§ 4-23. Duties of the customer and the issuer for payment cards and other payment instruments

This section sets out who has which duties in relation to a payment instrument, for example a bank card with its code. The customer must use the account and the instrument as the terms allow. From the moment the customer has the instrument in hand, he must also do what is reasonable to keep codes and other personal security information hidden from others. The terms set by the issuer (the party that issues the instrument) must be objective, the same for everyone in the same situation and reasonably proportionate to their purpose.

The issuer has its own duties. It must tell the customer how a loss or misuse is to be reported, and have arrangements that allow reports to be received at any time. Once a report has arrived, the issuer must stop all further use of the instrument at once. The issuer must also confirm receipt of the report, so that the customer can prove it for at least a year and a half.

New instruments may only be sent when the customer orders them. The exception is when the new one replaces an old one. The issuer must also make sure that no one other than the customer gets access to the personal security information. While the item is being sent, the issuer bears the risk, both for the card and for the code. Example: a bank sends a renewed card by post, and the shipment disappears on the way. In that case it is the bank, not the customer, that bears the risk for what happens to the shipment.

This section is closely linked to § 4-24. That section requires the customer to report without undue delay in the event of loss, theft or misuse, and the report must go to the party the issuer has specified under this section. The issuer's duty to inform and to receive notices is therefore what makes the customer's duty to give notice work in practice. The same section sets an outer deadline of 13 months to demand correction of a transaction that was not authorised or was carried out incorrectly.

Several other sections refer to this one. Their titles suggest that § 4-30 concerns liability and excess (egenandel) for unauthorised payment transactions (betalingstransaksjon), and that § 4-31 concerns reduction of the customer's liability. Section 3-7 has the title "Burden of proof (bevisbyrde) and standard of proof for payment transactions", and § 4-21 deals with charges and fees.