Special Report: Where does the buck stop?

The latest ATM scam has sent an alarming message to the banking sector. Who is responsible for the security of banking transactions? Is it the banks or the customers? Clients worry about the security of ATMs and credit cards while banks assure them that their fears are unfounded. They say their industry is a business of risks , which have to be faced as life goes on. Could be a true answer ... but does it satifsy those who had lost their salaries in the ATM scam? C.L. Jose investigates

This is a letter Gulf News received recently from a person named Tareq who wrote that his mobile number was almost identical to the mobile service number of one of the banks in the UAE. "Several customers send messages to the bank seeking services such as balance statement and other bank transactions.

The message has to have the PIN number followed by the '#' and the service number. Since my number is very close to that of the bank, lots of messages meant to be sent to the bank reach my mobile number by mistake.

About four months ago, I called the bank and discussed the issue with them when I realised the reason why I have been receiving these strange numbers and messages. I am still receiving messages containing the bank customers' PIN numbers."

Tareq said that he advised many customers to change the bank. This throws up a big issue regarding who is responsible for the security of a bank transaction. There may be larger basic issues involved.

However, the example narrated above shows disregard for the customer's concerns. Issues such as the recent ATM scam should invite greater focus on the risks and dangers involved in electronic banking.

Now that the furore has somewhat settled, banks have admitted to the scam which has emptied the savings of quite a number of loyal account holders registered with these banks. The Central Bank has also issued statements quantifying the amount lost in the scam from the UAE side.

For the UAE, which has seen scams in the corporate sector in the form of big loan scams like that of the Patels and a few other periodical 'abscondings', this ATM scam is unique.

However, banks are said to have offered to pay the ATM holders the money they lost in the scam if they prove the same. Though initially there were rumours that a huge amount had been siphoned off by the perpetrators of this act, the figure has been slashed down to Dh1.5 million.

Banks are now advising the account holders to change the pin number of their cards. "Regular changing of pin numbers is always advisable as a measure to avert these sort of scams," said a top official of a local bank which is said to be the most affected by this scam.

But the pertinent question is if the modus operandi of the scamsters involves copying one's pin number while the ATM holder is withdrawing money, how can a change in pin number address the issue?

Card technology experts explained that the scamsters followed a method whereby they sat in a car at a distance from the ATM booth and transferred the pin number from the card which was used to withdraw money from the ATM.

The UAE Central Bank has acknowledged that the fraud was perpetrated by a gang of computer professionals by inserting an electronic reader into the card slot of several ATMs, enabling them to copy critical ATM card data.

We are forced to raise the basic question: is the system secure enough to be the custodian of our hard-earned money? The bank chiefs, as a whole, shoot down this fear as unfounded. They argue that life involves several risk factors and we have to face them as life goes on. But will this answer the anxiety of an ordinary employee of a company who has lost a whole month's salary in the ATM scam?

"We are in the business of risk. Every bank makes its living through taking risks. The challenge before us is how will we manage the risk prudently," said Steven Pinto, senior vice-president and head of retail banking, Mashreqbank.

He went on to argue that the banks are taking the risk knowing fully well that they have the capability to do so.

"So when a scam of this nature takes place, it is more painful for us than it is for the customers," says Steven. He explained that the banks have to foresee three types of risk in their business - credit, operational and regarding reputation.

Having said this, certain stories brought to the notice of Gulf News by some customers raise the serious question of security. Is it the responsibility of banks or customers to secure transactions through ATM card or credit cards.

Renji John Abraham, working with a prestigious airline, was on an official tour to Turkey where he had to stay in a hotel for a couple of days. He used his credit card to settle the bill at the hotel.

He was surprised to hear that he had already exceeded the limit in one card. He had two cards from two leading foreign banks, and he found two unauthorised transactions on his Master cardand another one on his Visa card - all these transactions were made in Turkey.

On receiving his bills, he found that purchases to the tune of Dh10,000 and Dh8,000 had been made through his two credit cards without his knowledge. On approaching the banks, he was assured that the issue would be investigated and sorted out.

But after waiting for a couple of months, he has been asked to pay the amount. One of the banks told him that since one of the signatures was similar to his, he would have to pay the amount. Curiously, the bank didn't have any explanation for the dissimilar signatures.

The other bank gave an interesting reply. "All card-based transactions are valid regardless of signatures." Then where is the room for a cardholder to dispute a transaction? Does it also mean that if the signature is unlike his own, he can disown the transaction?

If yes, it amounts to a scenario where one can dispute the transactions made by one by scribbling a different signature at the counter of a supermarket or a hotel because very rarely are the signatures verified for genuineness - at least at supermarkets in the UAE.

There is another interesting story narrated by one UK citizen who had applied for a credit card in the UK before he left the country for the UAE. He was taken aback on receiving a bill from his credit card-issuing bank although he is yet to see his credit card!