Disputed ATM transaction

Is there any press report, or web link, for this?

cameras were put in machines to identify people taking money and saying it wasn't them - tell him to watch out as if he can be identified he will be off to prison! the police have told the bank what to do while they watch him.

If you were right (and obviously you're talking bollocks) the bank would have confronted the customer with the recording, and he would have said "I'm terribly sorry. I must have Alzheimers. I drew the cash out and the memory of that event went clear out of my head. I shall get some medical treatment" and he would not have had the gall to sue for his money.

Afraid not. The customer is a mate of mine. He has no interest in going to the Press, but might possibly write to the Banking Ombudsman to say "a fat lot of use you people are, but I got my money back anyway". Or something a bit more polite, to that effect.

The Todal posted

Personally, I'd write something a lot *less* polite to that effect.

Indeed: in general in the UK there's no systematic recording of ATM users correllated with transactions (they may be caught on eg carpark CCTV but there's no way to identify a particular transaction from that even if the bank can get hold of it).

Recording would only prove that it wasn't you, so the bank's allegation that you leant the card to someone else would still stand. Though the bank generally won't have a picture of you on file to compare with any CCTV.

Did your friend try the Ombudsman and what did they say? That answer would be interesting to know.

And did it go via the small claims court, or full County Court proceedings? I attended a recent case (Job v Halifax) in Nottingham County Court[1] which was on the fast track process but not, I think, small claims (the amount was about 3000 pounds). In that case Halifax did put up a defence and won, though the evidence presented was fairly poor on both sides.

I'd be interested to hear more details of the case with my professional hat on. (If you'd rather not post further details, feel free to email)

Theo (Banking security research, University of Cambridge Computer Laboratory, speaking personally)

"Roger" is on various groups talking bollocks.

Forgot Roger for a moment.

I did read where some people claimed that there credit or debit card was used at atms without authorization and without being careless. Even through Rogers story may be bollocks. (Yes, I know what bollocks means). This does not mean it cant happen. In those cases I did read both in the U.S. and in the U.K. sometimes the bank wins and sometimes the customer wins. One of those that won, is he did a transactions almost at the same time the thief did. So, the bank couldn't prove he was in two places at once. I read this on Google news. Sorry, I don't keep the links but there were stories on this.

Greg

The banks claim they know from their records whether or not the card was cloned. That seems dubious to me.

If only the bank could produce a photo or video of the person who drew out the money, there might be a chance of getting the police involved. However, I do wonder whether it was pure computer error and not fraud.

Yes, the ombudsman deliberated, asked various questions, and then concluded that she was unable to reach a finding of fact that my friend must be telling the truth since it was his word against the bank's computer records. I can understand that. The ombudsman can hardly say "all the documentary evidence shows that you drew out the money but I can tell from your voice and your style of writing that you are a truthful person so I will say that you are right and the bank is wrong".

It was issued in the local county court, but because the bank failed to file an acknowledgment of service or a defence, judgment was entered in default. At that point the bank knew that to set judgment aside would involve a fee of 75 quid, I suppose, and therefore decided to cut its losses.

I attended a recent case (Job v Halifax) in Nottingham County

A transcript would be most interesting.

Glad to make your acquaintance.

Indeed. It's possible to spot some kinds of clones - eg ones where the magstripe data has been tampered with. Another example is where the clone card produced the wrong transaction cryptogram (which isn't checked in an offline transaction). But ATM transactions are always online, so that doesn't apply.

But of course by definition there's no way they can detect a perfect clone. Making perfect clones is hard, though. What's easier is time or distance shifted attacks - having access to the card previously or in another place. The banks haven't discussed any countermeasures against these.

True. And the likelihood of computer error was discussed at length without much insight in the Job case (the bottom line is the banks don't provide statistics so we just have no idea how common it is).

That sounds a reasonable response. We heard of another case where the Ombudsman said the bank had supplied logs in an approved format and thus the transaction must be genuine... without actually checking the content of the logs:

Interesting. What are the costs to file in county court? Was it significantly more than the loss?

The case was only taperecorded so I don't believe a transcript was made, however the judgement can be found here: