Fraud on newphew card

starM

Hi, My brother in law just passed the information to me and a letter from HSBC. During 4th May to 8th May total £893.84 was taken from his sons bank account via debit card used at Morrisons Patrol, Asda patrol and Shell. HSBC statement is showing dates from 9th May to 10th May so possible these may be the dates when transaction appeared on his bank statement. He has not used the card. He is only 18 years old and do not use the account too much aswel. He do not drive and only passed his driving test 2 days ago. Parents transfer money to his account cover when needed as they also bank with HSBC. They reported the fraud to HSBC and received a letter today dated 18 June which is as follows:-

When originally disputed the transaction, you claimed:-

• You keep your card in your pocket
• No-one else had access to your card details
• You live with your family
• You have memorised the PIN after destroying the PIN advice, you have not shared this with anyone.
• You did not realise this was missing until 8 May 2012.

I have noted the card used during these transactions was issued to you on 15 September 2009, and you held the same PIN on this card since changed it to a number of your choosing on 25 January 2011.

The transactions you have disputed were Chip and PIN verified. This means the unique chip embedded within your card was read during the transaction and your PIN used to authorise them, which rules out the possibility of these being undertaken on a counterfeit or cloned card. In other words, whoever made these transactions had your card and knew your PIN.

You have already confirmed you had lost your card, but as you claim your PIN was memorised and had not been disclosed then I do not understand how these transactions were possible.

I have ruled out the possibility of someone observing your PIN and then taking your card, as your last genuine transaction was a week before the first transaction you have disputed. It is highly unlikely an unknown third party would have waited a week to use your card if they had stolen your card after observing you enter you PIN on 27 April 2012.

In your letter you have inferred that Bank should be trying to view CCTV, so perhaps I should mention it is not the Bank’s responsibility to identify the person who has undertaken the transaction, but to determine who should be responsible for the transaction, based on how the transactions could have occurred. Besides which, CCTV would only show who made the transaction, and not prove you did not authorise it.

I find it a noteworthy coincidence a credit was paid into your bank account less than an hour before the first disputed transaction occurred, taking your account from an overdrawn position into credit, which enabled disputed transactions to occur.

For the reasons given above, it is my view you either undertook the transactions yourself, or allowed a third party person to do so. Therefore you will remain responsible for these transactions.

While I appreciate that my decision not to refund the amount of the disputed transactions may come as disappointment to you, I trust I have satisfactorily clarified the Bank’s position.

However, although this case is now considered closed, if there is any significant information which has not previously been communicated, and which you feel should be taken into consideration, please write to the Appeal Manager know, at the address within 21 days.

If you are not satisfied with this response, you can also refer your complaint to the Financial Ombudsman Service. Further details about the Ombudsman Scheme are set in the enclosed leaflet and you have six months from the date of this letter within which to refer your complaint to them, Clearly, I hope that you will not find this course of action necessary.

---

Can anyone help with this please? Thanks MS

TheBanker

Do you have more info on the transactions? I'm puzzled as to how someone can spend nearly £900 on petrol in a few days, even with prices as high as they are!

Also is there any 'proof' available that your nephew couldn't have made the transactions, e.g. proof he was somewhere else?

You say that his parents transfer funds as and when needed, and it seems a transfer was made just before the fraud took place. Why was the transfer made and was it in keeping with similar transfers?

timbo58

If it's for petrol then surely there is a direct tie up between which pump was used and which vehicle registration was at that pump at the time?
I though they all did this to prevent drive-offs without payment?
I think it perfectly fair to request this and clearly the bank feel their assumptions and the oddities of the transactions outweigh their need to actually spend their own money investigating this matter as it would/should be if there were more in your nephews favour in the circumstances surrounding this.

The problem is here is that there is an allegation of theft: the bank clearly are regarding this as an attempted false claim and the police will therefore not be interested: it annoys me that the police/CPS do not take these matters seriously.
IMHO it would be better if the banks and the police took alleged theft as a serious matter and investigated properly, this would both prevent actual acts of theft and false allegations as both would end up in court rather than just being brushed under the carpet by the banks as a civil matter and genuine cases being ignored by an arrogant bank.

