February / March 2008
Most people with a bank or building society account make regular use of cash machines. In fact, around 7.5 million cash machine transactions are successfully carried out in the UK each day. Seen in that context, the number of complaints we see involving cash machines is relatively very small. However, those cases we do see often require detailed investigation, involving the analysis of cash machine audit trails, as well as collecting and assessing information about the circumstances of the disputed transactions.
The possibility of card fraud can be a particular worry for consumers. They are often concerned about whether a fraudster might be able to obtain information from their card, or from a transaction slip, to get access to their account - perhaps by "cloning" their card (making a copy that can be used in a cash machine). Most cards now include a micro-chip which can be 'read' by the cash machine, providing an enhanced level of audit trail information. However, consumers are often unclear about exactly how this might affect them in the event of a dispute.
Sometimes, consumers do not question having made a particular cash machine transaction. However, they say there was some problem with the cash machine and that it failed to dispense their money, or that their account was debited with more than they actually drew out. The situation can be further complicated by the fact that a consumer may be complaining about a transaction made at a cash machine owned by a different bank or building society from the one where they hold their account.
When we look at complaints involving cash machines we take into account the relevant law and provisions of the Banking Code, as well as the card terms and conditions of the customer's account. The following case studies illustrate some of the more typical cash machine complaints we have dealt with recently.
Mr O, a customer of bank A, attempted to use his cash card to withdraw £100 from a cash machine owned by bank B.
He later told us he had assumed there was some kind of fault with the machine. He said he had waited longer than usual but the cash had failed to appear, so he had given up and walked away.
He complained to his bank after finding the withdrawal shown on his next statement. When the bank refused to refund the money, he brought his complaint to us.
complaint not upheld
As part of our investigation into the complaint, we obtained the audit trail from bank B's cash machine for the day in question. There was no evidence of any malfunction and nothing to suggest that the sum of cash Mr O requested had not been dispensed in the usual way.
Initially, Mr O had been adamant that he had waited at least 20-30 seconds before concluding that the machine was out of order and would not dispense his cash. However, his recollection of the length of time he had waited became far less certain as our investigation progressed.
We noted from the cash machine's audit trail that there had been a gap of three minutes after Mr O had attempted to withdraw cash and before the next customer used the machine.
We concluded that it was more likely than not that Mr O had simply failed to wait quite long enough for the machine to dispense his cash. It seemed probable that the cash had then been picked up by a third party after Mr O had left the cash machine. We sympathised with Mr O, but we were unable to uphold his complaint.
Mr A tried, unsuccessfully, to withdraw cash from the machine outside a branch of his bank. He said he had entered his details but had then found that the screen failed to function correctly. The machine retained his card and the cash failed to appear, so he went inside the branch to report the problem.
To his alarm, he subsequently discovered that while he had been inside the branch, £300 had been withdrawn from his account. Someone had used his card at a different bank's cash machine in a shopping mall a few minutes' walk away. And a few minutes after that there had been a further withdrawal of £300 from the same cash machine in the shopping mall.
Mr A's bank agreed to refund the second withdrawal of £300. However, it refused to refund the first withdrawal. It said Mr A must have been "negligent in the care of his card and/or personal identity number ("PIN")". Mr A then brought the complaint to us.
We gathered information from Mr A about his unsuccessful attempt to withdraw money with his card. We also obtained the audit trails from both banks for the cash machines in question.
After examining all the facts, we concluded that Mr A had been the victim of a common scam - often known as the "Lebanese loop". A fraudster tampers with a cash machine so that it appears to "swallow" the customer's card. And having carefully observed the customer using the machine, the fraudster knows the customer's PIN, so can then use the card to take money from the customer's account.
We did not agree with the bank's view that Mr A had been negligent. Applying the provisions of the Banking Code, we upheld his complaint and said the bank should refund both of the £300 withdrawals. We said it should also pay Mr A a further £100 for the distress and inconvenience its mis-handling of the complaint had caused him.
Ms C contacted her bank about a number of cash machine withdrawals that had been made from her bank account over the previous two years.
She denied all knowledge of these withdrawals and said she thought there must have been an error in the bank's cash machine system, causing duplicated or "phantom" transactions to be generated on her account. Alternatively, she suggested, the disputed transactions might have been made by someone using a "cloned" card.
When the bank refused her request to refund all the disputed transactions, Ms C complained to us.
complaint not upheld
Because Ms C's cash card had expired and been replaced during the period in question, the withdrawals involved two different cards. And the disputed withdrawals had been made at machines owned by several different banks.
We noted that most of the disputed transactions were for small amounts and had been made almost immediately after other - undisputed - withdrawals.
In many of the transactions, the cash machines were ones that could "read" the micro-chip in the card and we were satisfied, from all the evidence we obtained, that the cards had not been cloned.
There was nothing in the various audit trails to support Ms C's allegation of a systems fault at her bank, or in the individual cash machines. We concluded, from the evidence, that Ms C herself should be liable for the withdrawals. We did not uphold the complaint.
Mr B's bank statement showed that four separate cash machine withdrawals - for £50, £100, £30 and £30 - had been made during the early hours of a Saturday morning. Mr B disputed two of these withdrawals.
He accepted that he had made the first withdrawal - of £50. He said he had been out celebrating his birthday with a group of friends. He had stopped at a cash machine shortly before 1.00am, while on his way from the club where he had spent most of the evening to a different club, nearby.
