Professional Documents
Culture Documents
Banking Finance Policies and Procedures Manual Extract
Banking Finance Policies and Procedures Manual Extract
The central issue in a dispute about a credit card transaction being wrongly debited
to an account is whether the transaction was authorised. Set out below are:
The conditions of use for credit card accounts together with any terms implied by
the law constitute the contract between the card issuer and the account-holder.
The conditions of use identify each party’s entitlements and obligations, including:
The issue of contractual liability for the transaction therefore primarily turns on
whether the account-holder in fact authorised the transaction. In broad terms, for
the card issuer to debit the account without such authorisation would usually, on the
face of it, be a breach of, or outside the contemplation of, the terms of the contract
by the card issuer.
Investigating Authorisation
Therefore, in all investigations of cases of disputed transactions, this office would ask:
Conclusion
If the transaction was not authorised by the account-holder, then the account-
holder would not be liable for the transaction unless there was a specific term of
the credit card contract, which changed this fundamental relationship between the
cardholder and the issuer bank.
One situation in which, even though the transaction was not authorised,
nevertheless the account-holder may be liable can arise if the account-holder
delayed notifying the financial services provider that he/she disputed the
transaction. (For a full discussion of this possibility see page 8: “Disputing
Transactions Outside Time Limit”).
One situation in which, even though the transaction was authorised by the
account- holder, nevertheless the account-holder may not be liable can arise if
the card was being used over its credit limit. This shift in liability could arise
because:
The account-holder had been misled about the operation of the credit
card limit; and/or
The granting of credit above the approved credit card limit amounted
to maladministration by the financial services provider.
What is a “Chargeback”?
There are varying requirements and time limits within which an issuer
financial institution must exercise its right. The chargeback rights and
requirements are identified in the operating rules of the various card
schemes.
There are different time limits for the exercise of different chargeback rights. The
time limits are specified in the operating rules but they are not disclosed to account-
holders. They may, however, be relevant to the dispute between the financial
services provider and the account holder in a number of ways.
Credit card conditions of use generally warn account-holders that they need to
dispute transactions immediately they receive their account statements. Problems
can arise if this term is not clearly expressed in the conditions of use (For a full
discussion of these issues, see page 8: “Disputing Transactions Outside Time
Limit”).
2. Take care in exercising any chargeback right. This would include using the
most appropriate reason code for the chargeback, so that the account-
holder’s reasons are properly represented, and properly completing
chargeback documentation under the relevant card scheme; and
Q: Did the financial institution exercise its right(s) of chargeback for each
of the disputed transactions?
Q: Did the financial institution use the most appropriate chargeback right
available for each of the disputed transactions?
Q: Did the financial institution satisfy itself that the response it received
from the acquirer bank was an appropriate and full response to the
chargeback right it exercised?
While authorisation is the key issue in determining liability for a credit card
transaction, there may be certain circumstances in which liability for the transaction
lies with the account-holder even though the transaction was not authorised by the
account-holder. This situation can arise if the conditions of use for a credit card
specify that if the account-holder delays notifying his/her financial institution that a
transaction is unauthorised, then the account-holder may be liable for the
transaction.
Conditions of use for credit cards usually include such a term because issuer
financial institutions seek to ensure that they do not lose their chargeback rights
because the right is exercised too late.
This office’s view is that in order for this term in the conditions of use to operate
effectively, it needs to clearly say that a failure to notify the financial institution
of a dispute within a specified time may lead to the account-holder being liable
for an unauthorised transaction.
However, not all financial institutions’ conditions of use are clear. Some conditions
of use say:
BFSO approach
Set out below are this office’s views on the principles to be applied when:
This office’s view is that if the term in the conditions of use requires the account-
holder to notify the financial institution “promptly” or “within a reasonable period of
time” of a disputed transaction then the obligation imposed on the account-holder
is that he/she must not unreasonably delay notifying the financial institution of the
dispute.
In determining whether or not there has been an unreasonable delay, we will look
at the circumstances of the dispute and ask:
Account-holder
An account-holder may say that he/she did not authorise the transaction and so is
not liable for:
Financial Institution
5. The time limit stated in the conditions of use for disputing transactions has
expired;
Analysis
In the event that the financial institution is not able to produce information
demonstrating that the account-holder authorised the transaction, this office’s view
is that the account-holder is not contractually liable for:
However, the financial institution may be prevented from obtaining the necessary
information because the account-holder has delayed in disputing the transaction. If
the account-holder has disputed the transaction outside the specified time limit, the
account-holder has breached the contract and in so doing may have caused the
financial institution loss or damage.
This office’s view is that the damage to the financial institution caused by the
account- holder’s breach of contract is the loss by the financial institution of its
right to chargeback the transaction.
If the account-holder had disputed the transaction within the time limit specified in
the conditions of use, the financial institution could have charged back the
transaction. The outcome of a chargeback would have been either:
In either event, the financial institution would not have had to bear the cost of
the transaction itself.
The financial institution loses both of these options because of the account-holder’s
breach of the credit card contract. This means the damage to the financial
institution is the amount of the transaction.
Because the financial institution is not able to establish that the account-holder
authorised the transaction, it consequently cannot establish that it was entitled
to charge interest (or fees such as foreign currency conversion fees). Therefore,
the financial institution is unable to demonstrate that it has suffered loss in
respect of interest and fees as a result of the account-holder’s breach of
contract.
1
1
Conclusion
In summary, the account-holder may be liable for the amount of the transaction
but not for any consequential interest or fees.
