Chip and Pin liability - some clarity

Since Watchdog have raised this ...

I have emailed the financial ombudsman to get some clarity on the position of liability for different types of cards. They have responded that they believe my understanding to be correct. If you wish to PM me - I can forward the content of the email - but it's not that interesting.

Just quickly before I post this - I'm not a lawyer, merely someone who has read the financial ombudsman's website, read the appropriate portions of the act and communicated with the FO. Do not take this as legal advice.

This is what I sent to them:

1. If you use a credit card - you are never liable, providing you did not authorise someone to make the transaction or did not personally authorise the transaction, for more than £50.
2. If you use a debit card - and the card is used while within an overdraft or fraudulently takes you into an overdraft - you will not be liable for more than £50 based on the same premise as above.
3. If you use a debit card - and the card remains outside the overdraft
   - you are as liable as the card terms and conditions/banking code set out - which based on the banking code should only be £50.
4. Prepaid credit cards would count as the same as 3

The key points here are that when your card is used to issue credit - either through the form of a credit card or a debit card accessing your overdraft - you are covered under section 84 of the Consumer Credit Act which makes no mention of increased liability due to negligence.

It is also important to note that under the banking code - the wording was changed from 'grossly negligent' to 'without reasonable care' with regard the level of responsibility the person had to take over their pin. The change in wording was not intended to change the level of neligence, merely to make the wording more accessable. However, some providers are taking it this way and the financial ombudsman is trying to get this changed back or to a more suitable wording.

The appropriate section of the act is detailed below:

http://www.johnantell.co.uk/CCA1974.htm

84 Misuse of credit-tokens

(1) Section 83 does not prevent the debtor under a credit-token agreement from being made liable to the extent of £50 (or the credit limit if lower) for loss to the creditor arising from use of the credit-token by other persons during a period beginning when the credit-token ceases to be in the possession of any authorised person and ending when the credit-token is once more in the possession of an authorised person.

(2) Section 83 does not prevent the debtor under a credit-token agreement from being made liable to any extent for loss to the creditor from use of the credit-token by a person who acquired possession of it with the debtor’s consent.

(3) Subsections (1) and (2) shall not apply to any use of the credit-token after the creditor has been given oral or written notice that it is lost or stolen, or is for any other reason liable to misuse.

(3A) Subsections (1) and (2) shall not apply to any use, in connection with a distance contract (other than an excepted contract), of a card which is a credit-token.

(3B) In subsection (3A), “distance contract” and “excepted contract” have the meanings given in the Consumer Protection (Distance Selling) Regulations 2000.

(4) Subsections (1) and (2) shall not apply unless there are contained in the credit-token agreement in the prescribed manner particulars of the name, address and telephone number of a person stated to be the person to whom notice is to be given under subsection (3).

(5) Notice under subsection (3) takes effect when received, but where it is given orally, and the agreement so requires, it shall be treated as not taking effect if not confirmed in writing within seven days.

(6) Any sum paid by the debtor for the issue of the credit-token, to the extent (if any) that it has not been previously offset by use made of the credit token, shall be treated as paid towards satisfaction of any liability under subsection (1) or (2).

(7) The debtor, the creditor, and any person authorised by the debtor to use the credit-token, shall be authorised persons for the purposes of subsection (1).

(8) Where two or more credit-tokens are given under one credit-token agreement, the preceding provisions of this section apply to each credit-token separately.

EXCEPTIONS

As with everything - there are exceptions.

Firstly - if the fraud is commited with a debit card - and you are not in your overdraft and the fraudster does not take you into your overdraft - you are as liable as the banking code makes you. This *should* be £50. However, because the wording is unclear - it may prove harder.

Secondly - all of this protection is wiped out if you give the credit card/debit card to someone else and authorise them to use it. If they make transactions which you did not authorise - you will still be liable because you gave it to them in the first place.

Third - you may have problems if the bank can prove that the chip is read, since it has not yet been shown that the chip can be cloned. As such that would suggest that it was the actual card that was utilised and this will make your story harder to prove. However, if you can be certain the card has never been out of your posesssion and no family member/friend has had access to it, you can use the Watchdog example of how a fraud might be commmited. Although it's worth noting that the complications involved in this form of fraud are extreme.

Conclusion

It's quite simple - if you use your plastic card for credit - then negligence with a PIN is not, by itself, a reason for the bank to refuse to refund your money. You may still be held liable for £50 - but that is all the Consumer Credit Act allows them.

Providing you didn't hand your card out - then if your bank is refusing to pay out - quote the law at them - threaten to take them to the Financial Ombudsman - and if they still won't pay out - DO IT! But please bare in mind the liability I set out at the top of this post because you'll only waste your own time if you've given the card to someone else and they've allowed the fraud to take place.

The examples and information from the Ombudsman is here:

http://www.financial-ombudsman.org.uk/publications/ombudsman-news/46/46_plastic_cards.htm

It is worth reading this page - especially the examples to see how the FO regards liability and responsibility.

The complaint form for the Ombudsman is here:

http://www.financial-ombudsman.org.uk/consumer/complaints.htm

Perhaps we can put this to bed now?

M.