In December Jae-sang lost her wallet, containing her driver’s licence and bank cards, and she reported the loss to the police. In January Jae-sang could not find her credit card, so thought it must also have been in the wallet she lost. Jae-sang called her card provider and asked for a new card.
The card provider issued a new card and on 30 January someone loaded a new PIN on that card. The card and PIN were immediately used to withdraw $800 from an ATM. The following day the card was used again to withdraw $500 from another ATM. The next day, 1 February, someone called the card provider and asked to put a hold on the card.
However, the card was able to be used again on 2 February to make two EFTPOS transactions at the same service station a couple of hours apart. One transaction was for $77.85 the other was for $20.
About 10 days later Jae-sang completed a ‘disputed transaction form’ disputing that she made any of the transactions on the card, and she attached the police complaint acknowledgement form from the previous December. The card provider declined Jae-sang’s claim. They said the card used to make the transactions was issued in January and the PIN was entered correctly on the first attempt, indicating that the person knew the PIN.
Jae-sang did not accept the provider’s response and complained to FSCL.
Dispute
Jae-sang said that because of a traumatic event, she was unable to remember the details of the events between December and February. However, at the time she completed the disputed transaction form she was certain that she had not made the transactions. Jae-sang could not recall whether she had loaded the PIN on 30 January and also couldn’t remember placing the hold on the card on 1 February.
The provider said that the person who requested the replacement card and loaded the new PIN would have answered security questions to identify themself as Jae-sang. Also, the person making the transactions would have needed both the card and the PIN. The provider did not consider they had any liability for the disputed transactions.
Review
We reviewed the provider’s records and confirmed to Jae-sang that the card used to make the transaction was not the card stolen in December but was in fact the card issued in January at what appeared to be Jae-sang’s request.
The provider’s records also showed that there were two login failures on 30 January before a successful login allowed the person to load a new PIN onto the card. This person could have been Jae-sang, but we could not completely disregard the possibility that someone, with some knowledge of Jae-sang’s personal information, logged into her account and selected a new PIN.
However, in our experience, when dealing with complaints about stolen cards and PINs, the transactions follow a predictable pattern. As soon as the thief has the card and PIN they will withdraw as much money as possible. Delay risks the possibility that the cardholder will discover the card is missing and place a hold on the card preventing further theft.
Jae-sang had an available balance of $6,500 and the daily withdrawal limit was $3,000, yet the person withdrawing the money only took $800 on 30 January and $500 on 31 January. It seemed to us unlikely that a thief would stop at $800 when they could have taken another $2,200.
Under the card’s terms and conditions, Jae-sang was liable for all the transactions she authorised on the account. Given that the person had the card and PIN, we could not say that Jae-sang did not authorise these transactions. It was our view that the provider was not obliged to refund the money stolen on 30 and 31 January.
However, someone placed a hold on the account on 1 February, and the provider allowed two further withdrawals on 2 February. It was our view that the provider was obliged to refund the withdrawals made after the hold was placed on the account.
Resolution
The provider accepted our decision but Jae-sang did not provide a substantive response and we discontinued our investigation.
Insights for consumers
A thief needs both your card and PIN to withdraw money from your account. It is very important that you keep your card and PIN safe. If you think either your card or PIN have been compromised, please contact your provider immediately to place a hold on your account.
