skip tocontent

ombudsman news

issue 89

October/November 2010

banking complaints about disputed debit card transactions

We regularly receive banking complaints involving disputed debit card transactions. Typically, the consumer says that their current account was debited with transactions they did not make. However, the bank refuses to refund the amount in dispute, saying the consumer must have known about the transactions as they were carried out with a genuine card and the correct PIN.

Our approach when dealing with these disputes is set out on our website, in the note on disputed transactions in our online technical resource. The precise questions we will ask depend on the circumstances of the individual case but are likely to cover the whereabouts of the consumer at the time of the disputed transaction, their previous use of their card, and how the transaction was verified (for example by inputting the PIN). Information we will require from the bank normally includes, among other things, its electronic audit trail for the disputed transaction and for any related transactions (such as balance enquiries) that preceded or followed it.

It is not uncommon - in cases of this type - for consumers to assume they must have fallen prey to fraudsters. There are often reports in the press about scams involving plastic cards and about the ever-more sophisticated electronic devices used by criminals to access bank details. When looking into the cases referred to us we will certainly consider the likelihood that some kind of scam may have been employed. However, in the vast majority of the cases we see, there is a far more down-to-earth explanation for the disputed transactions.

As the following case studies illustrate, our investigations sometimes reveal that the bank has made a straightforward error. And we sometimes find that the consumer was careless with their card and PIN or had genuinely forgotten that they had, after all, carried out the transaction themselves or authorised a friend or relation to do so.

89/05
consumer queries unauthorised transaction on his current account

An elderly consumer, Mr M, asked his bank to explain why a cash withdrawal of £150 had been debited from his current account. Mr M said he had never withdrawn the money. However, the bank told him the transaction had been carried out using his debit card and the correct PIN. The bank therefore thought it probable that Mr M had withdrawn the money himself, and then forgotten about it.

Mr M denied this and said he would certainly have remembered withdrawing such a large sum in cash. The bank then suggested that he might have 'lent' his card and PIN to someone else, perhaps so that they could obtain some cash on his behalf.

Mr M later told us that, by this time, he had become 'very frustrated by the bank's refusal to accept that it might have made a mistake'. He said he was worried that 'even more money might disappear' from his account in the same way. And he was concerned that he would be unable to convince the bank that he had not taken the money himself. Unable to resolve the issue with his bank, Mr M came to us.

complaint upheld
We established that a pension payment of just over £100 was credited to Mr M's current account on 23rd of each month. And on the following day he always withdrew exactly £100 from the same cash machine in his home town. It was generally the only withdrawal that Mr M made from this account.

The disputed transaction had been made just after 2pm on a Thursday afternoon in Cambridge, some 45 miles away from Mr M's home. Mr M had already told the bank that his card had never left his possession, so we asked if he could confirm where he had been on the day in question.

Mr M provided a statement from Mrs G, the manager of a charity shop situated close to where he lived. She said that Mr M had been on the shop's rota of volunteers for several years - and that he always helped out on Mondays and Thursdays. She kept detailed records and was able to confirm that he had been working in the shop on the day of the disputed transaction. She said that 'as usual' that day, he had come in at 11am and worked through until just after 1.30pm.

The bank had not been able to produce any evidence that Mr M had been careless with his card or his PIN. But it sent us information that it said provided 'clear proof' that Mr M's card and PIN were used to make the withdrawal. After making an independent assessment of this information, we decided that this 'proof' was not as convincing as the bank had suggested.

On the basis of all the available evidence, we concluded that Mr M had neither withdrawn the money himself nor given anyone else the means to do so.

We upheld the complaint and said the bank should refund the £150 to Mr M's account. We said it should add interest at 8% per annum, for the time the money was missing from the account. We said the bank should also pay him £100, to reflect the distress and inconvenience he had been caused.

89/06
consumer reports unauthorised transactions on his current account after the theft of his wallet and plastic cards

Mr A contacted his bank and asked it to cancel his cards after he discovered that his wallet had been stolen. In addition to a credit card issued by the bank, there had been two debit cards in his wallet - one for his 'main' current account, held jointly with his wife, and the other for the current account, held in his sole name.

Not long afterwards he was concerned to find that transactions he did not recognise had been debited from the current account held in his sole name. These transactions totalled £1,552.58 and included purchases made in several shops, together with two cash machine withdrawals.

The bank told him there was nothing to indicate that any of these transactions had been fraudulent. They had all been carried out by someone using the correct card and PIN.

Mr A told the bank he was upset by the implication that he had carried out the transactions himself. He said he was always careful with his PIN and could only conclude that a fraudster had made a 'lucky guess' or had 'somehow found the PIN from information stored electronically in the card or the cash machine.'

The bank thought the most likely explanation was that Mr A had left a note of his PIN with the card. And it insisted that as there was no evidence of fraudulent activity, it was unable to refund the disputed amount. Mr A then referred his complaint to us.

complaint not upheld
Mr A provided evidence that he had reported the theft of his wallet to the police - and that he had asked for all his cards to be cancelled. Unfortunately, because there had been some delay before Mr A realised his wallet was missing, the disputed transactions had already been made by the time he contacted the bank.

These transactions were all made with just one of the cards - the debit card for Mr A's personal current account. We noted that Mr A did not use that account at all frequently and it was over eighteen months since the debit card had last been used.

Mr A had told us that he had a different PIN for each of his cards. We noted, from the audit trails and other information supplied by the bank, that an attempt had been made to withdraw money using each of the cards in the stolen wallet in turn.

In each instance, only one PIN had been entered - the same PIN that had eventually proved successful when used with the debit card for Mr A's personal account.

After considering all the evidence, we thought it very unlikely that the thief had either guessed the correct PIN or obtained it by any technological means.

