Lucky number

Lucky number bad choice for PIN

Ms W contacted her bank and complained that ten unauthorised ATM withdrawals totalling $3,450 had been made from her account.

The transactions were made between 20 and 26 November 2005. Most were made at a hotel near Ms W’s home. Two were made at a hotel a few kilometres away. The last disputed withdrawal was made at an ATM at 7:00am on 26 November 2005. Ms W used her card at the same ATM on the same day to make a valid withdrawal at 1:13pm.


The bank investigates Ms W’s claim
In order to establish that Ms W was not liable for the disputed transactions, the bank asked Ms W whether she had disclosed her PIN to anyone. Ms W provided the bank with a statutory declaration stating that:
‘To the best of my knowledge I did not disclose my PIN to anyone. I did not give permission for my card to be used in any circumstances and it was used without my knowledge.’

The bank also interviewed Ms W by telephone. The bank said that Ms W advised during the phone conversation that:

  • she usually kept her card in her handbag;
  • her 18 year old son stayed with her sometimes and with his father sometimes. He was in and out during November 2005;
  • she withdrew cash about once a fortnight after her wages were deposited, and realised the balance was not correct when she withdrew $500 at 1:13pm on 26 November 2005;
  • her PIN was one she regarded as a lucky number;
  • she might have discussed her lucky number with her son but only as a lucky number and not as a PIN. She might have told her son the PIN five years previously when he was a boy, but he would not have remembered it now; and
  • she had never let another person use her card and PIN, and was careful not to let anyone watch her entering the PIN.

The bank allocates liability to Ms W
The bank said that there was video footage of Ms W’s son making the unauthorised transactions. It allocated liability for the disputed withdrawals to Ms W, on the basis that she had voluntarily disclosed her PIN to her son and had otherwise acted with extreme carelessness in failing to protect the security of the PIN. The bank mainly relied on its record of the phone interview with Ms W in January 2006, about seven weeks after she reported the misuse of her card.

Ms W lodges a disputes with BFSO
Ms W was not happy with the bank’s decision and wrote to BFSO. She acknowledged that the unauthorised withdrawals had been made by her son, that he had then disappeared, and that she did not know where he was.

She also said that:

  • she had not told the bank during the phone interview that she had actually discussed her lucky number with her son;
  • she could not be sure whether she had mentioned that the particular number was her lucky number to her son in the past; and
  • she had definitely not disclosed her PIN to her son and did not know how or when he found out.

BFSO’s investigation
In order to allocate liability for the unauthorised transactions, the case manager had to consider the circumstances in which Ms W’s son gained knowledge of the PIN.
The case manager took into account Ms W’s statement in the bank’s phone interview that she may have told her son the PIN five years ago when he was a boy. The case manager felt that there was no reason (apart from Ms W’s later retraction) to doubt the accuracy of this response. In addition, it is the Ombudsman’s policy to give greater weight to information that is more contemporaneous with the events that are the subject of the investigation.
The case manager’s view was that it was more likely than not that Ms W had disclosed her PIN to her son five years ago, and that he had remembered this because of the significance of the number to her.
The Finding was that Ms W was liable for the unauthorised transactions on the basis that she had disclosed her PIN to her son.


The Ombudsman’s Recommendation
Ms W did not accept the Finding and appealed to the Ombudsman. She said again she was in a poor emotional state during the bank interview, and did not recollect saying things in the exact terms as written in the bank’s record of interview. The Ombudsman took this into account when reviewing the available information. However, after his review he considered that the case manager’s assessment of the facts was correct and that, on the balance of probabilities, it was likely Ms W had disclosed the PIN to her son. The Ombudsman’s Recommendation upheld the case manager’s Finding.