Samantha said she was asleep with her phone switched off when the payments were made and she believed someone had stolen her card details at an ATM or remotely accessed her banking. She complained to us about the bank's decision not to reimburse her.

Our investigation

Both payments required Samantha’s full card details. The first payment also required access to her password-protected device and knowledge of her mobile banking app PIN so whoever was making the payment could approve the in-app prompt. The bank’s records showed the device, IP address and wi-fi network used for the disputed payments were also used for Samantha’s normal banking activity. No new devices were registered, and her banking credentials did not change.

The bank could not try to recover the first payment because it had been approved through an in-app prompt, but it made a chargeback request for the second payment. In response, the money transfer service supplied evidence that the activity on its platform matched the IP address used to access Samantha’s banking app when the payments were made. It also shared evidence showing the holder of the account receiving the funds was probably known to Samantha.

Card skimming at an ATM did not explain the in-app approval, and we found no evidence that Samantha’s banking was accessed from a new device or compromised through remote access. Given the extent of information and access required to make the disputed payments, we found that the payments were either authorised or occurred because Samantha did not take reasonable steps to protect her card details and banking credentials. In either case, the bank did not have to reimburse her loss.

Outcome

We did not uphold Samantha’s complaint.