It is that awful moment - you have found from getting a mini-statement or maybe receipt of a full statement that someone has been withdrawing cash from your bank or building society account using an ATM (Automatic Teller Machine) card. You have not told anyone your PIN and your card has always been in your possession.
First task is to tell your bank and building society. It is best to do this by telephone. Record your calls when doing so - make notes beside the phone if you cannot physically record the call and write up your notes afterwards. Make it clear to the bank that you have not told anyone your PIN and your card has always been in your possession.
The bank will give you some instructions. Since April 2007, when changes to the Fraud Act were made, it is the banks who should take on investigations for fraud. When they have compiled bundles of evidence, they are meant to pass details on to organisations such as the City of London police, which has a specialist bank fraud unit.
Since March 2008 all UK banks and building societies have signed up to a revised Banking Code. The key provisions in respect of this are set out in Sections 12.12 and 12.13
12.12 Unless we can show that you have acted fraudulently or without reasonable care, your liability for your card being misused will be limited as follows.
12.13 Unless you have acted fraudulently or without reasonable care (for example by not following the advice in section 12.9), you will not be liable for losses caused by someone else which take place through your online banking service.
- If someone else uses your card, before you tell us it has been lost or stolen or that someone else knows your PIN, the most you will have to pay is £50.
If someone else uses your card details without your permission, and your card has not been lost or stolen, you will not have to pay anything.
If someone else uses your card details without your permission for a transaction where the cardholder does not need to be present (for example, buying something over the internet), you will not have to pay anything.
If your card is used before you have received it, you will not have to pay anything.
Section 12.9 referred to above sets out, amongst other things, sensible provisions in respect of keeping your PIN secret and not writing it down. But the Official Guidance written in respect of the provisions in 12.9 expressly says "It does not follow that the Ombudsman or the courts would necessarily find that the failure to follow any of the safeguards set out in these paragraphs by the customer would amount to 'gross negligence'by the customer."
The one thing that you must not do (even though the staff at the bank will tell you to do it), is cut your ATM card in half when you are disputing transactions on that card. Just put the card, intact, in a safe place where it can remain unused until the dispute is resolved. This is because, with modern Chip and PIN cards, there should be information recorded on your card in the Chip which could be useful evidence in support of your statement that you did not use your card and you may therefore wish to have the card analysed - which is only possible in most cases if the card is intact.
This usage information is in a register called the Application Transaction Counter (ATC). The ATC is meant to be incremented by one each time a transaction is initiated. So if your card has not been used in a transaction then it should be the case that the ATC could prove this. However interpretation of ATC data is not easy because it is also possible that the ATC can increment multiple times during at ATM withdrawal. That is because sometimes the ATM will do a balance enquiry prior to dispensing cash, and from the card's perspective, this is a separate transaction. It is also possible that the ATC starts from a number which is greater than zero.
For the above reasons the examination of the card needs to be performed by an experienced independent technician whose analysis is acceptable to the banks and with whom the banks are prepared to co-operate. In any dispute the independent technician will need to be given access to confidential banking logs to analyse any data he recovers from the Chip. (I can introduce you to suitable independent technicians if requested.)
But now is the time to act. Having notified the bank orally by telephone you need to send them a Preservation Letter. There is a suitable draft here.
The Preservation Letter requires the bank to preserve all the evidence. If your case is disputed by the bank they cannot then say that they have lost the evidence or that it has been "destroyed under their normal security policy" since they will have been put on notice of your dispute and what should be kept by them. The police will also be happy about this - if the fraudsters are inside the bank then the evidence may be there to convict them.