Customers are increasingly being refused a refund after their bank card was stolen or accounts hacked
If a current account is hacked and fraudsters start making purchases and cash withdrawals using the card and pin – intercepted by the crooks – most customers would expect the bank to repay the losses without question.
If a wallet is stolen from a locked car, with the pin heavily disguised, most people would still expect the bank to refund any money withdrawn.
But, despite clear rules that state banks can only refuse to refund a customer if he or she has acted “fraudulently” or had been “grossly negligent”, there is growing evidence that the banks are taking a tougher line and refusing a refund – in some cases for the sole reason the thief used the card with a merchant the account holder had also done business with.
Even in the face of overwhelming evidence that the account holder was miles away at the time, and it could not have been them, some banks have been insisting their customer is liable.
If you are one of millions of people who has written down your pin – even as part of heavily disguised code that only you can decipher – the implications are worrying.
This week Guardian Money was contacted by a Sheffield couple who lost £1,260 after their wallet, plus a mobile phone and a satnav, were stolen from the glove compartment of their locked car. Within a few hours the thief had taken cash out of two HSBC accounts – one personal and one business.
The couple had done what many others do – written their pin in a heavily disguised form on a business card. They say the information would only have meant anything to them, and that they are not even sure the business card was in the wallet.
But HSBC has refused to refund the money, arguing that the couple’s real bank cards (not a clone) and the correct pins were used and that, therefore, they have breached the bank’s terms and conditions and were grossly negligent. Their case is complicated by the fact that a year earlier they had asked the bank to raise their £300 daily ATM cash limit to allow them to take out a higher amount – but just for 45 minutes. The bank has admitted that it failed to return the limit after this time, which enabled the thieves to take more than they would have done normally.
The pair, who have banked with HSBC for five years, say local police have not been interested in their case, indicating this is partly because they expect the bank to reimburse them.
Money has also become aware of other cases in which a bank is persuaded by fraudsters to send out a replacement card and pin reminder, which are then intercepted and used by the thieves. Again, the banks refuse to pick up the losses.
Late last year we were contacted by a Mr Singh, who has been in dispute with Nationwide since 2010. Back then he was working on assignment in Bangalore. He was sent a replacement debit card and a pin reminder to his UK home which is occupied by other members of his immediate family.
However, he says, neither arrived. Instead, someone else started using the card in Mumbai, running up a bill of £3,000. He immediately reported the loss and cancelled the card.
Nationwide initially indicated that he would receive a full refund. But a week later it turned down his claim and accused him of being involved in the fraud. It suggested he knew the person who had used the card, a claim he emphatically denied.
After a year and a half investigation, the Financial Ombudsman sided with Nationwide, at which point he approached us looking for some advice. We put him in touch with a specialist card fraud investigator, Richard Emery, who runs 4Keys International. Within four weeks, he had persuaded Nationwide that Mr Singh had a legitimate claim. The building society did not return his money but, instead, paid him his losses as a “gesture of goodwill”.
Had Emery not intervened, he would have faced a lengthy legal court case, and the possibility that he could be accused of fraud in court.
But the reality is that banks cannot refuse a refund because, on the balance of probabilities, it feels there may have been fraud. It has to prove negligence or fraud, yet in many cases they are now turning down refunds where they have suspicion only.
It is not just Money that has noticed this trend. Last week, BBC’s Watchdog programme featured several similar cases. One Barclays customer found his bank cards had been used by thieves to buy two car tax discs from the DVLA website for vehicles he didn’t own. Barclays insisted he was liable because his hijacked card details had been used with a merchant that he had also used. When he pointed out that anyone with a car had to buy a tax disc it cut no ice, although Barclays later refunded him in full.
Another NatWest customer lost £18,000 when a fraudster rang the bank and persuaded it to change his address from a house in Slough to another in Nottingham, and asked for a new card and pin to be sent.
