Lloyds credit card - bad for fraud, any advice?

susan47

Last Easter my son went to Eastern Europe on holiday. While there, somebody took £5k from his credit card - three large amounts of cash over just several minutes. It appears that his card was used and the PIN number was known, but how could that happen when he said the card never left his side, and it was in a different location to where he was? (Same city, different area.)

Lloyds TSB said he must have done it or given it to someone. They refused to refund him. So he went to the Ombudsman, and just yesterday they said that if he can't prove how it was done (!) then they will have to rule in Lloyds' favour. Basically, they say he must have been at the location and he's a liar.

Now, withdrawing cash like this is totally out of character. He has a witness to say he wasn't there, he was somewhere else. Also, he is actually a newly qualified lawyer with a top London firm and it dosen't do his reputation much good to have this ruling against him.

Clearly, Lloyds TSB don't want to admit that their system is flawed and this could have happened as it would open the floodgates for more claims. However, he didn't do it and now's he's £5k down. I don't suppose anybody would have any suggestions? Or are we really at the end of the road? It just seems so unfair.

Thanks for any suggestions - and I'd avoid Lloyds if you are travelling abroad!!

Mips

If he is innocent, I don't understand why he hasn't spoken to someone in authority in the Solicitors he works in?

They are the best to advise

cooltt

What's the Ombudsman ruling got to do with him being a lawyer? it's not a criminal offence to have your card cloned plus Lloyds are quite correct in taking this stance, if he can't prove he didn't take the money why should Lloyds believe that it wasn't him? would you if it was your bussines.

It's a harsh reality of life i'm afraid, the simple fact is 99% of the time when you are a victim of cc fraud it is because you have been careless with the card.

It's a hard lesson to learn.

susan47

He's a commercial property lawyer, and I guess in this economic climate he's lucky to have a job. He'd have to go to somebody senior in another department, and it's just awkward. I asked him to do that before but he said he didn't think he could.

susan47

He wasn't careless with the card, it never left his side. That's the point.

You see, there is a way that crooks can make it look like they used your card, I'm sure of it as it happened here, and in that case we should all be worried because it could happen to you too.

The fact is, he wasn't even at the location where it happened. He has a witness (a reputable friend who actually won an award when working with the Met Police). To have this slur on his character is just appalling (and to be £5k down as well.)

Like I said, we should all be very worried. The criminals must know they can get away with this and innocent people like us are lining their pockets!

clb776

why cant they get the camera footage from the cash machine? I thought all atms had cctv ?

Mips

susan47 wrote: »

He's a commercial property lawyer, and I guess in this economic climate he's lucky to have a job. He'd have to go to somebody senior in another department, and it's just awkward. I asked him to do that before but he said he didn't think he could.

Well he really should - else he should stump up the 5k

Solicitors aren't whiter than white

susan47

To clb776: It wasn't done at a cash machine, it was in a shop and they took £2k out then another £2k then another £1k, in the space of just minutes. Does that look like something the cardholder would do though? You'd think it was obvious it was fraud. Also obvious it was done by the shop owner somehow (linked to the shop that he was really in, some distance away.) But that's just our theory.

To Dippychick: I hope you're not suggesting that he really took the money himself. So many people dislike lawyers - he's barely qualified and has a pile of student debt, but he wouldn't stoop that low!

bert&ernie

So the transactions were retail purchases not cash withdrawals? This is a little unusualy as most of these cased involve ATMs and are know as 'Phantom Withdrawls'

The difficulty you have is that the bank are asserting that the chip was read and the PIN supplied. In theory, it should be possible for the bank to prove this cryptogaphically, but in practice this doesnt happen - the ombudsman invariably takes the bank at its word. A recent court case against Halifax also failed even though the bank admitted to destroying the data and the card

If the ombudsman has ruled against your son, then I think the only remaining option is to start court proceedings against the bank.