However, there are situations in which, even though the transaction was
authorised, nevertheless the account-holder may not be liable. This shift in
liability can arise if the card was being used over its credit limit.
3. The account-holder was misled about the operation of the credit card limit;
and/or
4. The granting of credit above the approved credit card limit amounted
to maladministration by the financial institution.
The discussion below sets out our policy in relation to each of these
scenarios.
Floor Limits
One of the most obvious rights to chargeback arises where the transaction is above
the relevant merchant’s floor limit and no authorisation for the transaction has
been obtained by the merchant from the account-holder’s financial institution.
There may well, of course, be many transactions for which authorisation is not
obtained by the merchant and the transaction is not disputed. This happens on a
daily basis and causes no problem. The problem arises where the account-holder
disputes the transaction and there was no authorisation obtained by the
merchant.
Q: Was the disputed transaction above or below the merchant’s floor limit?
If the disputed transaction was above the merchant’s floor limit, we ask:
If the merchant did not obtain a proper authorisation, then the disputed
transaction would not be valid under the card scheme’s operating rules and the
issuer financial institution should exercise its chargeback rights.
fair because:
3. If the merchant does not obtain the authorisation then the merchant
chooses to take the risk that the credit card transaction may not be valid;
and
Q: Does the account-holder’s account history show frequent over the limit
use of the card followed by repayments?
Misleading Conduct
In some cases, even though the transactions were authorised by the account-
holder, the transactions may be set aside because the account-holder may have
been misled about the operation of the credit card limit.
8. The account-holder provided his card as security for a third party’s hire of a
car in the belief that as the credit limit was )2,000 and his own transactions
14
Conditions of Use
The conditions of use for credit cards usually specify that there is a credit limit for
the card above which credit will not be provided.
On the other hand most conditions of use also anticipate that an account balance
may exceed its limit and provide that the amount in excess of the credit limit must
be repaid immediately.
This office’s view is that the reference to the possibility of exceeding the credit
limit must be read within the context of the prohibition on exceeding the credit
limit.
Therefore, the conditions of use may not amount to a sufficiently clear warning to
an account-holder that drawings in excess of the credit limit may be allowed by the
bank on the account.
The Conduct
In light of the prohibition on use of a card over its credit limit, there is a risk that
an account-holder may be led into the false impression that he/she can only use
the card up to, but not exceeding, the credit limit in the ordinary course.
BFSO investigation
Q: Was the account-holder aware that the credit limit could be exceeded?
Q: If the account-holder did not know that the credit limit could be
exceeded, did the account-holder rely on a perceived limitation of liability
created by the existence of the credit limit?
Q: If the account-holder did not know the limit could be exceeded and relied on
the existence of the limit, what loss, if any, has the exceeding of the limit
caused the account-holder?
Maladministration
Another circumstance in which liability for authorised transactions may shift from
the account-holder to the financial institution, notwithstanding that transactions
were authorised by the account-holder, is if there was maladministration by the
financial institution in the provision of credit to the account-holder.
As with the provision of all loans, a financial institution will assess an application
for credit against its lending criteria. Using such criteria, a financial institution will
calculate the credit limit for a customer’s credit card account. A failure to properly
assess an application for a credit card may lead an account-holder to incur a debt
that he/she cannot service and may amount to maladministration by the financial
institution in the decision to lend. Disputes of this kind are dealt with in
accordance with the Ombudsman’s maladministration policy (see page 23).
The disputes we have investigated of this kind include the following scenario:
The disputant had a credit card account with a limit of $3,000. She was
unemployed. She was able to use her card to make purchases that led to a
debit balance on the credit card account of more than $13,000. The financial
institution became aware that the disputant had exceeded her credit limit
when it was approximately 10% over the credit limit. It took some action to
contact the disputant but did not manage the rising debt in accordance with
its usual guidelines.
BFSO investigation
Q: Did the financial institution follow its usual procedures in the management
of the debt?
Q: What options for recovery of the card and stopping use of the card were
available to the bank?
Q: What steps did the financial institution take to contact the account-
holder to discuss the use of the card over the credit limit?
Difficulties in assessing a dispute can arise when the credit card is used for
numerous transactions below merchants’ floor limits. This use can take the card
over its limit. This practice is well known to financial institutions. The difficulty
that arises is determining when such use takes the card limit so high that the
provision of credit amounts to maladministration.
The approach this office takes is to look specifically at the procedures the financial
institution has in place to monitor and deal with credit card use of this sort. We may
ask:
Assessing loss
Secondary Cardholders
Difficulties arise when there is a dispute existing between the primary and
subsidiary cardholder that often means that the primary cardholder cannot
obtain access to the subsidiary card.
Therefore, those banks that provide limited stopping for their account-holders will
18
A limited stop is the stop placed on the card to allow it to be captured at an ATM
or when a merchant seeks authorisation for a transaction. The stop will not enable a
bank to stop the card being used for purchases that are below a merchant’s floor
limit.
An issue, which has also arisen in the context of these cases, is whether a
financial institution could take some sort of action on behalf of an account–
holder when:
This office understands that it may not be technically possible for a financial
institution to “stop” a merchant processing a direct debit to the account, however,
given that the debit has been cancelled by the account-holder, the financial
institution is obliged contractually to accept this cancellation (see pages 48 - 50).
Therefore, in this situation, this office considers good industry practice requires that
when a financial institution has been notified of this problem, the financial
institution should ensure that all future transactions under the direct debit authority
are charged back by the financial institution on behalf of the account-holder.
