Attack of the ATM

Rufus was in London when he decided to withdraw money with his travel card from an ATM machine. The ATM machine went blank and did not return his card. Rufus tried entering his PIN a couple more times but gave up when nothing happened. Rufus went into the shop the ATM was attached to for help. The shop told Rufus to call his bank. Rufus also filed a police report. The bank told Rufus his card had been swallowed and would be destroyed. Rufus was relieved as his wife had a spare card in Germany.

Rufus made a police report and went home to contact his wife who gave him the travel card company’s phone number. When Rufus called them, the travel card company advised Rufus that over $3000 had been withdrawn from his account. Rufus realised he had fallen victim to a scam. Somehow the fraudster had overseen Rufus entering his PIN, and obtained his card when Rufus went inside the shop.

Rufus asked the travel card company to refund the stolen amount. The travel card company refused, noting Rufus had breached its terms and conditions of use by compromising the card’s security, and by not immediately reporting the card’s loss.

Rufus thought this was unfair. It was reasonable for him to assume that the card was safe from misuse having been swallowed by the bank’s ATM, and would be destroyed. Rufus also complained that more than $3000 had been withdrawn from his account, even though the daily withdrawal limit was only $3000.

 

Review

Upon review, we found there was no evidence to suggest that Rufus had divulged the PIN, or recorded it on the card so as to make the PIN assessible to a fraudster. The card’s terms and conditions did not require Rufus to take any actions to prevent being “shoulder-surfed”. We did not think Rufus had breached any of the terms and conditions of use in relation to the card’s security.

The card’s terms and conditions required Rufus to immediately report the loss of his card. We decided that an element of reasonableness had to be read into the term “immediately”.

Rufus had taken continued actions by phoning the bank and making a police report. He also obtained the travel card company’s number and called them within two hours. Until then, he had no reason to believe the card would be misused. We did not think Rufus had unreasonably delayed reporting the loss of the card.

We found that the withdrawal limit only applied to ATM withdrawals. Rufus had been charged for vendor purchases, currency exchange and ATM withdrawal fees over and above the daily limit which were covered in the card’s terms and conditions of use.

 

Outcome

We decided that Rufus had not breached the card’s terms and conditions of use and that the travel card company should compensate Rufus for his losses. The travel card company immediately agreed and refunded Rufus.

 

Insights for the consumer

It is important to be mindful of “shoulder surfers” and scamming devices on ATMs. It is always good practice to shield your PIN when entering it into an ATM.

It is important to keep the PIN and security features of the card secure and immediately notify the card company when your card is lost. You must never record the PIN close to the card, or divulge it to any one else.

It is important to familiarise yourself with the travel card’s terms and conditions of use to check what fees you may be charged.

Consumers should also be aware that fees charged and daily limits differ between countries, ATMs and merchants. The travel card company notes that sometimes vendors will offer payment options in both NZD and the local currency. If your travel card is loaded in the local currency, paying in NZD may incur further fee charges.

Search case studies