It is dodgy that they are claiming the chip and pin was used and to be fair, all petrol stations use chip and pin, so it's obvious the thieves have the pin number in any case.

A transfer made to credit the account before any disputed payments is not the least bit odd and I am surprised the bank are seeing it as so: I see no correlation that infers this should be regarded as suspicious.

I would assume that the card has been used by multiple people as another poster has stated £900 in 3 days is too much to be one person with one vehicle refuelling.

If your son is definite that he has not used the card or allowed it's use (even by coercion and it's worth being very sensitive to find out whether bullying is an issue here) then wherever he used it before the disputed payments is absolutely crucial.

As the bank has said it is unusual for there to be a large gap between when the card goes missing and when it is misused, this is true, although it's hardly definitive.

When I had my card cloned and a CCTV was used to reveal my PIN it was at an independent petrol station, they then used the cloned card within 2 hours extensively, this is a 'normal' misuse scenario as an example.

Best advise is for Nephew to open a new account at another bank for any more credits to go into, and in the meantime change his PIN immediately to prevent this reoccurring, escalate the matter and keep up the pressure for the bank/police to make a proper investigation and to keep his ear to the ground in his social circle as someone knows something and he'll hear whispers eventually as thieves like to boast.

TheBanker

timbo58 wrote: »

A transfer made to credit the account before any disputed payments is not the least bit odd and I am surprised the bank are seeing it as so: I see no correlation that infers this should be regarded as suspicious.

If I was dealing with the claim I might ask further questions about this. The OP said that the account is funded by the nephew's parents as and when required. If the normal pattern is that the account sits empty, and when credits arrive they are spent straight away, this situation would cause suspicion. I would be asking the OP's nephew why the credit was arranged; if it was to cover spending then why did he not notice the card was missing straight away?

I think the nephew will have to make a complaint to the ombudsman (and be prepared for a 6 - 9 month wait for a decision). The FSA's Banking Conduct of Business sourcebook says:

Firm's liability for unauthorised payments
BCOBS 5.1.11

(1) Where a banking customer denies having authorised a payment, it is for the firm to prove that the payment was authorised.

(2) Where a payment from a banking customer's account was not authorised by the banking customer, a firm must, within a reasonable period, refund the amount of the unauthorised payment to the banking customer and, where applicable, restore the banking customer's account to the state it would have been in had the unauthorised payment not taken place.

Banking customer's liability for unauthorised payments
BCOBS 5.1.12

(1) Subject to (2) and (3), a firm may, in an agreement for a retail banking service, provide for a banking customer to be liable for an amount up to a maximum of £50 for losses in respect of unauthorised payments arising:

(a) from the use of a lost or stolen payment instrument; or

(b) where the banking customer has failed to keep the personalised security features of the payment instrument safe, from the misappropriation of the payment instrument.

(2) A firm may, in an agreement for a retail banking service, provide for a banking customer to be liable for all losses in respect of unauthorised payments:

(a) where a banking customer has acted fraudulently; or

(b) (subject to (3)) where a banking customer has intentionally, or with gross negligence, failed to comply with his or her obligations under the agreement for the retail banking service in relation to the issue or use of the payment instrument or to take all reasonable steps to keep its personalised security features safe.

So I wonder what evidence, if any, the bank have to back up their claims? An ombudsman will look at what is most likely to have happened. One person buying £900 of petrol in a couple of days, from different filling stations? Unlikely, I would have thought.

SnowTiger

starM wrote: »

You have already confirmed you had lost your card, but as you claim your PIN was memorised and had not been disclosed then I do not understand how these transactions were possible.

My guess is that a mate took the card and handed it around or sold it on with the PIN. I'd also guess your nephew's PIN was easy for someone who knows him to work out. Year of birth, day and month of birth, etc. People tend to use the same password/PIN for lots of things - mobile phone, games console, etc.

TheBanker

SnowTiger wrote: »

My guess is that a mate took the card and handed it around or sold it on with the PIN. I'd also guess your nephew's PIN was easy for someone who knows him to work out. Year of birth, day and month of birth, etc. People tend to use the same password/PIN for lots of things - mobile phone, games console, etc.