Another significant area of concern for disputants has been the account-holder’s
ability to stop direct debits being debited to his/her card account. This issue is
particularly significant where the credit limit has been exceeded.
Many financial institutions’ credit card conditions of use do provide for the
cancellation of direct debit authorities.
A term in the general or “Using Your Card” section of the conditions of use requiring
an account-holder to cancel the direct debit authority with the third party may be
enforceable.
Conclusion
BFSO investigation
Therefore the questions we will ask when investigating these disputes include:
Q: Did the account-holder instruct the financial institution, but not the third
party, that direct debits from the third party to the credit card account
should not be accepted by the financial institution?
If yes, the account-holder is entitled to do this and thereby stop the debit
arrangement unless the conditions of use vary the general rule.
Q: Do the conditions of use for the card instruct account-holders that they must
also cancel the direct debit with the third party?
If yes, then the account-holder usually would not be required to have also
contacted the third party before the bank should stop the direct debit in the
event that the account is being kept open and the card not cancelled.
If yes, then the account-holder would need to cancel the direct debit authority with
the third party as well as the financial institution in order to ensure the payment was
not debited to the account.
21
The Ombudsman has considered several cases where financial difficulties have been
suffered by customers because of the financial services providers’ practice of treating
a merchant’s request for confirmation that there are available funds in a credit card
account as a request for authorisation for that amount.
Effect on Customer
The effect is that a cardholder may find that he/she has no available credit even
though his/her purchases and other charges to the account are well within the credit
limit.
Particularly where the customer is overseas at the time, the effect can be
acute financial difficulty.
The Ombudsman’s view is that, unless a financial services provider has disclosed to
customers the effect of these “authorisations”, there is no contractual basis for
reducing the customer’s credit limit. While there may be an agreement between
the cardholder’s financial services provider and the merchant’s bank to treat these
queries as authorisations, in most cases there is nothing in the agreement between
the cardholder and the cardholder’s financial services provider which:
The sales voucher specifically authorises the travel agent to rely upon the
signature given for one charge to later vary that charge and to make
further charges;
The sales voucher put the cardholder on notice that this may be done;
The history of the EFT Code in Australia dates back to September 1986, when a
Commonwealth Government Working Group launched a document called
“Recommended procedures to govern the relationship between the users and
providers of Electronic Funds Transfer (EFT) Systems”. That document was amended
and relaunched in December 1989 as the Electronic Funds Transfer Code of Conduct
(“EFT Code”). There were further amendments in 1991 and 1998, but during all this
period the EFT Code was restricted to electronic transactions effected by card and
PIN.
As well as covering card and PIN transactions, the revised EFT Code covers other
forms of EFT transactions such as transactions initiated by telephone and internet
(including credit card transactions made over the telephone or internet).
Anticipating the development and introduction of new electronic facilities, the
revised EFT Code also includes a section on consumer stored value products such as
smart cards and digital cash. The main exclusions from coverage by the revised
EFT Code are transactions authorised by manual signature (such as credit card
purchases conducted in the presence of the merchant) and transfers to or from an
account designed primarily for use by a business and established primarily for
business purposes.
23
The text of the revised EFT Code is obtainable from the ASIC website:
fido.asic.gov.au. ASIC also publishes a plain-english guide entitled: “Your guide to
the EFT Code”. The Banking and Financial Services Ombudsman (“BFSO”) is the
principal external dispute resolution body that investigates complaints about
unauthorised electronic transactions by reference to the EFT Code. Apart from
this policy and procedures manual, BFSO also publishes occasional commentaries
on the EFT Code through its quarterly Bulletin. Comment on the revised EFT Code
is contained in Bulletin No. 35 (September 2002) and Bulletin No. 37 (March 2003).
BFSO Bulletins can be downloaded from the BFSO website: bfso.org.au.
The main focus of the EFT Code is to set out the principles for allocating
liability in disputes about unauthorised electronic funds transfer transactions.
Members of the public who hold accounts with an account institution may not
necessarily be aware of the existence of the EFT Code. Their relationship with
their account institution will be governed by the terms and conditions of use
(“T&Cs”) for each particular type of electronic banking facility. However, there
should be no difference between an allocation of liability under the EFT Code and
an allocation of liability under T&Cs. This is because clause 2.1 of the EFT Code
provides that:
account institutions will prepare clear and unambiguous T&Cs that reflect
the requirements of the EFT Code;
T&Cs are to include a warranty that the requirements of the EFT Code will
be complied with; and
All account institutions that are members of the BFSO scheme and that offer
accounts with electronic access to their customers have notified ASIC that they
have subscribed to the EFT Code and have warranted in their T&Cs that they will
comply with the EFT Code. Therefore, the Ombudsman reaches decisions in relation
to EFT disputes by applying the principles set out in the EFT Code.
Account institutions usually include a section in their T&Cs dealing with the need for
account holders to protect the security of devices (i.e. cards) and codes (i.e. PINs
and passwords) that enable access to electronic banking facilities. Although
previous versions of the EFT Code did not comment on the relationship between
security guidelines and liability provisions in T&Cs, it was the Ombudsman’s policy
that liability could only be determined by reference to the liability provisions of the
EFT Code rather than by reference to failure to observe security guidelines.
The revised EFT Code has clarified the matter by providing, in clause 5.8(b),
that account institutions may:
24
This is not to say that there is no point to security guidelines. They provide
guidance to account holders about practical measures that can be taken to maximise
the security of accounts and access methods. But, when unauthorised transactions
do take place, the security guidelines cannot override the liability provisions.
