Decision #493123-757Q307

File: 493123-757Q307

Compliance issue

Code of conduct — Canadian Code of Practice for Consumer Debit Card Services (2004) — Failure to comply with a voluntary code of conduct with respect to debit card fraud
Financial Consumer Agency of Canada Act, paragraph 3(2)(c)Footnote 1   
Canadian Code of Practice for Consumer Debit Card Services (2004), section 5, subsection 6(5)

A consumer complained to the Financial Consumer Agency of Canada (FCAC) that she was being held financially liable for unauthorized transactions on her bank account.

The consumer noticed that five unauthorized transactions had been made with her card. The next day, she reported this to the bank but indicated that she still had the card in her possession. At the time, the bank told her that it would investigate the circumstances under which the transactions in question had taken place.

As a result of its investigation, the bank concluded that this was not a case of shoulder-surfing or card skimming. However, the bank found that, in each of the five alleged unauthorized transactions, the customer’s PIN had been used correctly. The bank therefore held the consumer responsible for the transactions, alleging that she had failed to maintain the confidentiality of her PIN.

After reviewing this file, FCAC’s Compliance and Enforcement Branch determined that the bank did not prove, based on a balance of probabilities, that the consumer had contributed to the unauthorized use of her card. The Branch therefore issued a finding against the bank of “non-compliance” with the Canadian Code of Practice for Consumer Debit Card Services.

Decision taken

Following the Compliance and Enforcement Branch’s findings, and in accordance with FCAC’s compliance framework, the bank asked the Acting Commissioner to review the case. After reviewing the facts of the case and the bank’s statements, the Acting Commissioner found that the bank did not prove, based on a balance of probabilities, that the consumer had intentionally contributed to the unauthorized use of her card. He therefore upheld FCAC’s initial decision of non-compliance with the Code.

Compliance considerations

According to the information provided by the bank and the consumer — who both maintained that the consumer always had her debit card in her possession — the misuse of the card did not appear to be the result of shoulder-surfing or of a card being stolen. Likewise, the bank did not find any evidence of card skimming. The bank further stated that the explanation the consumer provided was believable.

Although the consumer said that the debit card had always been in her possession, she did state that she was sleeping when the transactions in question took place. The bank suggested that perhaps the consumer’s daughter had taken the card, and returned it after using it. It should be noted that the customer’s PIN was used and entered correctly on the first and all subsequent attempts. There are several possible explanations as to how the consumer’s daughter could have found out what her mother’s PIN was — if that is what happened — but the bank did not provide any details about this.

As far as the consumer’s responsibility in this case is concerned, the Acting Commissioner must refer to the Canadian Code of Practice for Consumer Debit Card Services. In light of the preceding information, the Acting Commissioner found that, on a balance of probabilities, the bank did not show that the cardholder had intentionally contributed to the unauthorized use of her card, as outlined in section 5 of the Code.

Measures taken by financial institution

At the time it closed the file, the bank did not indicate to FCAC whether or not it had reimbursed the customer.

Outcomes

The Canadian Code of Practice for Consumer Debit Card Services protects consumers who use debit card services in Canada. It sets out practices for the industry, as well as the responsibilities of both consumers and the industry, regarding debit cards. It is important for institutions to interpret the Code correctly, to ensure they comply with it, and also for consumers to understand their responsibilities in this area.

Although FCAC cannot take any enforcement action, it is essential that the Agency monitor this issue, to ensure that voluntary codes of conduct such as the Canadian Code of Practice for Consumer Debit Card Services work in the interests of consumers.

FCAC reports annually to Parliament and to the Minister of Finance on the extent of the compliance by financial institutions with these codes and commitments, as well as on the type and number of complaints the Agency has received.

Page details

Date modified: