https://www.bba.org.uk/wp-content/uploads/2011/03/Lending_Code_March_2011_Revised_Dec_2013.pdf
Section 6 Part 138-139
138. If a credit card transaction has not been authorised by the customer then any interest that may have been charged on
this transaction will be refunded unless the customer has acted fraudulently or with gross negligence.
139. Unless the subscriber can show that the customer acted fraudulently or with gross negligence, their liability for their
credit card being misused will be limited as follows:
If someone else uses the card, before the customer informs the subscriber that it has been lost or stolen or that
someone else knows the PIN, the most the customer will have to pay is £50;
If someone else uses the card details without the customer’s permission, and the card has not been lost or
stolen, the customer will not have to pay anything;
If someone else uses the card details without the customer’s permission for a transaction where the cardholder
does not need to be present (e.g buying something over the internet), the customer will not have to pay
anything; and
If the card is used before the customer has received it, the customer will not have to pay anything.