Preventing payment fraud: legal duties

Service page: Class actions and consumer claims lawyer.

Unauthorized charge: what is your right, and what do you do?

The Debit Cards Law, 5746-1986 was repealed on 14 October 2020, and the Payment Services Law, 5779-2019 applies in its place (sections 55 and 77). Under this Law, from the moment you give notice of the misuse you are not liable for further charges, and before the notice your liability is limited: at most NIS 75 plus NIS 30 for each day from the time you found out until the notice, and no more than NIS 450 if you gave notice within 30 days of the first use (section 24(c)). The limit does not apply if you made the essential component of the payment instrument available to another person or acted fraudulently (sections 24(d) and 26). Beyond that, you bear no liability (section 31).

What to do at once:

• Call the credit card company and report the misuse. From the moment of the notice you are not liable for further charges (section 24(b)). The amount charged, minus your share under section 24(c), must be refunded to you within eight business days of the notice (section 27(a)), and you can ask for the payment instrument to be frozen at once, for the period you request and up to 14 days, unless the service provider allowed a longer period (section 22).
• File a written complaint. If the company believes that one of the exceptions applies, it may charge you again only by a written notice with reasons, as a rule at least 15 days before the charge (section 27(b)).
• Keep a record of all correspondence, screenshots and confirmations.
• Contact the Bank of Israel’s Consumer Enquiries and Inspections Unit if the company refuses to cooperate.

The law has no “13-month window”. What decides is when you gave notice: after the notice you are not liable at all, and before it you are liable for at most NIS 75 plus NIS 30 for each day from the time you found out until the notice, and no more than NIS 450 if you gave notice within 30 days of the first use (Payment Services Law, section 24(c)). For a charge that has no signed document or record of strong authentication, you must give notice within 30 days of receiving the notice of the charge (section 29(b)).

When is a payment platform responsible for a charge that was reversed, and not only the credit card company?

The credit card company refunds the money to you (section 27 of the Payment Services Law), and sometimes collects it from the business that received the payment, but not when strong authentication was used in the transaction, or when such authentication was not possible or not allowed to the business (section 32(a)). But there are cases in which the platform itself (an e-commerce shop, a payment app, a fintech company) bears additional liability.

Duties to identify the customer and to report to the Israel Money Laundering and Terror Financing Prohibition Authority are imposed by the Prohibition on Money Laundering Law, 5760-2000 (חוק איסור הלבנת הון, התש״ס-2000) on banking corporations and on the financial bodies in the Third Schedule to the Law, including payment companies, under orders issued under section 7. The Payment Services Law, 5779-2019 empowers the Minister of Justice to set duties to verify the payer’s identity (section 10).

If the platform did not meet its duties and you suffered damage as a result, you may have a direct cause of action against it in tort law, alongside your rights against the issuer of the payment instrument. This question is examined according to the circumstances of the case. It is especially relevant in sophisticated frauds that a reasonable platform should have stopped.

Who is responsible for money stolen in a phishing scam: the bank, the customer or the platform?

The rule in the Payment Services Law, 5779-2019 is not a negligence test. For misuse that took place before you notified the bank or the credit card company, you are liable at most for a limited amount: NIS 75 plus NIS 30 for each day from the time you found out until the notice, and no more than NIS 450 if you gave notice within 30 days of the first use (section 24(c)). For use after the notice, you are not liable at all (section 24(b)). The limit does not apply if you made the essential component of the payment instrument available to another person, or if you acted fraudulently (sections 24(d) and 26). According to an opinion of the Ministry of Justice (30 September 2021), giving details to someone who impersonated the bank or the credit card company does not fall within this exception.

If the bank believes that one of the exceptions applies, it may charge you again only after a written notice with reasons, as a rule at least 15 days before the charge (section 27(b)), and in a dispute about this the court decides. Get legal advice before you accept a refusal by the bank as final.

What duties does Israeli law place on fintech platforms and businesses that accept online payments?

Businesses that accept payments online (shops, fintech companies, apps) are subject to duties that protect you as consumers, some of them only if they are regulated financial bodies:

• Identity verification (KYC): financial bodies that have duties under section 7 of the Prohibition on Money Laundering Law, 5760-2000 (banking corporations and bodies in the Third Schedule to the Law, including payment companies) must identify the recipients of the service according to the order that applies to them.
• Reporting suspicious transactions: the same bodies must report the actions set in the order, and the report is passed to the database managed by the Israel Money Laundering and Terror Financing Prohibition Authority (sections 7(d) and 29). A breach of the duty may lead to a monetary sanction (section 14), and an act intended to cause a report not to be made is an offense (section 3(b)).
• Data security: under section 17 of the Protection of Privacy Law, 5741-1981, the controller of a database and its holder are responsible for the security of the information in it, and the Protection of Privacy Regulations (Data Security), 5777-2017 set the scope of the duty. A leak from a database that was not secured as required may expose those responsible for it to legal liability.

What do you do if the bank or the credit card company refuses?

There are several steps:

• Contacting the Bank of Israel: the Consumer Enquiries and Inspections Unit at the Bank of Israel handles complaints against banks and credit card companies, at no charge.
• Contacting the Consumer Protection Authority: if the charge is from a business (not a bank), the Authority can investigate and enforce.
• A claim in the Small Claims Court: up to NIS 39,900 (as of 2026). You can sue without a lawyer, and the court fee is 1% of the amount claimed and not less than NIS 50 (regulation 6(a) of the Small Claims Adjudication (Rules of Procedure) Regulations, 5737-1976 (תקנות שיפוט בתביעות קטנות (סדרי דין), התשל״ז-1976)). Attach documentation of the transaction and the body’s letter of refusal.
• A full civil lawsuit: for large amounts, with legal representation.