Nephew could ask HSBC whether the correct PIN was used on the first attempt or whether there were any failures. The answer might not help his claim though, except if there were 2 failures and then a success, it indicates someone was potentially guessing.

SnowTiger

TheBanker wrote: »

Nephew could ask HSBC whether the correct PIN was used on the first attempt or whether there were any failures. The answer might not help his claim though, except if there were 2 failures and then a success, it indicates someone was potentially guessing.

Dunno how helpful that would be. It sometimes take me two or three attempts to hit the right PIN.

I think the OP's nephew's only option is the FOS now as the bank seems to have come to its final decision. Chip and PIN is considered to be secure, so there could be big repercussions if the FOS found against the bank.

TheBanker

SnowTiger wrote: »

I think the OP's nephew's only option is the FOS now as the bank seems to have come to its final decision. Chip and PIN is considered to be secure, so there could be big repercussions if the FOS found against the bank.

Not really - FOS could find that Nephew was a victim of 'shoulder surfing' quite easily, or that a friend guessed his PIN. I think this has a reasonable chance at FOS. To be honest in the circumstances, if I worked for the bank I may well not have defended this case in order to avoid the case fee.

MPH80

I think there are two key questions:

1) Has the card always been in his possession (never EVER out of it)?
2) Does he still have it?

If the answer to 1 and 2 are yes - then the valid challenge back to the bank is to prove they were chip and pin transactions.

There are certain records from the cryptographic transaction that takes place that prove it was done with the chip - those should have been stored by the bank. I can't remember the name of them right now - but I'll edit this post if I find them.

If they can't find those markers - then it was a mag stripe transaction.

However, if they can find them and your nephew still has the card then that suggests it was a mate and it was out of his possession for a period of time.

agrinnall

MPH80 wrote: »

I think there are two key questions:

1) Has the card always been in his possession (never EVER out of it)?
2) Does he still have it?

If the answer to 1 and 2 are yes - then the valid challenge back to the bank is to prove they were chip and pin transactions.

There are certain records from the cryptographic transaction that takes place that prove it was done with the chip - those should have been stored by the bank. I can't remember the name of them right now - but I'll edit this post if I find them.

If they can't find those markers - then it was a mag stripe transaction.

However, if they can find them and your nephew still has the card then that suggests it was a mate and it was out of his possession for a period of time.

Did you actually bother to read the OP? Everything you have questioned has already been stated there - the transactions were C&P verified, and the card has been lost.

starM

Hi, Thanks for replying back,

Transactions on the staement are:-

27/04/12 ATM Cash lloyds £20 at 13.07 (Not disputed)
04/05/12 at 15.24 Credit paid in £15 (Not disputed)
04/05/12 at 16.17 £100 Morrison Patrol
04/05/12 at 16.35 £75.21 Asda Patrol
04/05/12 at 17.01 £23.79 Asda Patrol
05/05/12 at 00.44 £99.00 Asda Patro
05/05/12 at 19.50 £100 Morrisins Patrol
05/05/12 at 19.42 £98.94 Shell
06/05/12 at 00.03 £28.93 Asda Patrol
06/05/12 at 00.39 £70.07 Asda Patrol
06/05/12 at 15.24 £100 Morrisons Patrol
07/05/12 at 00.41 £70 Asda Patrol
07/05/12 at 00.24 £29.00 Asda Patrol
08/05/12 at 3.20 £19.00 Asda Patrol
08/05/12 at 4.44 £79 Asda Patrol

To start with the account was overdrawn by small amount 10.27 so he went into the branch and paid in £15. Previously he had EMA paid into this account but thats been stopped aswel. So parents just transfer sometimes £20 or £30 into the account to cover his expenses - still studying. I would have guess so bank should have realised on 4th May that the card may have been used fraudently as these types of traansactions have never occured so they were unusual pattern based on conduct of his account but that was not done. I think he had the card when cash was paid on 4th May as just an hour later the card the was used - I will double check with my nephew.

I dont think their any point writing to HSBC but will go to FOS. Should I also send a letter to HSBC advising them of my next action and ask them to hold any recovery action? Do not want to distroy nephews credit cardit - his only 18 his got long way to go yet. Dont want they put any default on his credit report and pass the data to private DCA.

Regards