Chip and PIN

[Ian Batten]

On 25 Jan 08, at 1141, Casper.Dik@Sun.COM wrote:

>
>> In article <E1JIM2j-0004mv-00@mta2.cl.cam.ac.uk>, Ross Anderson
>> <Ross.Anderson@cl.cam.ac.uk> writes
>>> There's another Munden case in the pipeline - a police employee who
>>> complained about phantom withdrawals, whereupon the bank accused her
>>> of attempted fraud. She's awaiting trial. It's disgraceful.
>>
>> What is it about such cases that makes the banks prosecute, rather  
>> than
>> just ignore the punter (like the OAP "card locked in the safe" one on
>> the radio earlier this week - why isn't he also being prosecuted for
>> pleading innocence).
>
> Perhaps because they actually have proof or think they have proof?

In the eighties, my wife did some time as a branch manager in retail  
banking.  This was back in the days when branch managers exerted some  
power, and actually saw complaints and problems to resolve in-branch.

The hot topic of the time was ATM disputes on stolen cards.  The  
bank's basic position was ``misused card + known pin => not  
innocent''.  Note these were not the cases that Ross uncovered, of  
phantom withdrawals from accounts where the account holder still  
physically had the card (those turned out to be inside jobs, as I  
recall), but where the account holder couldn't produce the card  
themselves or had admitted that other people had had access to the card.

The cards were sometimes recovered from machines, after they'd been  
stopped, with the PIN written on them.  Several turned out to be  
being used by children, friends and family who had been given the PIN  
to get some money on behalf of the holder, and then used again, and  
again, and again.

Clearly, there are people who are the victims of ATM fraud which the  
banks deny for bad reasons. Ross has uncovered some cases, and there  
are probably others to come.

However, there are a hell of a lot of people who complain of ATM  
fraud who either have been so stupid as to deserve little sympathy,  
or are indeed trying it on.  To believe that every customer who  
claims their ATM has been misused and the bank should compensate them  
is telling the truth is akin to believing that every parent whose  
child is removed and tells their story in the Guardian is innocent.

Unfortunately, we don't know (a) what the ratio between customer-bad  
and customer-good ATM/Card fraud is and (b) how many people who go to  
the ombudsman are trying it on (the latter is unknowable, of course).

Are there cases where the ombudsman gets it wrong?  Of course: all  
systems are justice are faulty.  Does the ombudsman get it  
consistently wrong because of regulator capture?  It wouldn't  
surprise me.   But some people here appear to believe that the  
ombudsman should automatically find for the customer, because  
customers are honest as the day is long and banks are all guilty.  To  
pick up the analogy, John Hemming argues from the undeniable truth  
that social services sometimes get it wrong to the tenuous case that  
social services ALWAYS get it wrong.

ian