Phantom Cash Machine Withdrawals Can Haunt Customers

The Guardian - 16  October  2010

David Dix talks to Miles Brignall

You're sure you didn't take out that £240, but the bank insists you did. So what next?

It's the moment anyone who regularly checks their bank statement most fears. You are looking down the list of transactions and spot one you don't recognise. A rogue cash machine withdrawal of more than £200, seemingly made while you were fast asleep at 2am. You rack your brain and even look through your diary to establish whether it could have possibly been you (or your partner if it's a joint account).

In most cases that rogue withdrawal turns out to be genuine. You eventually remember you did take out the cash. But what happens if your investigations hit a dead end and you are adamant the money could only have been taken fraudulently? You would probably expect the bank to refund you. But what if it refuses your claim because it says your card and pin were used to access the cash?

This is the position Katrina Smith finds herself in. The businesswoman is currently in dispute with her bank, HSBC, after £240 was mysteriously taken from her account, at 2.10am from a cash machine in St James's Street, just round the corner from her Brighton home.

Despite her repeated protestations that she did not withdraw the money, the bank has refused to reimburse her.

HSBC says the fact it can show her actual card and pin were used indicates she must have acted negligently. It says its stance is strictly in line with previous Financial Ombudsman Service findings following similar ATM disputes.

Smith's problems started on 19 August when, looking online, she spotted the disputed withdrawal. She knew that on the previous night, on the way to the cinema, she had taken out £40 from the same ATM that was used for the disputed withdrawal.

On the way home just after midnight she withdrew £20 from another ATM in the same street, but was certain she hadn't taken out the third, much larger amount. She checked her wallet and still had her debit card, and rang the bank to inform them the £240 withdrawal was "fraudulent".

"The call centre person insisted it had to be me, since it was my card and pin that had been used. When I categorically denied this, she asked me if anyone else was with me during the earlier withdrawal around midnight. I said my boyfriend had been, and she then accused him of stealing my card while I was asleep. She repeatedly asked if I had taken the money. I took great exception to this. I've banked with HSBC since the early 1980s and have had my business account with them since the mid-1990s. I certainly have no need to try to steal their money."

Her bank card was stopped and she was told the fraud department would look into it.

Two weeks later she received a letter from HSBC refusing a refund on the basis that the bank was sure her actual card - not a cloned version - had been used with her pin. She appealed against this decision, asking whether the ATM had a camera, and was told she would get a response within 10 days.

When this deadline passed, she again contacted the bank and was told she would have to reactivate the complaint. At this stage she contacted Guardian Money. We asked the bank to look at her case, and were told HSBC would not be refunding her the cash.

Smith, who runs a successful TV bookings business, was furious. "I'm really pissed off about this, as it seems I'm guilty until proven innocent. If the bank checked the pattern of my withdrawals, they would soon see I've rarely, if ever, withdrawn large amounts of money, and certainly not at 2am. I have plenty of money - I don't need to try to defraud HSBC. If it was my boyfriend, he would have had to get up in the night, go out, get the money and get back into bed beside me, all without waking me up. It just doesn't make sense."

HSBC told us: "Her debit card was not stolen, but used by someone who had access to it in conjunction with her pin at her local ATM for a one-off withdrawal precisely equal to the remainder of her daily cash withdrawal allowance. We have provided the Guardian with the ATM record proving that her exact card was used and both the pin and value of withdrawal were entered accurately on the first attempt.

"Whoever used the card, took it and replaced it, knew her pin and the exact maximum they could withdraw. No further fraudulent activity was attempted using her card. With this knowledge, it is our view that on the balance of probability she was negligent with her personal information and we will not be refunding her."

But are cash machines truly infallible? Every few months it seems there is a story in the press about a malfunctioning ATM somewhere that is handing out too much cash. Usually, news of the fault spreads like wildfire, and huge queues build up until the glitch is put right or the machine runs out of notes. And readers with long memories will recall that in the early days of ATMs the banks adamantly refused to admit that "phantom withdrawals" were possible - a stance they were later forced to abandon.

Smith's is certainly not the first recent dispute of this kind. In January 2008 the Guardian reported how football coach Alain Job took the Halifax to court after £2,100 was taken from ATMs, even though he said his card had never left his side. Pensioner Donald Reddell described losing £3,000 in phantom withdrawals from ATMs even though his Barclaycard had only ever been used in a cash machine to change the pin, and was then placed in his safe. Both claims were denied.

The Financial Services Authority's Moneymadeclear website says bank customers' liability for unauthorised transactions before reporting them to the bank will usually be capped at £50 unless you were "grossly negligent" in keeping your details safe. Some readers will wonder what this means, and whether you can be grossly negligent while asleep.

The banks are guided by the Financial Ombudsman Service's (FOS) previous findings following similar disputes, though a spokesman was this week keen to stress that every case is examined on its individual merits.

"Generally, we would not expect a bank or building society to reject a complaint on the grounds that the pin had been used with the card without fully investigating the complaint. We will ask the customer to provide background about the events that took place around the transaction too. Just because the banks expect us to find in a certain way doesn't necessarily mean we will," he says.

For an independent view of Smith's case, we asked one of the UK's leading experts on ATM fraud, David Dix of the Cambridge-based firm Cryptomathic, to have a look at the detail. His immediate response was that the circumstances did not look good for her.

"It's very unusual in bank fraud cases for the card to be used in the nearest ATM to the customer's home. Generally, if the card is cloned and the pin captured, the fraudulent purchases happen outside the UK, where chip and pin technology is yet to be installed. As far as I am aware, there have been no cases of the chips in UK bank cards being cloned and used to take money out of ATMs. It is theoretically possible in a lab, but we haven't seen any cases yet on the streets."

Asked whether there could be some other possible explanation, Dix says it is hard for customers in Smith's shoes. "The problem is that the bank holds all the cards, and they are reluctant to hand over the information to customers. If it were an ATM malfunction, this would be fairly easy to spot.

"Also, the bank will know if there have been any other attempted transactions after the card was stopped, but they never give this information to bank customers, unless they are forced to in court. If Ms Smith went to court, she would probably lose. There have been other similar cases, and in the most recent the judge has always sided with the banks."

Back in Brighton, Smith says she won't be suing, as it would cost more than her loss. Instead she says she will apply to the FOS, which will cost the bank around £500. She is also set to move both her business and private account away from the bank, plus all associated savings.

Katrina Smith is not her real name