If your claim is for under £5K then it may be possible to deal with it through the small claims track. In which case you would not normally be expected to pay the the other parties costs if you lose. However, if it gets allocated to a different track the legal costs could end up being eyewatering. This is why so few 'phantom withdrawl' cases go to court.

I think your son either needs to write it off to experience or get some specialist legal advice pronto.

jaxo

cooltt wrote: »

What's the Ombudsman ruling got to do with him being a lawyer? it's not a criminal offence to have your card cloned plus Lloyds are quite correct in taking this stance, if he can't prove he didn't take the money why should Lloyds believe that it wasn't him? would you if it was your bussines.

It's a harsh reality of life i'm afraid, the simple fact is 99% of the time when you are a victim of cc fraud it is because you have been careless with the card.

It's a hard lesson to learn.

I take it you haven't been a victim of card fraud then?
You also have to remember that some companies you deal with can be careless with your details too, how do you know mail order details are shredded etc?
I'm super anal about security on my card, yet while I was abroad my account address was changed, security questions answered, apparently - though no hard proof, security code must have been used to order lots of expensive things online etc in the UK.
My case might have been easier to prove, though I got the suspicious tone from TSBLloyds fruad team.
I think there is an expert in card and pin cloning that could be helpful, there was a programme filmed in Cambridge the other year where they were able to clone a card from a dodgey pin and chip machine or the wireless versions? I can't remember the programme, anyone?
They too were raising the issue of since pin and chip the onus has shifted to prove your innocence, since the industry won't admit to security floors in the pin and chip system.

5K is a hell of a lesson!
I thought if the card is still in your possession you are only responsible for the first set amount, and mostly that's waived.

bert&ernie

jaxo wrote: »

I take it you haven't been a victim of card fraud then?
You also have to remember that some companies you deal with can be careless with your details too, how do you know mail order details are shredded etc?
I'm super anal about security on my card, yet while I was abroad my account address was changed, security questions answered, apparently - though no hard proof, security code must have been used to order lots of expensive things online etc in the UK.
My case might have been easier to prove, though I got the suspicious tone from TSBLloyds fruad team.
I think there is an expert in card and pin cloning that could be helpful, there was a programme filmed in Cambridge the other year where they were able to clone a card from a dodgey pin and chip machine or the wireless versions? I can't remember the programme, anyone?
They too were raising the issue of since pin and chip the onus has shifted to prove your innocence, since the industry won't admit to security floors in the pin and chip system.

5K is a hell of a lesson!
I thought if the card is still in your possession you are only responsible for the first set amount, and mostly that's waived.

You are thinking of Professor Ross Anderson. The Cambridge Security Research team blogs here. My previous post contains links to a site dedicated to Phantom Withdrawals and details of a recent case.

Incidentally, nobody has seen a cloned EMV (chip & pin) card 'in the wild' i.e. outside of a lab. The attack that I think you are referring to is a 'relay attack' as described here. Again, to my knowledge, nobody has seen this attack undertaken in the wild by fraudsters. This isn't to say that there aren't plenty of theoretical weaknesses in the EMV standard.

By far the most common EMV attack is a compromised terminal that records magstripe equivalent data and the PIN - this is then used to create a magstripe card that can be used to withdraw cash at an ATM, typically overseas in a non-EMV jurisdiction. Banks are generally good at refunding this type of fraud.

However, this is not what appears to have happened to the OP's son. The bank are sticking by their assertion that the transaction was authenticated and authorised using a genuine chip card and PIN. The most likely explanation, from the banks point of view, is that the cardholder either knowingly or negligently allowed this to happen.

This dispute is at an advanced stage - the ombudsman having ruled against the OP's son. It is not normally possible to appeal an ombudsman decision so the next step would appear to be litigation. This is a very big step to take and one that should not even be contemplated without taking professional advice.

In an ideal world, it would be up to the bank to prove, beyond doubt, that a customer made the withdrawal. However, in practice the ombudsman and the court tend to take the banks at their word. The lesson here is that you rely on the the ombudsman to fight your corner - you need to be all over it and give them a damned good reason to rule in your favour.