We have had several customers who have written their pin number on their ATM/Debit card and then had their wallets stolen or lost their cards. Do you know what Reg E/Visa states on negligence - do we have to give them their money back??

Someone correct me if I'm wrong but I think the reg doesn't see that as negligence on the customer and we need to be following the error resolution guidlines and timeframes as far and provisional credit and research and resolve procedures just like any other stolen card/error. Reg. E 205.6

I believe that Reg E says if they didn't authorize it you gotta give it back (regardless of how stupid they were to put their PIN on it). You might want to do a search on this topic because there have been numerous discussions on it in times past.

I am not up on Reg E guidelines and just looking for some guidance. Thank you for your assistance!

The prior posters are correct. From the Reg E commentary:

2. Consumer negligence. Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E. Thus, consumer behavior that may constitute negligence under state law, such as writing the PIN on a debit card or on a piece of paper kept with the card, does not affect the consumer's liability for unauthorized transfers. (However, refer to comment 2(m)-2 regarding termination of the authority of given by the consumer to another person.)

Cardholders can be as careless as they want...to a point. If a mother gives her son the card (with the PIN on the back) to go pick up some groceries and the son decides to help himself to an ATM withdrawal, that would not be covered. The son in effect exceeded his authority. Of course, getting the mother to admit this is another story!

The posters are correct, no matter how stupid the customers are you still have to give back the money. However, you do not have to issue them another Debit Card.

We had one that used his PIN number for part of his username on Facebook or one of those sites. His roommate got his card and tried some different numbers and that was one he tried. HOW STUPID!! But we had to give him his money back and go after the roommate. Thank God for video tapes!

As soon as I see the words "roomate" or "ex-girlfriend/ex-boyfriend" on a customer's written statement I know I'm in for some fun! ;-]

I read a good story once (I think it was on this forum, actually) about a little old lady who had written a PIN number on her ATM card.. only it was not *HER* PIN number.

She did actually end up losing her card, but when the crook tried to use it at an ATM, it ended up getting swallowed, because he tried the (wrong) PIN on the card too many times!

Clever lady!

The PIN number on the card probably would not affect liability under the MasterCard/Visa zero liability rules, since use of a PIN means those rules don't apply anyhow.

John, that is not entirely accurate.

Visa only excludes non-Visa branded PIN transactions from its Zero Liability Policy. PIN transactions processed over the Visa network do qualify.

http://www.usa.visa.com/personal/security/visa_security_program/zero_liability.html

MasterCard excludes all PIN transactions.

http://www.mastercard.com/us/personal/en/cardholderservices/zeroliability.html

This might be a stupid question, but how do you know whether or not a transaction was processed by Visa?

Not a stupid question at all. When in doubt, assume they are.

However, a large portion of non-US/Canadian Visa transactions are not processed on the Visa network. There is an identification field in the transaction log but I forget the name of it. I'd suggest asking your Visa Rep.

Also, on rare occasions MasterCard will process the transaction. Those are easy to identify because the 1st digit of the reference number will be a "5".

courts have ruled otherwise...the purchase of groceries was authorized. The withdrawal from an ATM was not, and therefore owed back to the account holder.

From an official interpretation of REG E Section 205.2---

2. Authority. If a consumer furnishes an access device and grants authority to make transfers to a person (such as a family member or co-worker) who exceeds the authority given, the consumer is fully liable for the transfers unless the consumer has notified the financial institution that transfers by that person are no longer authorized.

But, the courts would also convict the son (with proper evidence, of course) if the bank (victim) filed charges against him. So, the question is usually something similar to this, "Mrs. Smith, I understand that your son is the one responsible for taking the $200 out of the ATM. Do you wish to file charges against your son?" "If we honor your claim, we will file charges against your son, because we will have been the victim of a crime." When stated like that (not a threat, simply a statement of fact), Mrs. Smith may decide to take the loss and deal with her son herself.

If she decides that she's not going to protect him, follow through and file a police report for the "unauthorized use of a credit/debit card".

Do you have any links to these cases? I'd be interested to see what the exact circumstances where. I don't know that you can really apply it to every situation without knowing all of the facts of the case.

I too would be interested in links/cites. I haven't heard of these and would wonder why the different treatment if it was the same party.

I would not reimburse them under such circumstances, however it might be hard to prove that they wrote their PIN number on the back of the card unless the card was recovered. I assume the customer told you that she did it. Can you imagine if it became public knowledge that you would reimburse under this scenario? Wow! Get ready for a rush on the ATM's!!

"I would not reimburse them under such circumstances, however it might be hard to prove that they wrote their PIN number on the back of the card unless the card was recovered. "

Then you would be in direct violation of Regulation E. Get ready for the class action lawsuit!!

Welcome Canuck, as a new BOL Bankers' Threads poster. And welcome to the real world of Regulation E, where things are not always as we might prefer.

The regulation has been out since the 1970s, and bankers have bridled against the plain language of the Official Staff Interpretation that addresses PINs on cards almost since then. Take a look at Comment #2 to paragraph 205.6(b). Consumers are protected even from their own negligence.

Don't worry about the word "getting out." It's been public information for decades, and it's been discussed openly in Bankers' Threads countless times.

Regulation E is a decidedly consumer-oriented regulation with roots in a very consumer-protective law.

To put a finer point on that, David, Visa excludes all ATM transactions from coverage of their Zero Liability program.

Hi all, I should have mentioned that I live and work in Canada hence I'm approaching this from a Canadian perspective. Of course you have to abide by the regulations applicable to your particular region. My apologies! Great site by the way.

In Canada we do not have Regulation E, rather we follow a voluntary code of practice called the "Canadian Code of Practice for Consumer Debit Card Services." http://www.fcac-acfc.gc.ca/eng/industry/RefDocs/DebitCardCode/DebitCardCode_e.asp
Under this code when a cardholder contributes to unauthorized use, the cardholder will be liable for the loss. It specifically addresses writing one's pin on the back of a card as a no-no. The code of practice is incorporated into our individual FI debit card agreements.

There are some interesting differences between the U.S and Canada in this regard and I can see how regulation E could cause a lot of friction between the regulators and banking industry for sure. I don't see any protection for the bank at all. Let's see if I have this right... So if a customer keeps their PIN # written on their card, and the card is "lost or stolen" and an unauthorized withdrawal occurs later on, and the customer wants to be reimbursed, I assume as long as it was someone other than the customer who made the withdrawal, the bank has to cough up the money by law? How much would you estimate the banks lose annually under this scenario? I can't believe the police would put a lot of effort into these cases.

As a consumer of course this is great! I can see the benefit of not having to worry about the difficult task of memorizing 4 digits. Or trying to guess someone else's!

Canuck: Great to have you with us, but it might be best if you didn't advise U.S. bankers as your Canadian laws differ. I'm not trying to be rude, but you are advising primarily US banks here.


You are correct. The amount of the loss less $50 is allowed by Reg E.