In his case, NatWest agreed to refund the £5,000 that had been moved out of his account electronically, but refused to hand back £13,000 in purchases and cash withdrawals. Even though he could show that he was out of the country at the time they were made NatWest argued that, because the purchases had been made by his exact card and pin, he was liable. Following the BBC’s intervention it has now repaid his money in full.
Richard Emery, who appeared on Watchdog, says that where a customer disputes a transaction there is an onus on the banks to prove that the payment was authorised by them.
The Financial Services Authority’s Banking Conduct of business states that a bank may only hold a customer liable … where the customer has acted fraudulently, or has “intentionally, or with gross negligence, failed to comply with his or her obligations … to take all reasonable steps to keep its personalised security features safe.”
Emery argues that it is quite possible for a customer to keep the card and pin safe, but for a fraudster to obtain them – or just the card details – through other means, which they then use to perpetrate the fraud. In such cases, the bank must repay the customer in full, he says. The Financial Ombudsman Service, where lots of these cases end up, relies on the payment services directive, which came into force in November 2009.
It says that if someone is a victim of fraud, the bank must refund them immediately – unless it has good grounds to suspect that the cardholder has been negligent or acted fraudulently.
A spokesman told Money this week that use of the correct card and pin is not “evidence of negligence in itself. We have always made it clear to financial businesses that just because a pin has been used correctly in conjunction with a card, does not, in itself, mean that the cardholder should be found responsible for the debt.
“We expect to see all the evidence from the financial business demonstrating how it has investigated the disputed transactions and reached its conclusions. We then look at all the evidence from both sides – including the consumer’s recollections – when resolving the dispute.”
Back in Sheffield, there is some partial good news for the couple who had their wallet stolen. HSBC says it recognises it failed to lower the ATM cash limit, so has agreed to refund half of the £1,200 the couple lost.
An HSBC spokesman says the couple admitted to writing their pins on the back of a card held in purse which, even if in a disguised form, is against the account’s terms and conditions and is “considered negligent”.
He says the bank had declined the rest of their claim because it was told there was no damage to the car when it was broken into. Having looked at the ATM withdrawal pattern of both cards, the bank concluded that it was highly unlikely that a thief could have been shoulder-surfed their pin.
It says there were no incorrect pin inputs, no balance inquiry, and no further attempted withdrawals after the cards were reported stolen.
The worst pin numbers to use
A study by cryptographers at Cambridge University has found that crooks have a one-in-11 chance of guessing your pin number – because so many people just use their birth date.
Researchers examined the real four-digit numbers used by millions of people to lock their phones or access specialist websites.
Patterns immediately emerged. Oddly, the digits 69 occur much more than they should at the end of a four-digit sequence, which perhaps says a lot about what’s on many people’s minds.
“About a quarter of people stick with their bank-assigned random pin, and over a third choose one using an old phone number, student ID or other sequence of numbers which is, at least to a guessing attack, statistically random,” says Joseph Bonneau, a researcher in the university’s computer security department.
But the rest are easier to guess. One in 20 people use a simple numeric pattern such as 4545. One in 10 use a pattern on the entry keypad – which suggests you’d be pretty dumb to pick 1379 or even 2580/0852 (down/up the centre of the keypad). “Unfortunately, the final group of 23% of users chose a pin representing a date, and nearly a third of these used their own birthday. This is a game-changer because over 99% of customers reported that their birth date is listed somewhere in the wallet or purse where they keep their cards. If an attacker knows the cardholder’s date of birth and guesses optimally, the chances of successfully guessing jump to around 9%,” says Bonneau.
He reckons banks should ban a hitlist of 100 bad pin numbers (starting with 1234) which, if eradicated, would prevent nearly all attempts at guessing.
A separate study last year by an Apple iOS developer found that the most common four-digit unlock passwords on iPhones are 1234; 0000; 2580; 1111; 5555; 5683; 0852; 2222; 1212 and 1998. 5863 is the numerical representation for the word “love”.
It seems we are also a bit rubbish at picking passwords. A study last year found that the most common password is … password, with “abc123” not far behind.