A one-day trial that raises questions about the security of cash cards used in the U.K. and Europe concluded Thursday, with a decision expected in about a month.
Alain Job sued U.K. bank Halifax in March 2007 over eight withdrawals made from his account in February 2006. Job maintains he did not withdraw a cumulative £2,100 (US$3,100). He also maintains he did not authorize anyone else to withdraw the money.
Job decided to sue after the Financial Ombudsman Service (FOS), which mediates disputes between banks and customers, sided with Halifax.
Job is the first person to sue a U.K. bank over a phantom withdrawal and believes one possibility is that his card was cloned. Halifax maintains that it was his exact card that was used to perform the withdrawals and that either Jobs is knowingly trying to defraud the banks or was grossly negligent in handling his card and PIN (personal identification number).
Job admitted at one point during testimony to putting his cash card in his garden outside one night for some inexplicable reason, according to Alistair Kelman, an attorney who watched the proceedings in Nottingham County Court.
Job is represented pro bono by Stephen Mason, an attorney who specializes in the collection of digital evidence and has written about case law involving disputed cash-machine transactions.
Mason said late Thursday he could not discuss specific details of the case due to court rules. A Halifax spokesman also said the bank had no comment. An expert witness for Jobs said he also could not speak about the case yet.
Security experts who have studied cash-machine “phantom” withdrawals say there are proven ways that criminals can trick cash machines in certain circumstances into accepting bogus cards.
In the U.K. and throughout Europe, banks issue chip-and-PIN cards. They have an embedded microchip that’s used to authenticate transactions and people must enter a four-digit PIN. The PIN must also be used for credit- and debit-card transactions, rather than in the U.S., where a signature completes the transaction.
Studies done by researchers at the University of Cambridge have looked in depth at the chip-and-PIN system and highlighted weaknesses.
The liability rules are different for phantom withdrawal cases in the U.K. than in the U.S., where banks must directly prove fraud in order to reject a claim. In the U.K., that responsibility is on the customer, and banks tend to steadfastly maintain there are no security issues with their systems.
If the judge finds in favor of Job, it could lead to a change where U.K. banks would have to provide a higher level of evidence for phantom withdrawals in order to push the liability to the customer.
The FOS handles about 100 cases a month concerning contested cash-machine transactions, some of which are phantom withdrawals, said spokeswoman Emma Parker. The majority of those cases are found in favor of customers, she said. But the FOS doesn’t not have precise statistics available or releases information about specific cases.
The FOS has published anonymous case studies, some of which concern phantom withdrawals. Parker said “the cases we see turn on their individual circumstances, rather than on whether it is technically possible to clone a chip-and-PIN card.”
It would seem that video cameras by cash machines would resolve cases, but that’s not necessarily right. Even if there’s video, a bank could still argue that the customer making the complaint colluded the person in the video in order to scam money.
There are at least 64,000 cash machines in the U.K., according to Link, a major transaction network provider. Not every one has a video camera, and in Job’s case, there’s no video evidence of the contested withdrawals.