The EFT Code is very specific about the circumstances in which liability for
unauthorised transactions may be allocated to an account holder. Liability may not
be allocated for reasons other than those set out in the EFT Code. The liability
provisions, set out in Clause 5 and its sub-clauses, can be summarised as:
No Liability
(Where the access method uses a device), losses that occur before the
user received the device or code, including a re-issued device or code;
losses occurring after notification that a device has been misused, lost
or stolen or that the security of codes has been breached; or
Full Liability
the account institution can prove on the balance of probabilities that the
user contributed to the losses through fraud or contravention of certain
specified requirements in the EFT Code; or
the account institution can prove on the balance of probabilities that the
user contributed to the losses by unreasonably delaying notification after
becoming aware of the misuse, loss or theft of a device forming part of
the access method, or that the security of codes forming part of the access
method has been breached.
The requirement in the revised EFT Code for an account institution to be able to
prove on the balance of probabilities that the user contributed to the losses indicates
that the account institution must both:
1. Prove on the balance of probabilities that the user contributed to the losses
in one of the ways specified in the EFT Code; and
In practical terms, this means that the onus of investigation is placed on the
account institution. This is consistent with the requirement in clause 10.4(b) of
the EFT Code that, when it receives a complaint about an unauthorised EFT
transaction, the account institution is required to obtain from the user at least the
information outlined in the Schedule to the Code. If the investigation is properly
carried out, the account institution should have enough additional information, in
conjunction with its own technical information, to make an appropriate allocation
of liability.
BFSO’s role is then to assess the information provided to it by both the bank and the
disputant, subject to any required clarification, and decide whether we can establish
on a balance of probabilities that the user contributed to the losses in one of the
relevant ways.
For access methods that use a code or codes, a user contravenes the requirements
of the EFT Code if they:
where the access method uses a device, indicate the code(s) on the outside
of the device or keep a record of the code(s), without making any
reasonable attempt to protect the security of the code record(s), that is
liable to loss or theft simultaneously with the device; or
for access methods using code(s) without a device, keep a record of the
code(s), without making any reasonable attempt to protect the security of
the code record(s); or
act with extreme carelessness in failing to protect the security of all the
codes.
Limited Liability
Provided that a code was required to perform the unauthorised transactions, and
where the account institution cannot prove on the balance of probabilities that the
user contributed to the losses, the account holder’s liability is limited to no more
than )150.
The limited liability clause, clause 5.5(c), makes three further statements about
the application of limited liability:
the fact that an account has been accessed with the correct access
method, while significant, will not of itself constitute proof on the
balance of probabilities that the user contributed to losses; and
BFSO sometimes receives disputes from account holders who consider that
they should not be liable even for the limited amount of )150.
27
Provided that a code (i.e. a PIN or password) was required to perform the
unauthorised transaction(s), BFSO considers that investigation into disputes about
limited liability is not warranted, except where:
Even where an account holder is otherwise fully liable, their liability does not
include:
losses that exceed the daily or periodic transaction limit for the
access method, account or electronic equipment (or a combination
of these);
losses incurred on any one account that the account institution and the
account holder had not agreed could be accessed using the access
method.
For unauthorised credit card transactions, account institutions shall not hold account
holders liable for more than the liability there would be if the account institution
exercised any rights it had under card scheme rules at the time the complaint was
made.
Account institutions may not avoid obligations owed to users by reason only of the
fact that they are party to a shared EFT system and that another party to the
system has actually caused the failure to meet the obligations.
It is important to note that the EFT Code imposes no general duty of care on a
user or account holder.
There is a general presumption at law that an account holder should not be liable
for unauthorised transactions on their account unless they contributed to those
losses.
But when the means of authorisation is a PIN or password, rather than a signature, it
is often difficult to determine issues of authorisation and contribution because there
may be insufficient information to determine either the identity of the person who
entered the PIN or password or the means by which knowledge of a PIN or password
was gained.
The EFT Code deals with the problem of insufficient information by providing that
an account institution may not allocate full liability unless it can prove on the
balance of probabilities that the user contributed to losses. The difficulty that an
account institution has in meeting this onus of proof means that many complaints
about unauthorised transactions are settled by limiting the account holder’s liability
to )150.
The starting place for any investigation is the Schedule to the EFT Code. The
Schedule sets out the information to be obtained, where available and relevant,
from a user who lodges a dispute concerning the authorisation of an EFT
transaction. The Schedule reflects the requirements of Clause 10.4 of the EFT
Code.
(a) an extract from the transaction log for the relevant EFT
access method;
(b) details of the last undisputed transaction;
(c) details of the account holder/user’s notification of the misuse, loss
or theft of a device, or breach of code security; and
(d) any other material relevant to the account institution’s decision;
5. Where the disputed transaction was conducted with card and PIN,
whether and in what circumstances the card was recovered;
8. Either the reference code identifying the Terms and Conditions applicable to
the account at the date the disputed transactions occurred, or a copy of
those Terms and Conditions;
9. Where the disputed transaction was conducted with card and PIN:
(a) a description of the method by which the user gains access to the
access method, including mention of every identifier and code that
must be input to gain access;
(b) the date the account holder /user first requested access to the
access method;
(c) the date the account holder/user first selected the code(s)necessary
to gain access to the access method;
(d) the date of the last code change made by the account holder/user
prior to the disputed transactions; and
5. Any other relevant information that could account for the misuse of a card
or the misuse of phone and internet banking facilities.
