A bank customer was not liable for the entire loss after BankID fraud
Supreme Court judgment 13 September 2022, HR-2022-1752-A, (case no. 22-025299SIV-HRET), civil case, appeal against judgment.
Sparebank 1 Østlandet (Counsel Olav Fredrik Perland) v. A, The Norwegian Consumer Council (intervener) (Counsel Amund Noss) (Assisting counsel Asle Bjelland)
A bank customer had in a telephone conversation been tricked into giving her BankID password and codes to a person she perceived to be a representative of the bank. Under the BankID agreement, she was obliged not to reveal code and password to any one – including the bank and the police. The Supreme Court found like the Court of Appeal that the bank was nonetheless liable for the loss of NOK 153 240. Based on the wording and structure of section 35 subsection 3 of the Financial Contracts Act, the customer also had to have been aware of the breach to be liable for the entire loss. This condition was not met, as she had thought that she spoke to a representative of the bank, and in the relevant situation, she was not aware that she could not give the codes and password to the bank's employees. Since she had been grossly negligent, she was liable for a sum of NOK 12 000.
Area of law: Financial contracts law. Section 35 subsection 3 third sentence of the Financial Contracts Act.
Key paragraphs: 50-51
Justices: Indreberg, Falkanger, Arntzen, Bergh, Høgetveit Berg