§ 3-31. Information on security and liability for payment services

This section says that the customer must be given information about security and liability when an agreement on payment services is entered into. The customer must know what is expected of them to protect the payment instrument, how the service provider (tjenesteyter) gives notice in the event of suspected fraud, when the instrument can be blocked, and how much the customer may be liable for in the case of transactions the customer has not authorised. The customer must also know how and how quickly errors must be reported, and what the service provider is responsible for.

What the customer must do is set out in § 4-23. The customer must use the payment instrument in accordance with the terms and take reasonable steps to keep the security information safe, for example a code. The issuer, for its part, must provide information on how loss or misuse is to be reported, make sure that notices can be received at any time, stop further use as soon as the notice is received, and confirm the notice so that the customer can document it for at least 18 months.

The deadlines for reporting are set out in § 4-24. The customer must give notice without undue delay on discovering loss, theft or unauthorised use of the payment instrument. To be able to demand that an unauthorised or incorrect transaction be corrected, the service provider must have been notified without undue delay and no later than 13 months after the debit. The 13-month deadline does not apply if the service provider has not given the customer information about the transaction in accordance with the rules in Chapter 3 and 4. Under § 4-45, the service provider may agree to be allowed to block an instrument when security requires it, or in the event of suspected fraud, and the customer must as a general rule be notified before the blocking.

Liability for errors and misuse is divided between several provisions. Under § 4-32, the service provider must refund the amount by the end of the next business day (virkedag) when the customer disputes liability for an unauthorised transaction and has given notice in time, except for the excess and for cases where the service provider has reasonable suspicion of fraud and brings legal action or goes to a complaints board (klageorgan) within four weeks. In the case of direct debit (where the payee (betalingsmottaker) collects the amount), the payer (betaler) can demand repayment of a previously authorised transaction no later than eight weeks after the debit, unless otherwise agreed, and the service provider must pay within ten days (§ 4-27). Who is responsible for correct execution depends on whether the payer or the payee initiated the transaction (§ 4-28 and § 4-29).