After collating all the information requested from the account institution and
the account holder/user in a particular case, we assess the information according
to the following criteria:
31
2. Given the relevant established facts, what are all the possible
reasonable explanations for the fact that the disputed transactions
occurred. This will include an assessment of whether there is any
possibility that the disputed transactions were carried out by the user or
by some other person with the user’s knowledge and consent, i.e.
whether there is any possibility that the disputed transactions were
authorised rather than unauthorised;
3. For each of the possible reasonable explanations about how the transactions
occurred, what is the degree of likelihood that should be accorded to each of
them;
(a) it is clear that the user did not contribute to the losses, such that
the account holder has no liability; or
(b) on the balance of probabilities, the user did contribute to the
losses, such that the account holder has full liability; and
6. Should the account holder’s liability be limited to )150, on the basis that
the relevant established facts are not sufficient to prove on the balance of
probabilities that the user contributed to the losses.
The great majority of disputes considered by BFSO require the Ombudsman to form
an opinion as to whether, on the balance of probabilities, the account institution has
proved that the user contributed to the losses resulting from unauthorised
transactions by contravening the requirements set out in clause 5.6 of the EFT Code
(as summarised above), or by unreasonably delaying notification to the account
institution.
We set out below our approach to assessment of the following concepts that
govern the allocation of liability, namely:
2. The voluntary disclosure by the user must contribute to the losses for the
account holder to be liable. This means that a causal connection must be
established between the voluntary disclosure and the consequent losses.
That causal connection might be lacking where, say, an account holder
acknowledged having disclosed a code to a family member but the
unauthorised transactions were carried out by an unrelated third party
following theft of a card;
7. The user makes a reasonable mistake of fact or law that the code
disclosure is authorised or required by the account institution or the law in
the circumstances.
33
The assessment of whether or not a user should reasonably have believed that they
were disclosing the PIN to a person in authority, or as a result of a mistaken belief
that they were authorised, or compelled by law, to do so, will be assessed in light
of the educative activities undertaken by the user’s account institution about code
security. At the same time, BFSO recognises that attacks on the security and
integrity of the electronic banking system are increasing in sophistication, as
demonstrated by the creation of fraudulent internet banking websites to capture
account identification and password information. Accordingly, BFSO will take into
account the extent to which the reasonable user of electronic funds transfer
facilities could be expected to understand the means by which the security and
integrity of the system can be circumvented, and to appreciate the extent of
electronic fraud.
The revised EFT Code defines a device as “a physical device used with
electronic equipment to access an EFT account”. Most commonly, a “device”
is a card that is used in combination with a PIN or password to access an
account.
Card issuers warn that the best way to keep a code, i.e. a PIN or password, secure
is to memorise it. However, this is not always possible. In assessing whether a
user has contributed to losses by keeping a record of a code that was liable to loss
or theft simultaneously with the device, the following principles apply:
2. The user must not indicate the code on the outside of the device;
There are two aspects to the concept of making a reasonable attempt to protect
the security of a code record, which includes either or both of:
making any reasonable attempt to disguise the code within the record;
or
Definition of “simultaneous”
During the development of interpretative policies for the 1998 version of the EFT
Code, the Ombudsman received a number of submissions to the effect that
“simultaneous” should be interpreted as meaning “in the same event”.
34
The submissions were to the effect that if a thief broke into a cardholder’s home
and stole a card and a record of the PIN during the same burglary then this would
reflect the intent of the EFT Code to make a cardholder liable if they kept their
card and PIN record in such a way that they could be taken together. There are
various gradations in this analysis: for example, the burglary could take 3 hours or a
few minutes; the card and PIN record could be in the same room or different
rooms.
The Ombudsman’s view is that “simultaneous” loss or theft would occur where
the device and code record are:
in the same receptacle that itself can be lost or stolen (for example, a
wallet, handbag, briefcase or suitcase); or
in the same location within the same room (for example, on the same
desktop or tabletop, or in the same drawer or box) so that device and code
record can be seen together and taken in the same instant.
In the case of theft from a vehicle, however, the Ombudsman’s view is that
“simultaneous” loss or theft would occur when both device and code record were
in the vehicle, even if they were in different compartments of the vehicle, e.g. the
device in a centre console and the code record in the glove box.
Rationale
The rational for the Ombudsman’s policy is that he has reached this view based
on:
the fact that while the EFT Code is concerned to ensure that users are not
grossly negligent, the recognition that a code record may be kept only
implies an obligation on the user to exercise a reasonable standard of care
to keep a device and a code record a reasonable distance apart.
With regard to theft from vehicles, the Ombudsman’s rationale is that a vehicle is a
particularly confined space that facilitates the easy removal of any objects contained
in that space.
35
Record of a Code
The 1998 version of the EFT Code contained no reference to the fact that
account institutions had introduced systems that enabled cardholders to self-
select a PIN of their own choosing.
The obvious intent of the self-select facility was that it enabled a cardholder to
choose a PIN that they would remember easily, thus making it less likely that the
cardholder would create their own PIN record – either at the time of or after
choosing the PIN.
The problem that the Ombudsman faced was whether it could be said that a
cardholder had contributed to losses where they self-selected a PIN that was a
number or word that could be found on other cards or documents usually carried by
the cardholder in their wallet, but the number or word:
was created and kept for a purposes other than as a memorial of the PIN
(e.g. a date of birth on a driver’s licence); and/or
The problem typically arose in the context that the cardholder had self-selected
their PIN to be the same as, or based on, their date of birth and information about
their date of birth was contained on their drivers licence.
