The Plaza Vea supermarket chain has been sanctioned by the Peruvian consumer authority following a case of unauthorized credit card charges carried out at the end of 2023. The conflict originated when a client detected two high charges that he never approved and that, despite everything, were processed without the proper verification of his identity.
After several months of administrative proceedings, the Specialized Chamber for Consumer Protection of Indecopi has confirmed a fine of 11,6 Tax Units (UIT), equivalent to S/ 62.060, concluding that the supermarket failed to comply with the duty of suitability by not applying the security measures required for this type of card operation.
How the case of unrecognized consumption was uncovered
The file states that the conflict began on December 31th 2023, when two purchases were processed at a Plaza Vea establishment using a credit card for S / 3.980 y S / 23.789The cardholder subsequently detected these transactions and stated that he had neither made nor authorized them, and that they were completely beyond his control.
Faced with this situation, the consumer filed a formal complaint in March 2024 before the Indecopi Regional Office of La Libertad. In his statement, he maintained that, although the transactions were carried out by inserting the card and using the secret code (PIN), the merchant did not verify at any time that the person who used the payment method was actually the cardholder.
The Commission's Technical Secretariat accepted the complaint for processing through a resolution in May 2024 and charged the company with the alleged violation of article 19 of the Consumer Protection and Defense CodeSpecifically, it was questioned why the establishment had not adopted the security measures required to prevent unauthorized card transactions.
During the proceedings, Plaza Vea presented its discharges in June 2024denying responsibility and arguing that it had acted in accordance with the rules of the financial and retail sectors, given that the purchases were made with the correct entry of the customer's PIN.
After analyzing the documentation, the Commission of the Regional Office of Indecopi of La Libertad It issued a resolution in November 2024 declaring the complaint valid. In addition to the fine of 11,6 UIT, it ordered the payment of the costs of the proceedings and the registration of the infraction in the Registry of Infractions and Sanctions (RIS) of the institution.
Arguments of Plaza Vea and review of the case in the second instance
The company, identified in the file as Food Retail Company SAC – Plaza VeaHe decided to appeal the decision. In his appeal, he argued that he had acted with due diligence because the transactions in question were carried out using the cardholder's secret PIN, information that, in theory, only the customer should know.
The company argued that the The use of a PIN constituted a valid authentication mechanism and that sector-specific regulations did not, in all cases, require additional identity verification when the system confirmed that the password was correct. Furthermore, it cited past rulings from other administrative bodies in which, according to its interpretation, the entry of the password was considered sufficient.
Plaza Vea also questioned the proportionality of the fine and demanded that both the financial penalty and the obligation to assume the costs of the proceedings be waived, insisting that the responsibility for the fraud should not fall on the establishment.
The appeal was reviewed by the Specialized Chamber for Consumer Protection of the Court for the Defense of Competition and Intellectual PropertyThe body that reviewed the first instance proceedings in their entirety. In its resolution, identified as Resolution 2908-2025/SPC-INDECOPI and dated September 15, 2025, the Chamber fully confirmed the Commission's decision.
One of the key points of the analysis was the examination of the payment receipts associated with the transactionsThey only contained the notation "PIN VERIFIED", but did not include basic customer identification data, such as the name or identity document number of the cardholder.
The obligation to verify the customer's identity
According to the Court, the Credit and Debit Card Regulations, approved by the Superintendency of Banking, Insurance and AFP (SBS)This requires affiliated businesses to implement security measures concurrently, not alternately. In other words, verification of the card validity, the verification of the user identity and, if applicable, requesting the customer's signature on the receipt.
Based on this interpretation, the resolution emphasizes that the Use of the PIN does not replace prior and reliable identification of the holderThe fact that the system confirms the key, by itself, does not release the establishment from the obligation to verify who is really behind the card at the time of purchase.
In practice, this means that businesses must strengthen their in-person sales protocols, requesting, for example, the identification document y verifying that the data matches that of the plasticWhen this step is not carried out and, later, unrecognized consumption appears, the responsibility is transferred to the service provider.
The Court recalled that the Article 19 of the Consumer Protection and Defense Code Article 19 of the Credit and Debit Card Regulations establishes that providers are responsible for the quality and suitability of the service offered. In the context of card payments, suitability includes ensuring that the following procedures have been followed: necessary security procedures before approving the transaction.
Therefore, the adjudicating body concluded that Plaza Vea failed to fulfill its duty to properly identify the buyer and, consequently, violated the economic interests of the affected consumer. Since it was not demonstrated that the identification protocol had been followed, the responsibility for the unrecognized transactions falls on the commercial establishment.
Details of the financial penalty and its effects on the company
Regarding the amount of the sanction, the Court upheld the fine of 11,6 UIT initially set by the Commission. It was taken into account that the total amount of the questioned consumption exceeded 4 UIT but was less than 8 UIT, and that the sanctioned company has the status of a large company within the food retail sector.
The collegiate body classified the infraction as instantaneous and did not find mitigating or aggravating circumstances relevant factors that would justify a further reduction or increase of the fine within legal limits were not considered. The penalty, therefore, remained within the limits established by current regulations.
In addition to the fine, the ruling confirmed the registration of the infringement in the Register of Infringements and Sanctions of Indecopi, an element that may be taken into account in future administrative procedures and that serves as a precedent for the company's conduct in relation to consumer regulations.
Indecopi also required the company to voluntary payment of the fine and costs derived from the procedure, warning that, in case of non-compliance, a coercive collection process could be initiated to ensure the collection of the amounts owed.
The case falls within a line of action by the Peruvian authorities that reinforces the requirement of security controls with fraud detection using artificial intelligenceespecially when there is a history of fraud or claims for unauthorized charges. Although the ruling refers to a specific business, the criteria can be applied to other establishments that accept these payment methods.
Relevance of the case for businesses and consumers
Beyond the specific sanction against Plaza Vea, the ruling by the Specialized Chamber for Consumer Protection sends a clear message to the market: Relying on the PIN is not enough or in automated authorization systems to consider that a card transaction is correctly validated.
For businesses, especially supermarket chains, department stores, or electronics stores, the procedure works as a reminder that they must strengthen their internal protocols and apply risk modelsRequiring the presentation of an identity document, verifying that the holder's data matches that on the card, and recording that information on the receipt are steps that, although they may seem cumbersome, become essential when consumer security is at stake.
From the user's perspective, the case highlights the importance of periodically review card transactions and, if it detects an unrecognized charge, Find out how to cancel a card paymentThe actions of the affected customer, in filing the complaint a few months after the events, allowed the authorities to reconstruct what happened and determine responsibilities.
Although this resolution was issued in Peru, the approach is similar to that of many consumer authorities in Europe and Spain, where there is an emphasis on payment service providers and merchants adopting Measures against paytech fraud in Latin America and enhanced authentication measures to minimize the risk of fraud. The regulatory trend is clear: the burden of protecting the customer falls, increasingly, on those who offer and manage payment methods.
The sanction against Plaza Vea becomes a benchmark case regarding the Responsibility of establishments for unrecognized consumption with a credit card. The resolution makes it clear that consumer protection requires more than automated systems: it requires human controls, document verification, and a security culture that, when properly implemented, can prevent both fraud and lengthy administrative and legal disputes.