Argentina: court orders bank to refund unauthorised home banking transfers

A provincial court in Argentina has upheld a company’s claim against its bank over electronic transactions the company says it never authorised, as reported by El Ciudadano on 9 November 2026. It matters because it strengthens an approach that shifts the risk of digital fraud towards whoever runs the platform and profits from it.

What the company claimed

The firm sought the return of ARS 83 million, plus interest and costs. It reported the redemption of a mutual investment fund and several transfers which, it argued, lacked a valid digital signature. The case was first covered by Versión Rosario, which relayed the account of the claimant’s lawyer.

The bank’s defence and the court’s answer

The bank argued that the operations were made with the client’s username and password and confirmed with a coordinates card. The court did not find this sufficient. It recalled that case law classes home banking as a risk-creating activity, which means strict (objective) liability for the institution that runs the system and earns money from it.

The judgment adds that digital platforms open new ways of compromising user security that in-branch banking did not know. It also stresses that the bank acknowledged applying no additional measures, such as positive identification tests using biometric data or checks against the Sistema de Identificación Digital, either when adding new payees or when paying recipients not used before. Hence the court speaks of aggravated strict liability.

What it means in practice

The key question is no longer only who held the credentials, but whether the bank’s system was reasonably secure against unusual patterns. Showing that the right password was used is no longer enough to prove the client’s authorship. For businesses, the case shows that a claim can succeed even where they are not consumers in the strict sense. The information available comes from press reports and does not identify the court or the date of the decision, so its finality and any appeals will need to be followed.

Our view at CEA Digital Law

At the Euro-American Committee of Digital Law - CEA Digital Law, we welcome a debate focused on the security of the system rather than on the individual diligence of the user. It is close to the logic of European payment services rules, which place on the provider the burden of proving that a transaction was properly authenticated. In Latin America and the Caribbean, and in rapidly digitalising African banking markets, it would be useful to converge on minimum standards: strong authentication, alerts for unusual transactions and checks when new payees are added.

We suggest that regulators and institutions define these standards in advance and in clear terms. That would give banks certainty about what is expected of them, and protect customers and businesses. An open question remains: how should risk be shared when the client is a victim of social engineering and hands over their own data?

Sources

• El Ciudadano

CEA Digital Law