Decision #82571-273Q407

File: 82571-273Q407

Compliance issue

Code of Conduct — Canadian Code of Practice for Consumer Debit Card Services — Failure to comply with a voluntary code of conduct with respect to debit card fraud
Financial Consumer Agency of Canada Act, paragraph 3(2)(c)^{Footnote 1}  
Canadian Code of Practice for Consumer Debit Card Services, sections 5, subsection 6(5)

A consumer complained to the Financial Consumer Agency of Canada (FCAC) that she was being held financially liable for unauthorized transactions on her bank account. The disputed transactions were made with the consumer’s debit card, which had been stolen. On the day of the theft, the bank noticed that there had been some unusual activity on the consumer’s bank account and therefore changed the customer’s debit card status to prevent any further withdrawals. Later the same day, the consumer reported the theft of her card to the bank.

The consumer asked to be reimbursed for the funds she lost because of the fraudulent activity. The Canadian Code of Practice for Consumer Debit Card Services outlines banks’ obligations, in certain circumstances, to reimburse consumers who have experienced losses as a result of unauthorized activity. The bank initially declined her request, since it concluded that the consumer had not adequately protected her PIN. When the consumer appealed that decision, she provided the bank with more details about how the theft took place. After investigating the case, the bank’s ombudsman recommended that the consumer be fully reimbursed.

The consumer also complained that the bank did not properly inform her of the dispute resolution process that was available to her, or how long each stage of the bank’s investigative process could take. The consumer was not reimbursed for more than 100 days.

Section 5 of the Code states that cardholders are not considered to have disclosed their PIN voluntarily if the PIN is obtained by coercion, trickery, force or intimidation, including situations where the customer’s PIN is observed at a point-of-sale terminal.

Appendix A of the Code — clauses 3 and 5 — provides guidance on how to interpret section 5 of the Code. Clause 3 outlines the situations in which a cardholder would not be liable for any losses. Clause 5 describes how cardholders could contribute to the unauthorized use of their card.

Subsection 6(5) of the Code states that, while the dispute resolution process is taking place, the PIN issuer will provide the cardholder with information about how the process works, and how long each stage would take, under normal circumstances.

Decision taken

The Acting Deputy Commissioner upheld the previous finding of non-compliance with paragraph 3(1)(g), subsection 5(1) and subsection 6(5) of the Code. The bank could have investigated further to ensure that the unauthorized transaction was not the result of fraud or theft; nor did the bank adequately investigate to rule out a situation such as “shoulder surfing”; nor was there evidence that the bank made the consumer aware of the dispute resolution process or how long each stage of the process could take.

Compliance considerations

Thorough investigations are essential for ensuring that voluntary codes such as the Canadian Code of Practice for Consumer Debit Card Services work well for consumers. FCAC is concerned that the bank did not adequately investigate this matter when the consumer initially reported it to the institution.

There is no evidence, in this case, that the consumer had been informed about the dispute-resolution process in writing when she requested to be reimbursed, or how long each stage of the process could take. The fact that the consumer used the dispute-resolution process does not constitute evidence that the bank itself advised her about it in a timely fashion.

Measures taken by the financial institution

The bank has subsequently amended its information materials to include more details about the dispute resolution process and the timelines related to it.