Decision #96129-353Q307

File: 96129-353Q307

Commissioner’s Decision

Compliance issue

Code of conduct — Canadian Code of Practice for Consumer Debit Card Services
— Failure to comply with a voluntary code of conduct with respect to unauthorized debit card transactions
Financial Consumer Agency of Canada Act, paragraph 3(2) (c)^{Footnote 1}  
Canadian Code of Practice for Consumer Debit Card Services (2004), subsection 6(6)

A consumer complained to the Financial Consumer Agency of Canada (FCAC) that he was being held financially liable for unauthorized bank transactions that had been made with his lost debit card. Although consumers are usually directed to the Ombudsman for Banking Services and Investments (OBSI) to have liability disputes resolved, in keeping with its mandate to monitor compliance with the Canadian Code of Practice for Consumer Debit Card Services, FCAC keeps track of this type of consumer complaint. The disputed transactions took place within one day of the consumer’s loss of his card. The consumer went back to the merchant where he thought he had forgotten his card but, after being unable to retrieve it, he contacted the bank three days after the card went missing, to report the loss.

The consumer maintained that his personal identification number (PIN) was not an easy combination to guess, nor was it easily traceable to him, nor had he voluntarily disclosed it to a third party. When the alleged unauthorized transactions took place, the wrong PIN was entered several times before the correct one was finally entered. However, the consumer’s history of debit card transactions showed that he often entered the incorrect PIN when making valid debit card transactions.

The consumer claimed that he had not authorized the transactions that had been made with his lost debit card, and therefore asked the bank to reimburse him for the missing funds.

However, since the bank concluded that the pattern of disputed transactions did not indicate that the card had been stolen, it refused the consumer’s request. Moreover, the transactions occurred at a location where the consumer had previously used his card.

The Canadian Code of Practice for Consumer Debit Card Services outlines the obligations of financial institutions in certain circumstances, to reimburse consumers for losses they have experienced as a result of unauthorized activity on their debit cards.

Subsection 6(6) of the Code, Procedures for Addressing Unauthorized Transactions and Other Transaction Problems, stipulates that, if an investigation determines that not all of the funds should be reimbursed to the cardholder, the PIN issuer — which, in this instance, is the bank — is responsible for showing that, on a balance of probabilities, the cardholder contributed to the unauthorized use of the card.

As a result of the information that the consumer and the bank provided during the compliance investigation, FCAC’s Compliance and Enforcement Branch concluded that the case showed there had been non-compliance with the Code. FCAC therefore sent a letter of non-compliance to the bank, stating that the institution had failed to demonstrate that, on a balance of probabilities, the consumer contributed to the unauthorized use of his card. In response, the bank asked for a review of the case by the Commissioner and filed additional information with the Agency.

Decision taken

After reviewing the file and after taking into consideration the additional information that the bank supplied in response to the Agency’s non-compliance letter, the Acting Commissioner decided that this case did not show any non-compliance with the Code. He determined that, given the additional information it had provided, the bank demonstrated that, on a balance of probabilities, the consumer must have contributed to the unauthorized use of his debit card.

Compliance considerations

In response to FCAC’s letter of non-compliance, the bank provided the Agency with a more comprehensive timeline for the disputed transactions, which occurred almost 24 hours after the consumer had lost his debit card, at a location he frequented.

In its representations to FCAC, the bank also revealed details from its own internal investigation, showing that the consumer had not used his debit card at a point-of-sale terminal in the period just prior to the loss of his card — which eliminated the likelihood that any “shoulder surfing” had taken place. Moreover, at no time did the consumer allege that when he used the card, there had been any deception or trickery on the part of the merchant — which eliminated the involvement of a third party in the transaction.

Outcomes

Monitoring is essential to ensure that voluntary codes such as the Canadian Code of Practice for Consumer Debit Card Services work well for consumers. The Code is designed both to protect Canadian users of debit cards and to outline consumers’ and industry’s responsibilities, as well as their liability, with respect to debit card transactions.

The disclosure of this information not only facilitates investigations, in cases of disputes. It also fosters healthy competition in the marketplace.