ATM theft on Credit Card

nsalam

Hi All


I have been the victim of ATM theft on my credit card to the tune of 4.5k. The Bank (Halifax) have refused to write it off as they say that if I did not undertake the withdrawals then someone I know used my card to do it. The card was in my possession at the time of the thefts and I was able to prove, at least, that it was not me by showing them my time data from my workplace.


The initial ombudsman decision backs the Halifax up so it is going for a final decision with the Ombudsman now.


Someone has cloned/stolen my details and used nearby ATMs in the process - something that added to the Halifax argument.


I have presented my case to a solicitor who advises that I have less than a 51% chance of winning the case and the judge will ultimately decide my fate.


Any advise? Anyone been through this please?


thank you
Naz

PeacefulWaters

The Consumer Credit Act, which covers the theft of 'credit’, states that liability for unauthorised withdrawals or purchases lies with the cardholder for the first £50 - this technically means that, even if they have been negligent with their PIN, the cardholder is only liable to pay the £50 of the losses incurred.

http://www.moneywise.co.uk/news/2009-06-24/fraud-how-to-get-your-money-back

zagfles

PeacefulWaters wrote: »

The Consumer Credit Act, which covers the theft of 'credit’, states that liability for unauthorised withdrawals or purchases lies with the cardholder for the first £50 - this technically means that, even if they have been negligent with their PIN, the cardholder is only liable to pay the £50 of the losses incurred.

http://www.moneywise.co.uk/news/2009-06-24/fraud-how-to-get-your-money-back

Yes, but in this case the bank appear to be claiming that the OP authorised the withdrawals (either made the withdrawals themselves or gave someone else the card & PIN to make them).

Ironically the OP would be in a better position if they'd written their PIN on the card and lost it...

PeacefulWaters

zagfles wrote: »

Yes, but in this case the bank appear to be claiming that the OP authorised the withdrawals (either made the withdrawals themselves or gave someone else the card & PIN to make them).
...

And the onus is on the bank to prove it.

(Interestingly, chip and pin card cloning is quite rare, although not impossible. If I was to speculate wildly I'd guess the ATMs used were all within a 20 mile radius of the OP's home or workplace and if I was on the bank's fraud team I'd be very suspicious)

zagfles

Over what period were the withdrawals made? Where were they made? If you can get locations there may be CCTV evidence of the culprit. Does anyone else know the PIN? Do you use the card for other stuff? Do you remember it being swiped anywhere rather than using a chip reader (where you just push the card in part way?

zagfles

PeacefulWaters wrote: »

And the onus is on the bank to prove it.

Indeed. Though I don't think it needs to be crminal justice standard ie "beyond reasonable doubt".

agrinnall

PeacefulWaters wrote: »

And the onus is on the bank to prove it.

(Interestingly, chip and pin card cloning is quite rare, although not impossible. If I was to speculate wildly I'd guess the ATMs used were all within a 20 mile radius of the OP's home or workplace and if I was on the bank's fraud team I'd be very suspicious)

I think this is quite likely to be why the bank is suspicious. When it happened to me the card details were stolen in the West Midlands and the cloned card used in an ATM in Sydney. It would have been easy for me to prove that I wasn't on the other side of the world (although I had just arrived in Vietnam when I noticed the transactions) but Nationwide never queried it.

ChumpusRex

PeacefulWaters wrote: »

And the onus is on the bank to prove it.

True, but the bank has a compelling argument:
A card with the correct card details was used and the correct PIN also was used.
The card was in the OP's possession before and after the alleged frauds, so was not lost or stolen.
If the ATMs used were nearby, then they have proof that the OP was in the area (from work timesheets) so could have made the withdrawals.
Cloned cards are very rare in the UK, and banks have been making cloning harder.

The bank only needs to convince the judge "on the balance of probabilities" in other words, 51:49. They do not have to prove "beyond reasonable doubt".

The OP has a very weak case, unless they can get some evidence like CCTV from the ATMs, or ask an IT security expert to check the digital signatures in the bank's logs against the card.

paulofessex

It may be worth have a good Google ect as l recall seeing a program on how in cases of dispute only the chip on your card can prove if it was that card used and not a cloned card. This is why it is important when a bank asks you to destroy your card in cases of suspected fraud, by all means cut it in halve BUT don't cut the chip and keep in safe place in case needed later on.

grumbler

ChumpusRex wrote: »

...
If the ATMs used were nearby, then they have proof that the OP was in the area (from work timesheets) so could have made the withdrawals.

Even if wasn't nearby, this wouldn't prove anything unless transactions close in time were made in remote locations.

Cloned cards are very rare in the UK,

Indeed. Any proven cases of chip cloning?

and banks have been making cloning harder.

How can they do this if the technology remains the same since chip&pin was introduced years ago?

The OP has a very weak case, unless they can get some evidence like CCTV from the ATMs,

This can neither prove nor disprove anything unless it's some person known to the OP.

or ask an IT security expert to check the digital signatures in the bank's logs against the card.

Can you elaborate on 'digital signatures'?

I think what only matters is whether the transaction was chip&pin or not. If it wasn't then the OP has a stronger case (some ATMs allegedly still default to simple PIN if chip is damaged - don't take my word for this).

ChumpusRex

grumbler wrote: »

Even if wasn't nearby, this wouldn't prove anything unless transactions close in time were made in remote locations.
Indeed. Any proven cases of chip cloning?

Not of chip cloning. However, magstripe cloning is well known, and certainly used to work with chip cards (because they retain the magstripe as a backup).

PC June Badger had a chip card, noticed "phantom ATM withdrawrals", and made a fraud claim with the bank. She was promptly arrested for fraud.

At her trial, the bank argued that chips were uncloneable. Her defence team showed that the bank IT systems of the time, did not distinguish between a magstripe read and a chip read, and that a magstripe only clone could be accepted.

How can they do this if the technology remains the same since chip&pin was introduced years ago?

The technology isn't the same. The chips are significantly more advanced, and use much stronger encryption. In particular, modern chips now tend to use "dynamic data authentication" which is a much stronger technique for prevention of cloning.

ATMs have magstripe and chip readers. The magstripe is used for compatibility with foreign, non-chip cards. Older ATMs would fall-back to the magstripe if a chip was unreadable, allowing a magstripe only clone to be used. These days fallback transactions tend to be flagged as suspicious, or blocked unless there is a good reason (e.g. the ATM doesn't have a chip reader because of its age) [/quote]

This can neither prove of disprove anything unless it's some person known to the OP.
Can you elaborate on 'digital signatures'?

This is my point. If CCTV shows someone that isn't the OP, then while it doesn't prove the transaction wasn't authorised, it does provide the OP and the police with someone to chase for the theft.

The digital signatures are the heart of chip & PIN. The chip will send a signature to the bank as part of the transaction, which the bank keeps. If the signature is correct, then the genuine chip was present at the time of the transaction, and cloning is virtually inconceivable. In the Badger case, when the bank checked their logs, they found blanks where the signatures should have been, even though the transactions had been recorded as "chip & PIN" and the case against her collapsed.