Open letter to Santander: please use contracts that aren't impossible to comply with

dalesrider

pqrdef wrote: »

But seriously, when I leave the house I usually have 5 or 6 cards. But I only memorise two PINs. I can just about remember which PIN applies to which card. There's no way I'm going to memorise half a dozen PINs. Do they want me to write them down on a bit of paper and keep it in my wallet? Or do they want me to leave my Santander card at home and just let that account go dormant?

Writting your PIN is the biggest NO NO.... As is using DOB or tel no.
Fraudsters have a knack of finding these if they steal your wallet/purse.

So NEVER WRITE YOUR PIN DOWN, or keep the pin advice with you.

If you find having to remember more than 2, 4 digit codes... I think you need to come and work with me.
8 digit staff no, 13+ access codes and then passwords all to remember.... Many of which have to be changed on a monthly basis... Never mind all the stuff I need for personal banking etc.

callum9999

rockitup wrote: »

What is the bank's stance now on customers storing log-on details with the likes of 1Password. It is the only way I can get to use ultra-strong passwords, different to each account.

I also use a 256 bit VPN when accessing financial websites or making a credit card payment online, stealth mode on the Mac and a 64 character WPA-2 password on my router.... Am i being paranoid? :eek::eek::rotfl:

Just write it down on a piece of paper...

As to the complaint, I hardly see why such a ridiculous fuss is being made over it... It clearly says make REASONABLE attempts... There are no reasonable attempts to make your address or date of birth etc. unique to them, so they clearly don't expect you to. It's OBVIOUSLY referring to passwords and PINs...

mgdavid

callum9999 wrote: »

J....... It's OBVIOUSLY referring to passwords and PINs...

..then it begs the question, why not just say 'passwords and PINs'

JuicyJesus

maninthestreet wrote: »

How would Santander ever know if you did use the same PIN number used for a Santander card with a non-Santander card?

They wouldn't unless you told them. And if you told them, you'd be breaching the other bank's terms because this would effectively be disclosing the PIN to a third party.

But then Santander have never been ones for common sense.

jamesd

maninthestreet wrote: »

How would Santander ever know if you did use the same PIN number used for a Santander card with a non-Santander card?

From the original terms and conditions: 13.1 You are responsible for transactions from your account and any fees or interest incurred as a result of those transactions if: ... d) you deliberately failed to follow any of the safeguards referred to in Condition 9.7 or you are grossly negligent in failing to follow any of them;"

Santander can find out if shoulder surfing or another measure lets a criminal obtain the PIN from another card and then uses that PIN with a Santander-issued card, with no remotely close transaction involving the Santander card that could have been a cause of the disclosure. In such cases the new terms and conditions add: "K) take reasonable steps to keep your PIN or Personal Security Details unique to the accounts that you hold with us" and Santander will try to tell you that you are responsible for the fraud, not them, even if your card was stolen to carry it out.

There is no provision in there for reasonableness or how customers might be supposed to manage the large number of PINs that may potentially be required, nor for those customers who may have medical-related issues that make it uncommonly difficult to comply.

So you'll find out how Santander will do it, but only just before you make the FOS complaint about them refusing to pay out on the fraud claim. And lots of customers will just read their terms and not take the matter to a complaint then the FOS.

What Santander is doing is constructing an unreasonable set of conditions that will allow them to decline to pay for some of the fraud losses that they currently do have to pay for.

If you merely write down your name in a place associated with your account they can use that as an excuse to justify denying some fraud claims. Unless: "12.3 You are not responsible for any unauthorised use of your card, passbook, PIN, or any of your Personal Security Details in any of the following cases: ... b) after you have notified us of its loss, theft or unauthorised use in accordance with Condition 12.1;"

And that, along with the mandated requirement to report such things to Santander, is why all Santander customers should be notifying Santander about the disclosure of their Personal Security details, like name, address, star sign and such.

Even though it's daft. Just because Santander is being daft but in a way that they can exploit to make customers liable for losses that Santander should be bearing.

jamesd

callum9999 wrote: »

I hardly see why such a ridiculous fuss is being made over it... It clearly says make REASONABLE attempts... There are no reasonable attempts to make your address or date of birth etc. unique to them, so they clearly don't expect you to. It's OBVIOUSLY referring to passwords and PINs...

Their definition is NOT restricted to just passwords and PINs.

Part of the change relates to reasonable measures but there are other parts of the terms and conditions that cover any disclosure or writing down of Personal Security Information, which is defined more broadly than just PIN and password.

You're applying common sense. Their contract doesn't apply that and requires that stuff that can't possibly be treated like a password or PIN must be.

JuicyJesus

Even though it's daft. Just because Santander is being daft but in a way that they can exploit to make customers liable for losses that Santander should be bearing.

I don't often agree with you, but I'm with you on this one.

In my view, and in the views of most if not all banks, I would define negligence as disclosing the PIN to a third party and/or allowing the card to be used or kept by someone besides the customer. Santander's actions seem to want to redefine that to their benefit and define negligence as something that, if the customer is otherwise not negligent, only happens inside the customer's head - causing a shift in liability and possible conflict with the terms of other banks. And the terms are so broadly defined by Santander that they are, as you say, not possible to comply with without giving every single banking institution different details.

dalesrider

Of course while many may think that this is santanders way of getting out of pin fraud.
If people complain about being held liable for fraud. And it goes to FOS. Even if santander win it is going to cost them a lot....
Anything under the £750 cost, will santander let it go....

jamesd

I've now made the required phone notification to Santander about Personal Security Details that have become known to other people. And from now, use of those details in fraud is at Santander's risk, not mine, unless I'm grossly negligent.

If you want to do the same you should call 0845 972 4724, use the lost or stolen choice. You'll end up being transferred to the security team who'll note the information that you list on your account. Please do start the call saying that no PIN or password has been compromised and that you don't think there is an increased risk of fraud, you're just notifying because the contract requires it and because notifying transfers some risk from you to Santander.

Don't be caught out if they ask you if any personal security details have been compromised and give PIN as an example - their contract defines personal security details more broadly than that so you can't agree to that but you can say that no PIN or password has been compromised, and should.

callum9999

jamesd wrote: »

Their definition is NOT restricted to just passwords and PINs.

Part of the change relates to reasonable measures but there are other parts of the terms and conditions that cover any disclosure or writing down of Personal Security Information, which is defined more broadly than just PIN and password.

You're applying common sense. Their contract doesn't apply that and requires that stuff that can't possibly be treated like a password or PIN must be.

I didn't say it was, I said that's what they are getting at. If you genuinely believe that they ever have, currently do, or ever will have the intention that your address or DOB must be unique to them, and that you're never allowed to write them down etc., then you need help... As it stands, you are making a fuss out of absolutely nothing.

mgdavid wrote: »

..then it begs the question, why not just say 'passwords and PINs'

Maybe there are other things that are included? Regardless, it DOES NOT say that you have to have a unique address or DOB etc. with them, nor will they EVER insist that you need to.

I just think this whole rant is pathetic. It doesn't affect you in the slightest, you've just gone digging in t&cs and are trying to be put out by it...