Victims of chip-and-PIN fraud who are unable to recover their money have been urged to consider legal action against their banks. Increasing numbers of Times Money readers have reported that credit and debit card providers are flouting the Banking Code by refusing to refund money fraudulently withdrawn from accounts.

Under the Banking Code customers are only responsible for losses arising from fraud if they acted “without reasonable care”. This could include writing down a PIN or allowing someone else to use a card.

Unless a bank can prove that its customer acted fraudulently or without reasonable care, the most that the customer should be liable for is £50. However, consumer groups say that many banks insist that victims of fraud must have been negligent with a PIN and are refusing to pay out.

Cathy Neal, of Which?, the consumer group, says: “Banks are very reluctant to admit that there any flaws in the chip-and-PIN system. The Banking Code is not specific enough and there appears to be different approaches from banks on how to compensate fraud victims.

“In many cases, the issue of ‘reasonable care’ of a PIN becomes the consumer’s word against the bank’s, which can lead to months of stress and financial hardship as customers try to recover their money.”

If victims of fraud are unable to gain compensation for their losses through their banks, they can refer cases to the Financial Ombudsman Service (FOS), the independent body that settles disputes between banks and consumers. Cases typically take up to nine months to resolve.

Ms Neal says: “If a consumer is unsuccessful with the bank and the ombudsman, the only other option is to take the bank to the small claims court. It does not cost a huge amount — usually about £150 in court fees, which will be refunded if you are successful — and you can represent yourself. You would be expected to prove your claim, so you may have to pay for an expert’s opinion. However, if the ombudsman has investigated your case, you should have a lot of evidence already. The court would be mindful that you are an individual and would try to be as helpful as possible.”

If you win your case, you will get the court fees back as well as the claim, and you can also ask for certain expenses. If you lose, you will not get the court fees back, but it is unlikely that you will have to pay any other costs. For more on making a claim through the small claims court.

Last week Alain Job, a 40-year-old living in Nottingham, took his bank, Halifax, to court over £2,100 of cash machine withdrawals made in February 2006. Mr Job says that he did not withdraw the money, his card was with him the whole time and no one else knows his PIN.

Halifax maintains that it was his exact card that was used to withdraw the money, inferring that either Mr Job tried to defraud the bank, or he was grossly negligent in handling his card and PIN.

Halifax was unable to comment on the case, other than to say that it would “vigorously defend” itself in court. The judge of the one-day trial said that it will take at least a month to deliver his verdict.

Mr Job is the first person to sue a UK bank over a phantom cash withdrawal, but he is one of many fighting their banks over disputed transactions. Credit and debit card fraud at UK cash machines increased by 31 per cent in the past year, according to Apacs, the UK payments association.

While banks generally maintain that the chip-and-PIN payment method is totally secure, experts say that fraudsters are finding new ways to beat the system. The FOS handles about 50 cases of disputed chip-and-PIN transactions every week. Most of these involve cash machines. In the case of Mr Job, it ruled in favour of Halifax.

Emma Parker, of the FOS, says: “We have had alleged cases of card cloning, shoulder surfing [where someone watches you enter your PIN], the use of cameras at cash machines and even fraud among family members.

“However, if a consumer is not satisfied by our adjudication, it is their prerogative to take the matter further through the courts.”

Stephen Mason, the barrister representing Mr Job, says that taking a bank to court is the best way to ensure a fair and transparent investigation.

“The problem for consumers is that neither banks nor the ombudsman reveal all the evidence that the bank relies upon, making the whole system seem rather opaque,” he says. “The only way that a consumer would see all the evidence surrounding a disputed transaction is if he or she took legal action against the bank.”

Chip-and-PIN was introduced in 2004 as a near-infallible payment method. Previously, data on cards was stored on a magnetic strip and identification was verified by a signature. Now a microchip is also used to secure the data, which is much harder to skim or clone, and a four-digit PIN is required for transactions. However, many cash machines abroad do not have chip readers, which means that all cards still have a magnetic strip, and all cash machines — in the UK and overseas — are able to read the strip instead of the chip. While chips are difficult and expensive to clone, magnetic strips are relatively easy.

Apacs has confirmed that if a card does not have a chip, the cash machine may use the magnetic strip to verify the payment. Ross Anderson, of the University of Cambridge computer laboratory, says: “Despite what the banks say, their systems are not infallible and chip-and-PIN could be compromised in a number of ways.

“It has been known for banks to duplicate debit cards because of a procedural error, meaning that identical cards are working at the same time. More commonly, skimming devices are placed on cash machines and retail sale points, allowing fraudsters to clone the magnetic strip. Though we do not know of any cases where the chip has been completely cloned, partial clones that work in some shops have been found in France and suspected here, and full clones are possible.”

Last year a 34-year-old man was found guilty of using fraudulent cards to steal more than £40,000 from UK cash machines. A police search of Ady Bunu’s home in Wakefield, West Yorkshire, revealed a cash machine crime “factory” that contained fake cash machine fronts, blank cards and pinhole cameras. Police said that they recovered the details of more than 2,000 compromised cards, resulting in “the prevention of almost £1 million in potential fraud losses”.

Case study

Robyn Osbourne had £1,600 taken from her Barclays current account after her card was stolen on New Year’s Eve. She was locked in dispute with Barclays for five months, with the bank refusing to compensate her until Times Money intervened.

The 27-year-old, a junior physiotherapist from North London, was a victim of shoulder surfing while paying for a drink with her debit card. Shortly afterwards, the card was stolen from her handbag and used to withdraw cash and to make a number of purchases.

Barclays refused to compensate Ms Osbourne, saying: “That the card has been misused indicates that neither it nor the PIN were adequately protected.”

But Ms Osbourne insists that she concealed her PIN while paying for her drink and kept the card in her handbag, which she wore all night. “I feel let down,” she says. “Not only was I held liable for an offence that I did my best to prevent, but the bank should have realised that the transactions were fraudulent as it was completely unlike my normal spending habits.

“It is a great deal of money and I have since been unable to afford my rent and bills.”

Protect your PIN

• Memorise your PIN and destroy the notification letter. Never write it down or store it in your mobile phone. Use different PINs for different cards.

• Never tell anyone your PIN. If you think that someone knows the number, change it at a cash machine as soon as possible.

• When entering your PIN, use your free hand to shield the number from people or cameras.

• Check your statements regularly and thoroughly. If you notice an unfamiliar transaction, contact your bank immediately.

Take your bank to court

• Fill in a claim form at www.hmcourts-service.gov.uk and send it to your local county court with the court fee.

• Most claimants do not use a solicitor. If you do, you will have to pay the legal fees. A “lay representative”, such as a friend or Citizens Advice Bureau (CAB) adviser, can help in court.

• If the bank opts to defend itself, rather than pay up, the court is likely to allocate the case to a small claims track and issue a hearing date. Your local CAB can help you to apply and prepare a case (go to www.citizensadvice.org.uk).