Credit Card Security Code

Historyfanatic

A friend of mine made an online transaction with his card. Because he was buying online he had to give his security code. He was scammed and the scammer cleaned out his card.
His card company has told him that they have no responsibility to compensate him because he gave out his security code. Can this be correct? How is anyone supposed to buy online (or at a distance) if they cannot give their security code?

InsideInsurance

How did they clear out his bank account? Charging him a different value to what he had agreed to/ additional transactions to themselves? Or did they use his card details to pay other companies?

meer53

I don't think he's telling you the full story.

Who was he buying from, what did he buy ?

p00hsticks

I suspect there might have been a miscommunication somewhere on the line - what security code are we talking about ?
The CVV number (usually the last three digits on the signature strip on the back of the card) which as you say, you give for 'customer not present' transactions online or over the phone, or the PIN, which does not appear on the card and should never be given to anyone ?

nidO

What did he provide, the CSV on his card, or his PIN?

Assuming the former, his provider is wrong - The whole point of the CSV is to provide for cardholder-not-present transactions, ie online and phone purchases.
If you provide your card details to a shop to take £X and the shop ends up taking £XXXXX then that's fraud on the part of the shop, and your card provider is entirely liable to cover any money fraudulently taken.

If your friend for some reason provided his card PIN, well, the card provider are right, he got scammed but through his own fault (giving his pin out to someone).

Historyfanatic

I can assure you that he is telling me the whole story! Are credit card companies allowed to avoid their legal obligations in this way?

Historyfanatic

He did not give out his PIN, only the Security Number on the back of his card. What should he do now? Does anyone know if card companies have tried this ruse before to avoid their responsibility?

dzug1

Historyfanatic wrote: »

I can assure you that he is telling me the whole story! Are credit card companies allowed to avoid their legal obligations in this way?

Is that a serious question? I hope not.


Perhaps he has failed to communicate the situation effectively to the company


He needs to restate his case, invoking their complaints procedure.
If that fails to produce results then (and only then) the ombudsman can be involved.

Historyfanatic

It most certainly is a serious question! We all know, I assume, that banks and credit card companies will wriggle furiously to get out of their legal obligations despite rulings by the Ombudsman.
Does anyone know the law on this?

meer53

Historyfanatic wrote: »

It most certainly is a serious question! We all know, I assume, that banks and credit card companies will wriggle furiously to get out of their legal obligations despite rulings by the Ombudsman.
Does anyone know the law on this?

There will be a valid reason why the bank aren't refunding him. If you give the full story, we might be able to give better advice.

I think he has misunderstood the reasons the bank have given. They can't refuse to refund if any transactions are fraudulent.

Who did he buy from and who "scammed" him ?

Historyfanatic

That is the full story! My friend is a very senior and experienced lawyer. He saw his bank manager today and she told him that, because he had given out his his security code, the bank had no obligation to refund the money scammed from his card.
There is no misunderstanding. She was adamant that giving out the code was a breach of security and absolved the bank of all responsibility. On this forum we have all seen banks trying this sort of argument in fraud cases involving someone's PIN and alleging that the person gave out their PIN when there was no evidence that they had done so. The Financial Services Ombudsman ruled against this some two years ago but banks still try it on.
Giving one's security code is essential for an online transaction.
This is yet another excuse and I wondered if anyone had come across this particular attempt to evade responsibility.