Technology that’s supposed to cut down on debit and credit card fraud is putting consumers at risk. Chip and PIN technology may be doing more to protect the banks than you and while the banks have saved millions of dollars in losses, consumers are now left carrying the burden.
If your debit or credit card is stolen or lost and your PIN is used to commit fraud, it’s up to you to prove it wasn’t your fault or you could be liable for the loss.
It happened to Tanya Green when her wallet was stolen in late December and crooks racked up more than $1,000 in cash advances on her stolen RBC credit card. But RBC sent Green a letter holding her responsible for the loss because according to her cardholder agreement if the PIN is used she can be liable.
“They felt that the only way somebody could have gotten my PIN was if it was somebody that I knew that broke into my car or the PIN was in my wallet and neither of those things are true,” said Green. “I would have expected RBC to be more on my side.”
| Related Cloverdale couple on the hook debit card fraud |
In January, CTV News reported on a similar complaint from David and Amelia Petrunia. Their debit cards were stolen but RBC was holding David responsible for $12,000 in transactions because his PIN was used even though police had released photos of the suspects.
"They bled this thing dry. It was incredible how fast they did what they did," said David.
The Financial Consumer Agency of Canada says you have a responsibility to make your PIN hard to guess, to keep the number separate from your card, and to never share it with anyone, or your bank could hold you liable. But that doesn’t automatically mean you’re liable for fraud if you met the bank’s requirements.
"Consumers should not be held liable automatically if their PIN or means of authentication has been used to do this or the unauthorized transactions," said Philippe Pellerin, of the FCAC.
The banks have an obligation to do a thorough investigation.
If you’re not satisfied with the investigation you can file a complaint with the bank’s ombudsman and following that, if you still think you’ve been treated unfairly, you can file a complaint with FCAC.
Since chip and PIN technology was introduced in 2008 on debit cards alone, banks in Canada have reduced their losses by 97 per cent from $142 million to $4.4 million in 2018. What we don’t know is how much of that loss has been passed on to consumers.
Seven years ago, security researcher Steven Murdoch of the University College of London was able to prove chip and PIN technology could be tricked using an electronic device that he says was eventually used by thieves to commit fraud in France.
“It will trick the terminal into thinking the PIN is correct,” he said.
And he told CTV News that there could still be vulnerabilities in the technology.
“We can’t be sure whether all banks fixed it and we also can’t be sure whether there are other vulnerabilities just a bit like it but the banks and academics never found out about but criminals knew,” Murdoch added.
We reached out to the Canadian Banker’s Association about the vulnerability.
“I’m almost certain that vulnerabilities in the systems would have been addressed by now through firmware updates and policy implementations,” said Mathieu Labrèche, director of media strategy with the association.
CTV News reached out to RBC for comment. In the Petrunias’ case, the bank held firm. In Green’s case they said they closed out the investigation because Green paid the balance and that her number was not in service. Green said she paid the balance to avoid penalties and fees, not because she was admitting it was her fault. She also said she has not changed her phone number and it's the same one she had when she reported the fraud.
After McLaughlin On Your Side investigated, Green said an RBC fraud respresentative reached out to her to tell her the bank would reverse the charges as a goodwill gesture.