The policy that the Ombudsman developed for the 1998 version of the EFT Code
was that a record of information created for purposes other than the recording of
a PIN and/or a record of information created before the generation or selection of
a PIN would usually not be considered to be a “record of the PIN” because:
Because it also covers telephone banking and internet banking, the codes for which
are usually required to be nominated by the user, the revised EFT Code does
acknowledge the existence of self-selected codes. It also recognises the dangers
that arise from selecting a code that can be found on other cards or documents by
proscribing the self- selection of the user’s date of birth or name as a code.
36
So the practical guidelines developed after 1998 to deal with information that
appeared on a document such as a drivers licence will not always apply to
disputes under the revised EFT Code. However, the Ombudsman will still apply
the same general principles when considering what constitutes a record of a code,
namely that:
Self-selected Codes
which the account institution requires the user to keep secret; and
which the user must provide (in any manner) to or through a device
or electronic equipment in order to access an EFT account.
PINs for cards (which are known only by the card user and which are not
held on file by the account institution even though they may be generated
by the account institution); and
The revised EFT Code recognises that the security of self-selected codes can be
compromised if the chosen code is so closely connected with the user that it could
be guessed or ascertained from other information by an unauthorised third party.
To counter the most obvious problems, without unduly limiting a user’s ability to
choose easily remembered codes, the revised EFT Code provides that a user
contravenes the requirements of the EFT Code if they select a numeric or
alphabetical code that:
the code is chosen after the account institution subscribed to the revised
EFT Code [generally, this date is 1 April 2002 - the date from which the
EFT Code became binding on Code subscribers]; and
37
The EFT Code goes on to provide that, where this particular clause applies, the
onus will be on the account institution to prove on the balance of probabilities
that it gave the specific instruction and warning to the user at the time specified
and in a manner designed to focus the user’s attention specifically on the
instruction and the consequences of breaching it.
1. The EFT Code only restricts self-selected codes in the two specific
instances. Otherwise, there are no restrictions on the type of code that
can be selected;
4. Where a user disputes that, immediately before selection, they were given
the instruction and warning BFSO will require the account institution to
prove that it gave the instruction and warning. Such proof might be in the
form of a signed acknowledgment by the user that they received the
instruction and warning. In the absence of proof, BFSO would not
automatically assume that the instruction and warning was given;
6. The wording of the revised EFT Code implies that, where the selection or
change of code is done in the presence of a staff member of the account
institution, the instruction and warning would normally be given orally.
Where the selection or change of code can be effected through an ATM,
computer, telephone or other electronic terminal or equipment, system
software should insert a prominent instruction and warning at the relevant
point of the self-selection program.
The concept of making a reasonable attempt to protect the security of a code record
applies to both code records that are used in conjunction with a device, and to stand
alone code records used in access methods such as telephone banking and internet
banking.
38
A user is not required to protect the security of identifiers, that is: non-secret
information such as account numbers, customer identification numbers, card
number and card expiry date.
More care must be taken with codes used to access telephone banking and internet
banking. For facilities that need only one code to gain access, a user may be liable
for unauthorised transactions if any record of that code is found by an unauthorised
person unless the user has made a reasonable attempt to protect the security of
that code record. For facilities that need two or more codes to gain access, whether
or not the user is liable will depend on whether the user kept the multiple code
records on the one article, or on several articles liable to loss or theft
simultaneously; and whether or not the user made a reasonable attempt to protect
the security of those code records.
The Ombudsman’s guidelines developed for the 1998 EFT Code are still relevant to
the revised EFT code.
3. Concealing the code record’s identity as a code record by placing the record
in a location or context where it would not be expected to find a code.
For example, by concealing the code on a piece of paper in a cookery
book; or
In assessing whether a user has made a reasonable attempt to disguise the code,
the following principles apply:
39
Standard of attempt
1. The attempt to disguise the code does not have to be the most
reasonable that could have been undertaken;
of average intelligence;
who has sufficient, but not specialised, computer skills when it comes
to using facilities such as internet banking; and
4. The Ombudsman will consider on the facts of each case whether the user
made a reasonable attempt to disguise the code within the meaning of the
EFT Code, taking account of all relevant information including:
Educative activities
To ensure that users and account holders have clear guidance on which methods of
disguise could be used and which should not be used as they are more easily
penetrated, account institutions should tell users and account holders about these
disguises in:
1. T&Cs;
4. Advertising campaigns.
birth date;
postcode; or
telephone number;
The inclusion of a method of recording a code in this list does not create a
resumption that an attempt to disguise a code using that method is always
unreasonable. That is a question of fact and context in each case.
The revised EFT Code allows that a user might not have contravened the
requirements of the EFT Code by keeping a code record that was liable to loss or
theft simultaneously with a device, if they took reasonable steps to prevent
unauthorised access to the code record.
Although the End Notes do not form part of the EFT Code, clause 20.3 provides
that they may be used to interpret the EFT Code. Accordingly, the Ombudsman
adopts the End Note as part of these guidelines.
This concept is similar to the Ombudsman’s view that a code may be disguised by
concealing the code’s identity as a code record by placing the record in a location
or context where it might not be expected to find a PIN; for example, on a piece
of paper in a cookery book.
Where disputes occur in the context that an undisguised code record was liable to
loss or theft simultaneously with a device, the type of situation that is likely to
arise is where the undisguised code record is hidden among other entries in an
address book, diary, personal organiser or such like that was carried along with a
device in a handbag, briefcase, backpack or similar container.
