of money was not due to your negligent behaviour, then the bank may be liable to compensate you for the loss. You may file a formal complaint with your bank. The bank, based on your complaint, may undertake relevant investigations on the financial crime.

Further, you may have to file a police complaint and submit details of the transaction along with evidence. In the event you feel that your complaint is not resolved by your bank to your satisfaction, you may escalate your complaint to the Central Bank of UAE to report the matter to them for investigation and resolution.

Ashish Mehta is the founder and managing partner of Ashish Mehta & Associates. He is qualified to practise law in Dubai, the United Kingdom and India. Full details of his firm are on www.amalawyers.com. Readers may e-mail their questions to news@khaleejtimes.com or send them to Legal View, Khaleej Times, PO Box 11243, Dubai.

Disclaimer: The information provided above is intended for general guidance and does not constitute legal advice. It is recommended to seek formal legal counsel.