AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
There is no single CBN rule that makes the bank or the customer always liable for an unauthorised debit. Liability turns on your account and card terms, how quickly you reported, and whether either side was negligent; card terms commonly make the customer liable for transactions before the card is reported. The CBN's November 2025 draft guidelines on authorised push payment fraud proposed that institutions with weak systems bear the loss, that no-fault cases be split between banks, and that customers report within 72 hours.
An unauthorised debit is money taken from your account without your consent: a cloned card, a hacked app, a USSD session from a stolen phone, or a debit the bank cannot explain. A related but different case is authorised push payment fraud, where you were tricked into sending the money yourself. Who bears the loss is decided differently in each case, and the speed of your report is the one thing you control in both.
What decides liability today
| Factor | Why it matters |
|---|---|
| Your account, card and channel terms | They set when you are liable, often until you report the card or phone as lost |
| Time to report | Losses after a report usually fall on the bank; before it, often on the customer |
| Negligence | Sharing a PIN, OTP or password shifts liability to the customer |
| The bank's controls | If the bank's systems failed, the customer has a strong complaint |
| Evidence | Alerts, session IDs, location and device records decide disputed cases |
What bank terms say
Stanbic IBTC's debit card terms, for example, ask customers to report a lost, stolen or compromised card immediately, make the customer liable for transactions before the report, and ask for unauthorised transactions to be reported in writing within 120 days. Its USSD terms make the customer liable for unauthorised use of their phone. Other banks' terms differ in detail but often follow the same pattern, so read yours.
The 2025 draft rules on push payment fraud
On 26 November 2025 the CBN published draft guidelines on authorised push payment (APP) fraud for comment, as reported by TechCabal. If adopted as drafted, they would:
- Make an institution that fails to flag or freeze a fraudulent transaction because of inadequate systems bear the cost.
- Split the refund equally between the banks where no institution and not the customer is at fault.
- Exclude customers who acted fraudulently or negligently.
- Require customers to report within 72 hours with the date, amount, recipient details and supporting documents, with exceptions for illness, force majeure, unavailable channels or bank staff failures.
- Require banks to acknowledge within 24 hours, notify other institutions involved within 30 minutes, finish investigating within 14 working days and reimburse within 16 working days of the first report.
Unauthorised or authorised: which case is yours?
The distinction matters because the two are handled differently. If someone used your card, phone or login without you, the debit is unauthorised and the question is whether your bank's controls and your own care were adequate. If you entered the transfer yourself after being deceived, for example by a fake investment, a fake seller or a caller pretending to be your bank, it is authorised push payment fraud. Banks have historically been reluctant to refund the second kind, which is what the 2025 draft guidelines tried to address.
Some cases mix both: a fraudster talks you into reading out an OTP and then makes the transfer. Expect the bank to treat that as your negligence. Describe exactly what happened in your complaint, because the details decide the outcome.
If the bank refuses to refund
Ask for the refusal and its reasons in writing, together with the evidence the bank relied on, such as the device or location used. If you disagree, escalate to the CBN Consumer Protection Department with your timeline and the bank's reply. Report fraud to the police as well; a police report is often requested later.
Your reporting duties
- Block first. Use your bank's block or hotlist code from your registered number; GTBank lists *737*51*10# to hotlist a card and Access Bank *901*911# to block an account. Then call the bank.
- Report in writing the same day: dates, amounts, references and what you did not authorise.
- Do not share codes with anyone who calls offering help, even if they say they are from the bank.
- Keep everything: alerts, screenshots, call times and names.
- Escalate on time: three days for an acknowledgement and two weeks for a resolution under the CBN complaint guide, then the CBN Consumer Protection Department.
Worked example
Example only. Chidi's card is cloned. Three debits of ₦40,000 go through at 9pm, and he notices at 10pm and hotlists the card at 10:15pm. A fourth debit of ₦40,000 is attempted at 11pm. Under typical card terms, the first three debits (₦120,000) happened before his report and he may be treated as liable unless he shows the bank's controls failed; the fourth, after the report, should be the bank's responsibility. His complaint should stress that he never shared his PIN and ask the bank to explain why the cloned card was accepted.
Where Pryme fits
Fewer weak points mean fewer disputes. Pryme uses an authenticator app rather than SMS codes and a transaction PIN for approvals (security). For what to do in the first hour after fraud, see lost money to fraud, and on refunds, will your bank refund you. SIM swap cases are covered in SIM swap fraud.
Questions people ask
Will my bank refund money taken without my permission?
It depends on your terms, how fast you reported and whether you were negligent. Losses after you report are more likely to be refunded than losses before.
How soon must I report fraud to my bank?
Immediately. Card terms often make you liable until you report, and the CBN's 2025 draft APP fraud guidelines proposed a 72-hour reporting window.
Who pays if I was tricked into sending money?
Under the November 2025 draft guidelines, banks with weak controls would pay, no-fault cases would be split between banks, and negligent customers would not be refunded. Check whether the final rules are in force.
What if I shared my OTP with a fraudster?
Sharing a PIN or OTP is usually treated as negligence, which shifts liability to you under most terms and under the draft guidelines.
Sources
- TechCabal: Nigerian banks must refund fraud victims within 16 working days under new CBN framework (draft APP fraud guidelines, 26 November 2025) · accessed Oct 2026
- Stanbic IBTC: Debit card terms and conditions · accessed Oct 2026
- Stanbic IBTC Bank: USSD Banking Terms and Conditions · accessed Oct 2026
- Central Bank of Nigeria: How to Lodge a Complaint (CPD/GEN/GUIDE/03, 24 January 2022) · accessed Oct 2026
- GTBank: Complaints and Enquiries · accessed Oct 2026
- Access Bank: USSD Banking FAQs · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.