Generally speaking the Ombudsman would not accept that such a record was in a
place where a code record would not be expected to be found. However, according
to the circumstances of a particular case, he would consider whether the
undisguised code record was reasonably “hidden” among the other records.
With regard to codes for telephone banking and internet banking, an undisguised
code hidden in a folder with other banking records could not be accepted as being
in an “unexpected place”. But such a telephone/internet code hidden in a folder
unrelated to banking topics in a filing cabinet could be accepted as being in an
unexpected place and/or hidden among other records.
42
The revised EFT Code, in sub-clause 5.5(b), goes on to provide that the account
holder is liable for the actual losses which occur between when the user became
aware (or should reasonably have become aware in the case of a lost or stolen
device) and when the account institution was actually notified.
The revised EFT Code also comments, in sub-clause 5.5(c), that in determining
whether a user has unreasonably delayed notification, the effect on the user of any
charges imposed by the account institution relating to the notification or the
replacement of the access method must be taken into account.
The Ombudsman takes the following view when assessing the two times from
which delay in notification could be measured:
Actual awareness
As a first step the Ombudsman will make an assessment of the time at which the
user actually became aware of the misuse, loss or theft of a device, or that the
security of code(s) had been breached (e.g. by becoming known to an unauthorised
third party).
For a user to actually become aware of this fact requires more than doubt or
suspicion. For example:
usually, a user will need to check that a device has not been misplaced
before they actually become aware that the device has been lost or
44
usually, a user’s doubts or suspicions that someone may have seen them
enter a code at a terminal will not make them actually become aware
that the code has become known to someone else; and
for a user to become aware that the security of an access code for telephone
or internet banking has been breached, it would usually be necessary for
them to actually become aware that unauthorised transactions appear on
the account or, at least, that the account balance is significantly less than
expected. However, the mere fact that account statements were sent to the
account holder would not in itself mean that the account holder actually
became aware of unauthorised transactions at the time the statement was
sent.
In the case of loss or theft of a device, an account holder’s liability commences from
the time that the user should reasonably have become aware of the loss or theft.
Note that this test does not apply where a device has only been misused (i.e. not
lost or stolen) or when code security has been breached.
The time at which a user “should reasonably have become aware” arises when a
reasonable user, with the actual user’s pattern of card use and in the actual user’s
circumstances at the time, would reasonably have checked on the presence of the
device, either to use it or to confirm that the card was still in their possession, in
such circumstances as:
where a reasonable period has elapsed since the user last saw or verified
the presence of the device, and it would reasonably be expected that the
user would have looked for the device to use it by the end of that period
(taking account of the actual user’s normal usage patterns and variations
due to circumstances such as illness, or being at home, or on holiday).
The test of when a user should have checked the whereabouts of their device does
not impose an obligation on the user to regularly use the device. The test is
subjective.
This means that the Ombudsman would look at the user’s usual practices and
their explanations for any variation from that practice.
It is not an unreasonable delay for the user to take a reasonable time to ensure that
the card has not been misplaced, to search for the card if the cardholder believes it
has been lost, or to notify police or security officers before notifying the account
institution. Nor, if they become aware of the loss or theft within branch opening
hours, is it unreasonable delay for the user to notify a branch rather than use the
account institution’s telephone hotline or customer contact line. Furthermore,
delays in notification caused by congestion on a telephone line or in a branch are
not unreasonable delays by the user or account holder.
45
The requirement to take into account the effect on the user of charges is illustrated
by the following scenario:
the account institution denied the claim on the basis that the
user unreasonably delayed notification; and
the user delayed contacting the account institution because they were
unsure whether they had lost the card and did not want to unnecessarily
incur the inconvenience and costs associated with obtaining a replacement
card.
putting themself in a position where they may have to show that they
acted reasonably in taking extra time.
In order to test whether the time taken was reasonable, this office would ask
questions to discover:
1. Whether the user had good grounds for doubting that the card had really
been lost or stolen;
2. Whether the user had previously incurred this inconvenience and cost
unnecessarily;
4. How much longer the search took as a result of this concern about
those costs, e.g. 5 minutes, 3 hours, a day?
All of these matters would be taken into account in assessing the case.
Summary
then the user does not contribute to the loss from that unauthorised transaction
and the account holder would not be liable on the basis that the user unreasonably
delayed notification.
Unauthorised internet card transactions that are reported to the card issuer within
chargeback time frames are usually resolved to the satisfaction of the account
holder because the card issuer has been able to exercise its charge back rights.
The disputes that are brought to BFSO generally involve circumstances where the
account institution’s charge back rights have expired by the time unauthorised
internet-based credit card transactions were brought to it’s attention. However,
because these transactions are covered by the EFT Code, the issue of account
holder liability has to be considered as an entirely separate issue to whether or
not the account institution still retains chargeback rights.
Because internet-based credit card transactions only require the input of non-
secret identifiers (i.e. card number and expiry date), without the need to input a
secret code, the EFT Code limits the circumstances in which an account holder
could be liable for unauthorised internet-based transactions.
End Note 4 to the EFT Code comments, among other things, that:
code, now comes within the scope of the EFT Code (e.g. use of a credit
card number through telephone or personal computer to make a
purchase)”; and
“The user is not liable for unauthorised transactions based on the use of an
identifier without a code or a device. The user is liable for unauthorised
transactions based on the use of a device (or a device and an identifier)
without a code only where the user unreasonably delays in notifying loss or
theft of the device.”
The general conclusion to be drawn from End Note 4 is that an account holder has
no liability for unauthorised internet-based credit card transactions. This
conclusion is supported by a close examination of clause 5.5(b) of the EFT Code –
the clause that deals with the allocation of liability because of unreasonable delay
in notification.
