Banks are not properly monitoring accounts for fraud, so putting their customers’ money at risk, a Times Money investigation has found.
Many people assume that their banks will pick up on unusual activity and stop transactions if they appear suspicious. However, fraud victims say that their banks have authorised transactions allowing several thousands of pounds to be spent in a few hours.
Sandra Quinn, of Apacs, the UK payments association, says: “There are no industry guidelines for how banks should monitor fraud. Each has a different policy. It is impossible for consumers to know which is best — or worst — because they do not publish their fraud figures or details of their monitoring policies.”
While there is nothing in the Banking Code that compels banks to monitor for fraud, they all say that they have “detection systems” to identify unusual spending patterns and potentially fraudulent transactions. But they deliberately do not tell consumers the type of transactions that may be flagged as suspicious in case it gives fraudsters too much information.
Alex Barnett, of Halifax, says: “We are unable to disclose what values or transaction patterns trip a fraud alert, mainly because this is assessed on an individual basis. A set of normal transactions for one person may not be normal for another.”
Concerns about monitoring have mounted as banks appear more reluctant to compensate victims of chip-and-PIN fraud. Times Money has been inundated with letters from readers who have had thousands of pounds withdrawn from accounts, only to find that their banks refuse to compensate them. Many have been “shoulder-surfed” — watched as they enter their PIN — then had their cards stolen and accounts drained at cash machines and in shops.
Under the Banking Code, consumers are not liable for such fraudulent transactions, but banks are refusing to pay out, telling customers that they must have been negligent with their PIN. Jane Smith, 58, was a victim of fraud after an HSBC cash machine on Baker Street, Central London, swallowed her Abbey debit card. She went back to the branch as soon as it opened the next day, only to find that fraudsters had spent £4,000 — her entire overdraft — in less than 24 hours. Abbey initially refused to pay a refund, saying that she must have given her PIN to someone. It took her three months to recover the money.
She says: “I have been a loyal Abbey customer for 30 years and have never been overdrawn until this happened. Surely the bank should have noted the transactions and stopped them?”
Professor Ross Anderson, of the University of Cambridge computer laboratory, says that Mrs Smith’s story is common. “Banks have used chip-and-PIN to dump liability,” he says. “If a transaction is disputed and a PIN was used, it is either the customer or the merchant’s fault. Why should banks go to the trouble of running a complex detection system to flag up suspicious transactions? It is simpler to authorise transactions, especially once fraud becomes someone else’s problem.”
Emma Woolf, 27, had a similar problem with her Abbey business account. She was horrified to discover a balance of £23 when she logged on to online banking — her account should have contained about £10,000. Fraudsters had been draining the funds for three months, mainly by making cash withdrawals of up to £500 at a time. They had also changed the address on the account.
Miss Woolf, who lives in northwest London, says: “I have not made a cash withdrawal on my account for several years, so endless cash withdrawals are very out of character. Yet it was not flagged up by the fraud team.”
Like Mrs Smith, Abbey told Miss Woolf that she must have been negligent with her PIN and is refusing to pay back her money.
“I have kept my card in a safe since October and have never told anyone the PIN,” she says. “I have now lost £10,000 and my business cannot operate. It has been a nightmare.”
Miss Woolf says that she is a victim of account takeover fraud, which rose by 62 per cent last year, compared with 2007. A fraudster contacts a bank, masquerading as the genuine cardholder, and then arranges for funds to be transfered out of the account, or changes the address and asks for a replacement card.
Fraud costs the banking industry millions of pounds every year — and losses are increasing. Last year card fraud rose to £609.9 million, a 14 per cent increase on 2007. Cathy Neal, of Which?, the consumer organisation, says that there needs to be greater clarity and consistency on how banks monitor fraud: “They will not pick up on highly unusual activity but will often stop transactions if a customer is abroad, for example.
“The vagueness of the Banking Code on fraud liability means that banks are inconsistent with compensation. Many victims are also not told how fraudsters stole account or card details, which can be very unsettling.”
Nina Gregory, 70, is taking Abbey to a small claims court next week after fraudsters took £2,800 from her Isa account two years ago while she was on holiday. The bank has refused to refund the money, a decision upheld by the Financial Ombudsman Service.
She says: “I went to Russia for five weeks and took my Isa card with me. When I received my monthly statement when I got back, I saw that £200 had been withdrawn from cash machines in West London, every day for two weeks, until the money ran out. I have never withdrawn so much cash from a machine, or so regularly.
“However, Abbey insists that because the correct PIN was used, and the transactions took place near to my house, it cannot be fraud. It implied that I left my card at home and was somehow negligent with my PIN.”
Mrs Gregory, like many victims of fraud, says that she was made to feel like a criminal, adding: “Abbey’s fraud department asked me lots of aggressive questions to try to establish how I had been negligent. Where did I keep my purse? Had I written down the PIN? To be accused of lying or colluding with fraudsters at my age is an insult.”
An Abbey spokesman says that the bank reviews every customer claim and that it takes full responsibility for fraud as long as the bank is “satisfied that the customer has not done anything to leave his or her account vulnerable”. He adds: “However, we are unable to accept responsibility for money that goes missing from an account through negligence; for example by writing down the PIN or sharing it with a family member.”
Mrs Gregory is not the first bank customer to take legal action over chip-and-PIN fraud. Alain Job took Halifax to court in April over £2,100 that he says was withdrawn from his account fraudulently. He lost his case after the judge ruled that Mr Job must have compromised his PIN. During the hearing, however, it emerged that Halifax had destroyed three primary pieces of evidence: the debit card, the ATM receipt and cryptographic evidence showing the decision by the bank’s computers to authorise the transaction.
Professor Anderson says: “Banks are under no pressure to be transparent, which is part of the broader weakness of regulation. The Financial Services Authority believed the banks’ credit risk models. They have been just as gullible in believing their operational risk and security models.”
Case study: Halifax failed to spot £1,720 taken in a day
Angela Millar had £1,720 taken from her account by fraudsters in only 12 hours. Ms Millar, a journalist, was shoulder-surfed in a bar in East London while paying for drinks. Her card was then stolen from inside her handbag.
The 28-year-old says: “I didn’t notice that the card was missing until the next day. The thieves had emptied my overdraft and left me with nothing.”
After waiting two weeks for a phone call from Halifax’s fraud department, Ms Millar was subjected to 45 minutes of questioning.
“They told me that they were using voice recognition technology, presumably to see if I was lying,” she says. “They asked many questions — were you out eating and drinking, or just drinking? Who were you with? How did you get home? It was extremely intimidating.”
Halifax refused to issue compensation, so Ms Millar went to Argos, where the fraudsters had spent £750, and obtained CCTV footage of them using her card. “I gave the footage to the police, at which point Halifax finally agreed to give me my money back,” she says. “The whole experience was horrendous.”
Be on your guard
• Check your account as regularly as possible for any suspicious transactions.
• Never let your card out of your sight when paying in a shop or restaurant. Always cover your hand when you enter the number.
• Make sure that your PIN is not the same number as anything else, including your house burglar alarm, to ensure that banks cannot accuse you of being “negligent” with the number.
• Never tell anyone else your PIN — even family members — and never write it down.