However, Mr B strongly denied having made the second withdrawal - of £100. This transaction had taken place at 4.28am at a different cash machine, situated in the town's high street. Mr B said he could not have made this withdrawal as he was certain he had returned home by that time.
Mr B also disputed the withdrawal of £30 - made at 7.00am at the same cash machine in the high street where the £100 withdrawal had been made.
He accepted that he had indeed attempted to withdraw money from that particular cash machine at that time. However, he said the machine had failed to dispense any cash, so the transaction should not have been debited to his account. He did not dispute the withdrawal of £30 made at 7.24am from another cash machine nearby.
Mr B complained to us after his bank refused his request to refund the disputed transactions.
complaint not upheld
We checked through the audit trails from the different cash machines involved. These did not show any error or discrepancy. There were a number of inconsistencies in the different versions of events that Mr B gave us during the course of our investigation. There were also inconsistencies in the information provided by the friends who had shared in his birthday celebrations.
Taking everything into account, we thought Mr B's celebrations had probably gone on for a lot longer than he later recalled. We thought it likely that he had made (but later forgotten about) the withdrawal of £100. And it seemed more likely than not that the cash machine had dispensed the £30 withdrawn at 7.00am, but that he had failed to wait long enough for the cash to emerge from the machine. We did not uphold the complaint.
Every Friday morning Mrs V, a pensioner in her eighties, withdrew £50 from the cash machine outside her local bank branch. On one particular Friday, she said she had just started to use the cash machine when a smartly-dressed middle-aged man had come up to her. He told her that there was a problem with the machine because it had "eaten" his card when he had tried to withdraw some cash. He warned her that she ought to cancel her transaction in case the same thing happened to her.
Feeling flustered, Mrs V pressed the "cancel" button. However, the man told her she had been too late and that the card had already gone. He said that if she dashed into the branch quickly enough, one of the bank staff might be able to open up the machine and get her card out.
Mrs V hurried in to the bank and after queuing up anxiously for several minutes was able to speak to a cashier. She reported exactly what had happened - and how the man had advised her to come in to the bank right away. The cashier told Mrs V that she was not to worry, and that the card would be fine - she would just have to wait a few days for it to be returned to her.
Within 15 minutes of Mrs V reporting to the cashier that the machine had "eaten" the card, someone had made two cash machine withdrawals from her account. The withdrawals - each for £250 - had been made at two different cash machines.
When Mrs V contacted the bank, it refused to refund the disputed withdrawals, saying the problem must have resulted from negligence on her part.
Eventually, after she had made a formal complaint, the bank said it was prepared to allow her an interest-free overdraft of £500 while it investigated. Mrs V then referred the matter to us.
We were satisfied that Mrs V's account of what had happened to her at the cash machine, and immediately afterwards in the branch, was entirely truthful.
It was clear to us that the man who spoke to her had observed her entering her PIN, and had then distracted her in order to obtain the card.
In our opinion, the events that Mrs V reported to the cashier should immediately have aroused suspicions that she had been targeted by a fraudster. The cashier should have recommended that Mrs V's card be "stopped". If he had taken prompt action, the card would have been stopped some five minutes before the fraudster made the first withdrawal.
We did not accept the bank's argument that Mrs V had been negligent in her care of the card or PIN and we upheld the complaint. We said the bank should refund Mrs V both of the disputed withdrawals, and pay her a further £250 for the worry and distress caused by its mishandling of the complaint.
Miss G had a £5,000 overdraft facility in place on her account. When she got her monthly bank statement she was expecting to find that she was overdrawn by around £800. She was therefore very surprised to discover an overdraft of over £1,000.
When she looked at her statement more closely, she found a £250 cash machine withdrawal that she could not account for. She contacted her bank to say she was certain she had not made the withdrawal herself and could not understand how anyone else could have done so.
The bank insisted that Miss G must have been negligent in the care of her card or PIN. So it said that, under the terms and conditions of her account and the provisions of the Banking Code, she was liable for the transaction. Miss G then brought her complaint to us.
The detailed information that we obtained during our investigation led us to conclude that one of Miss G's work colleagues had probably taken her cash card from her handbag - without her knowledge - and had later replaced it.
On several occasions the colleague had gone shopping with Miss G during their lunch break. We thought it likely that the colleague had been able to obtain the PIN by carefully watching Miss G entering the number when she used her card in a supermarket near their workplace.
We were satisfied that Miss G had neither made nor authorised the transaction. And in our view the question of negligence did not arise at all.
Because Miss G's account was overdrawn, the transactions had been made from credit. This meant that the relevant provisions of the Consumer Credit Act 1974 applied. These say that customers are only liable for a transaction if they either made or authorised it themselves - otherwise their liability is limited to the first £50. The Consumer Credit Act, which is a statutory safeguard for consumers, takes precedence over the Banking Code.
So we said Miss G should not be liable for more than the first £50. We also said that the bank should refund the overdraft interest charged on the £250, and pay Miss G £75 for the inconvenience it had caused her by its poor handling of her complaint.
ombudsman news gives general information on the position at the date of publication. It is not a definitive statement of the law, our approach or our procedure.
The illustrative case studies are based broadly on real-life cases, but are not precedents. Individual cases are decided on their own facts.