Point 2 above is usually not applicable to internet-based disputes because the entry
of a code did not form part of the access method.
Where unreasonable delay does apply, the account holder is liable for the actual
losses which occur between when the user became aware (or should reasonably
have become aware in the case of a lost or stolen device) and when the account
institution was actually notified.
Where the device (i.e. the card) was not lost or stolen, neither the account
institution nor the Ombudsman can propose a time from which the account holder
should “reasonably have become aware”. Rather, liability can only commence from
the time of actual awareness of the misuse of the card. Even then, there could only
be liability on the basis of unreasonable delay if a misused device formed part of the
access method.
For internet-based credit card transactions, identifiers input into a computer are
the primary access method. Whether or not the “unreasonable delay” clause is
applicable turns on whether or not the device (i.e. the card) also formed part of
the access method. However, it does not seem that the device forms part of the
access method for internet-based transactions because:
2. The access method for internet-based card transactions only requires the
card number and expiry date to be keyed-in at a computer terminal;
Where a device does not form part of the access method, there can be no
contribution to losses on the basis of unreasonable delay in notification. Therefore, as
all other possible reasons for allocating liability are eliminated because the access
method does not use a code, there does not seem to be any basis in the EFT Code by
which liability can be allocated to an account holder for unauthorised internet-based
credit card transactions.
Even if a device did form part of the access method, liability on the basis of
unreasonable delay in notification could only commence from the time that the
account holder actually became aware of the misuse of a card. However, even
though they may concede that they received statements, opened them and read
the account balance, it could still be the case that an account holder who does not
check each transaction in detail could still be unaware of unauthorised
transactions.
In internet card disputes, the Ombudsman cannot determine that an account holder
should reasonably have become aware of unauthorised transactions at the time of
opening statements, because the “should reasonably have become aware” test can
only be applied where a card has been lost or stolen. The “should reasonably have
become aware” test cannot be applied in circumstances where the account holder
still has a card in their possession, and the transactions result from misuse of the
card number.
When a user disputes a transaction with their account institution, the EFT Code
sets out a number of procedures for the allocation of liability and the
investigation and resolution of disputes. In summary, the account institution is
required to:
5. Obtain from the user at least the information outlined in the Schedule to
the EFT Code;
7. Make its decision on the basis of all relevant established facts and not on
the basis of inferences unsupported by evidence;
49
6. Where it has advised the need for more time, complete its investigation
within 45 days unless there are exceptional circumstances;
8. Advise the user in writing about the outcome of the investigation, together
with reasons for the outcome including references to relevant clauses of
the EFT Code and, except where the complaint is resolved completely in
favour of the user, contact details for its external dispute resolution body.
While the time frames mentioned above are generally applicable, the revised EFT
Code substitutes different times where the disputed transaction concerns a credit
card account and the account institution decides to resolve the complaint by
exercising its rights under the rules of the credit card scheme:
the time limits under the rules of the card scheme apply in lieu of the 21
and 45 day limits; and
Where an account institution fails to observe any of these procedures, and where
the failure contributed to a decision against the account holder or delayed the
resolution of the complaint, the external dispute resolution body may determine
that the account institution is liable for part or all of the amount in dispute.
Full liability may not be allocated to the account holder unless the “relevant
established facts” are sufficient to allow the account institution to prove on the
balance of probabilities that the user contributed to the losses within the narrow
confines of the
50
EFT Code. Where the “relevant established facts” are not sufficient to provide
such proof, the account holder’s liability must be limited to no more than )150.
2. The EFT Code provides that the fact that an account has been accessed
with the correct access method, while significant, will not of itself
constitute proof on the balance of probabilities that the user contributed
to losses;
3. The account institution may not have collected from the user at least
the information specified in the Schedule to the EFT Code;
5. The account institution may not have given reasons for the outcome of its
investigation that include references to relevant clauses of the EFT Code
and/or may not have given contact details for its external dispute resolution
body.
The Ombudsman’s view is that if an account institution takes more than 45 days to
complete an investigation then this is, on the face of it, an unreasonable delay by
the account institution and, therefore, a potential breach by the account
institution of clause 10.12 of the revised EFT Code.
To avoid being in breach of EFT Code requirements, the account institution would
have to be able to show that there were “exceptional circumstances” which caused
the delay, and that it wrote to the user to advise them of the reasons for the delay.
The only other circumstance in which the revised EFT Code allows an investigation
to extend beyond 45 days is where the account institution is waiting for a response
from the user and has advised the user that it requires such a response.
51
complaint. The Ombudsman does not consider that systematic delays resulting
from the level of resources allocated to dispute resolution would constitute
“exceptional circumstances” for the purposes of the EFT Code.
Where the complaint involves a credit card transaction, and the account
institution decides to exercise its rights under the card scheme rules, the
Ombudsman will have regard to the time limits allowed by the card scheme
rules.
Under the provisions of the revised EFT Code, any failure of the complaint
investigation procedures that delays the resolution of a complaint allows the
Ombudsman to exercise a discretion to determine that the account institution is
liable for part or all of the amount in dispute.
The discretion can be exercised simply to compensate the account holder or user
for the effects of the delay, even where the account holder is otherwise liable for
the amount in dispute.
1. Advise the account institution of the reasons for concluding that it had
not handled the complaint in accordance with the EFT Code;
2. Indicate to the account institution the reasons why this failure contributed to
the account institution’s decision, or delayed the resolution of the complaint;
and