Credit and debit card providers are exploiting a grey area in the Banking Code, which leaves victims of chip-and-PIN fraud with thousands of pounds of losses.

As the financial crisis continues to hit profits, the banking industry is becoming increasingly reluctant to compensate customers who have had money withdrawn from their accounts fraudulently.

The chip-and-PIN system was introduced three years ago to combat fraud on lost and stolen cards. It proved successful at first, but fraud where a PIN is required increased significantly last year, suggesting that criminals are finding more sophisticated ways round the new payment method.

The Financial Ombudsman Service (FOS), which handles consumer complaints against banks, says that it now deals with about 125 cases a month of customers locked in disputes over PIN fraud. Most of these involve withdrawals from cash machines, where the consumer denies either making the transaction or authorising someone else to do so.

Under the Banking Code, to which all banks must adhere, customers are responsible for losses only if they acted “without reasonable care”. This could include writing down a PIN or allowing someone else to use a card. The code clearly states that unless a bank can prove that its customer acted fraudulently or without reasonable care, the most that the customer will be liable for is £50.

However, experts say that the matter has become a grey area in which banks often refuse to compensate their customers. Cathy Neal, of Which?, the consumer organisation, says: “Each case of fraud is unique and the issue of ‘reasonable care' is often open to interpretation. The danger for consumers is when it becomes a matter of their word against the banks'. People often go through years of stress fighting to clear their names and get their money back.”

As well as shoulder-surfing, fraudsters' tricks range from hiding a camera at a cash machine to record PINs to planting a device at a chip-and-PIN payment point to clone the card and use it overseas.

David Humphreys, 59, has been involved in a dispute with Smile, the internet bank, since October 2005 after he noticed that £1,500 was missing from his current account. Cash machine withdrawals of £250 had been made every day for six days.

He says: “Smile said that it was unable to refund the money because the correct PIN was used. We think that the fraud dates back to when my wife used her card in a shop. The cashier took her card to the back of the shop and reappeared with a device on which my wife entered her PIN.

“We have had many lengthy and stressful communications with Smile, which culminated in the bank telling us that my wife, who is in a wheelchair, must have given the PIN to someone else one day when she was unable to leave the house. I thought that was pretty low of the bank. We have never written down the PIN, or given the number to anyone. This has been going on for more than three years and we have almost given up hope of seeing our £1,500 again.”

A Smile spokesman says: “We are confident that the card and PIN issued to the customer were used for the disputed transactions.”

Mr Humphreys has taken his case to the FOS but has been told that it will take at least five months to resolve the matter. Emma Parker, of the FOS, says: “Complaints involving allegations of card fraud depend on the individual circumstances surrounding the case. The ombudsman will investigate and consider all relevant information, such as how someone could have got hold of the PIN and whether other consumers using a particular cash machine were similarly affected.”

The FOS has upheld many complaints where banks have refused to pay customers who have been victims of fraud. In one case, a grandmother had her card and a piece of paper with her PIN on it stolen from her home by her grandson, who withdrew £6,000. Though the card and PIN had been hidden carefully, the bank refused

to refund the account, insisting that the woman had been “grossly negligent”. The FOS upheld the complaint and ordered the bank to compensate the victim, saying that she had not been negligent.

In another FOS case, an office worker discovered on her bank statement a £250 cash withdrawal that she did not make. Again, her bank told her that she must have been negligent and was liable for the transaction. The FOS investigated the case and found that one of her work colleagues had taken the card from her handbag, used it to withdraw cash and later replaced it. The colleague had been shopping with the victim and had observed her enter the PIN. The FOS upheld the complaint.

Kevin Mountford, head of banking at Moneysupermarket.com, the comparison website, says: “As banks face increasing pressure on profits, they will be keen to pass on liabilities to either the consumer or the retailer, where there is a potential get-out. This is certainly a grey area and the regulators could do more to clarify the position of consumers.”

How to protect your PIN

Ensure that you are the only person who knows your PIN. Your bank or the police will never phone to ask you to disclose it. Never write it down or record it.

When entering your PIN, use your free hand and your body to shield the number from prying eyes or hidden cameras. If you think that someone has seen your PIN, you can change it at a cash machine or by contacting your bank.

Memorise your PIN and destroy any paper notification as soon as you receive it. If the PIN that you are given is difficult to remember, change it to something more memorable.

Be alert whenever you use a cash machine. If someone is watching or crowding you, cancel the transaction and go to another machine. Do not accept help from seemingly well-meaning strangers and never allow yourself to be distracted.

When paying in a restaurant or shop, never allow your card out of your sight. Do not allow assistants to take the card away or watch you enter your PIN.

Case study

Megan Gibbens, above, had £2,300 stolen when her Barclays debit card was taken from her handbag while she was in a bar. The 28-year-old, who lives in South London, was in dispute with Barclays for six weeks and managed to recover her money only after contacting Times Money's Troubleshooter.

“I think that someone must have watched me enter my PIN while paying for a drink at the bar, then stole my card and made cash withdrawals and several store purchases,” she says.

“I told Barclays as soon as I realised that the card was missing and was promised that the appropriate forms to dispute these transactions would be posted to me immediately. Two weeks later, and after seven more phone calls, the forms arrived, but the maximum amount that you can claim on them is £500.

“I changed the form to claim £2,500 and sent it back, but despite many more frustrating phone calls, the bank seemed unable to tell me anything.”

Miss Gibbens says that she understands that Barclays needed to investigate the case, but adds: “I was left feeling powerless, with no faith in the bank's commitment to customer care. I do not believe that I would have got my money back if Troubleshooter had not intervened.”