We accepted that Mr A had not made the disputed withdrawals himself. But we thought that he had probably written down the PIN for the card he used with his personal account (the card he used least often) and kept it, with the card, in his wallet. The thief was then able to try the PIN with each of the cards in the wallet until he found the card it worked with.

We decided that the disputed transactions had only been possible because Mr A had not taken reasonable care of his PIN. We did not uphold the complaint.

89/07
consumer reports suspected fraud after unauthorised cash withdrawal from her account

Miss L complained that her bank would not reimburse her for a cash withdrawal of £250 that she insisted she had neither made nor authorised. The money had been withdrawn from a cash machine inside her local supermarket.

She admitted visiting the store around the time the transaction had taken place. However, she said she had only used her card to pay for groceries - not to withdraw cash.

Miss L told the bank that she thought fraudsters must have targeted that particular store, as a friend had a similar experience. She said he had been to the same supermarket a day or so earlier - and later discovered that unauthorised cash withdrawals had been debited from his account.

The bank told Miss L that whoever had made the disputed withdrawal from her account had used the correct PIN. The bank therefore concluded that she had either carried out the transaction herself or otherwise authorised it. Unhappy with this response, Miss L brought her complaint to us.

complaint not upheld
It was clear from the audit trail provided by the bank that Miss L's debit card and PIN had been used for the disputed transaction.

We asked Miss L if her friend was willing to tell us more about his own experience involving the same cash machine. Miss L said he did not want to get involved, as he was now 'not certain exactly which cash machine had been used.'

We noticed that just ten minutes before the disputed withdrawal, Miss L's debit card was used at a self-service checkout machine in the same store, to pay for some groceries. That transaction appeared on the same bank statement as the cash machine withdrawal and had not been disputed.

The bank confirmed that there had been no other reports of suspicious activity at that particular cash machine. And Miss L's longer account history showed that it was not uncommon for her to use that cash machine shortly after buying groceries in the store with her debit card. The amounts she withdrew in cash generally varied between £200 and £250.

We concluded from the evidence that there was nothing to support Miss L's claim that she had neither made nor authorised the disputed withdrawal. We did not uphold her complaint.

89/08
consumer complains of poor service and inadequate compensation after bank debits her account with unauthorised transactions

As soon as she discovered that her purse had been stolen, Ms T rang her bank and asked it to cancel her debit card. Several weeks later she checked her bank statement and saw that the bank had debited her current account for two transactions that she did not recognise. The transactions, totalling £279.42, were made after the bank had told her that her card was cancelled.

After investigating Ms T's complaint, the bank eventually accepted that the transactions had been fraudulent.

It refunded the money to Ms T's account but she remained far from happy. She said the bank had taken 'far too long to grasp what had gone wrong'. She also complained that it had taken several weeks to send her the forms it had required her to complete before it would investigate the problem.

The bank offered Ms T £100, in recognition of the inconvenience she had been caused. Ms T thought £150 would be a more appropriate sum. She said that the transactions would never have been made if the bank had acted more promptly to cancel her card. So she thought the bank should have refunded her account as soon as she queried the transactions, rather than spending time on an investigation. When the bank refused to increase its offer of compensation, Ms T came to us.

complaint upheld

We noted that the disputed transactions had been made some while after Ms T reported her card stolen. We were therefore satisfied that she should not have been held liable for them.

We also noted that there had been a delay of over three months before the bank finished its investigation and re-credited Ms T's account. The bank was unable to explain this delay.

In the circumstances, we agreed with Ms T that the bank should pay her £150, in recognition of the inconvenience it had caused her.

89/09
disputed transaction made with debit card

Mr C complained to his bank when he found a debit card transaction that he did not recognise on his bank statement. A payment of £27.50 had been made in an off-licence in the town where he lived.

Mr C said he had never visited that particular off-licence and he asked the bank to refund his current account for the amount it had 'debited in error'.

The bank told him the payment had been made using the correct PIN with his bank card. The transaction had taken place just after 8.30pm on a Saturday evening - and the bank suggested that Mr C might simply have forgotten that he had visited the off-licence that evening.

Mr C again insisted that he had not made the payment. The bank then told him it could only conclude that he had authorised someone else to carry out the transaction. Mr C strongly denied this and he asked the bank to carry out a more detailed investigation. When it refused to do this, Mr C brought his complaint to us.

complaint withdrawn
We asked Mr C if he had any evidence that would show he could not have been in the off-licence when the disputed transaction took place.

He told us he had been playing in a five-a-side football game at the local leisure centre that evening. He gave us details of the timings of the fixture and said we could check that he had been playing if we contacted the match organisers, the other team members - or indeed anyone who had been watching the game.

He also told us he had been accompanied to the match by his teenage son and the son's classmate, who had gone along to support the team.

We looked at the audit trail for the disputed transaction, together with related information provided by the bank. We were satisfied from this that the payment had been made with Mr C's genuine card.

The PIN for that card was the day and month of his son's birthday. And whoever used the card for the disputed payment had entered the correct PIN at the second attempt.

Mr C said he was sure the only explanation was that someone had 'cloned' his card. But the facts of the case did not suggest to us that this was such a sophisticated fraud.

The transaction had taken place not long after the start of the football match - and in an off-licence just five minutes away from where the match was taking place. It was a relatively modest transaction and whoever used the card had entered the correct PIN on the second attempt.

We phoned Mr C to discuss the case. As a result, he told us he would make some enquiries of his own. The following day he rang us to say he no longer wished to pursue his complaint.

image of ombudsman news

ombudsman news gives general information on the position at the date of publication. It is not a definitive statement of the law, our approach or our procedure.

The illustrative case studies are based broadly on real-life cases, but are not precedents. Individual cases are decided on their own facts.