What Is the Bank's Liability If There Is Identity Theft?
In 2010, Javelin Strategy and Research reported a continuing increase in identity theft cases in the United States.
Identity theft occurs when a person uses the identification of another person to commit fraud. In banking, identity theft involves the unauthorised usage of a bank account to receive goods or money.
When facing an identity theft situation, thorough understanding of bank liability protects consumers and allows them to protect their interests. The liability of the bank depends on the specific type of identity theft involved.
Identity theft through check fraud occurs in four main ways: forgery, counterfeiting, alternation and paper hanging.
Forgery occurs when a check is written without authorisation of the account holder through stolen checks. Counterfeiting involves the fabrication of a check through computer software or colour photocopying. Alterations happen when information on a check, such as the amount of the check, is modified or changed. Theft through paper hanging involves the writing of a check on a closed account, leaving the account holder liable for all charges.
Article 4 of the Uniform Commercial Code (UCC) regulates the liability of the bank in cases of check fraud. According to the National Check Fraud Center, the UCC requires banks to provide regular bank statements for the consumer to identify all items paid from an account. The consumer must properly examine each statement in order to discover unauthorised withdrawals in a timely fashion. While the industry standard gives consumers 30 days from the statement date to report a check fraud, the UCC actually allows for "reasonable promptness," which is left for the bank to determine.
Each individual bank will lay out its specific time frame for check fraud reporting in the account agreement with the consumer. After the time frame has expired, the bank is not required to reimburse the consumer or investigate the fraud claim.
Credit, ATM and Debit Card Theft
Identity theft through the unauthorised usage of credit, ATM and debit cards is a crime of convenience within the identity theft world.
Whether a card is physically stolen or the information is simply copied and used, the consumer's entire banking account is at risk. The Fair Credit Billing Act and the Electronic Fund Transfer Act lays out consumer responsibility and bank liability.
The key to limiting consumer loss relies completely upon discovering and reporting the theft as soon as possible. The longer the theft goes unreported, the less liability the bank faces.
If the loss of a credit card is reported before unauthorised charges, the consumer is only liable for up to £32, with the bank liable for the remaining charges. If the credit card number is used, but not the card itself, the bank is liable for 100 per cent of the fraudulent charges.
The bank's liability regarding ATM and debit card theft depends entirely on how soon the theft is reported.
If the theft of an ATM or debit card is reported prior to the theft of funds, the bank is entirely liable for the fraudulent charges. If a consumer fraud report is made with the bank within two days after the loss of funds from an account, the consumer is liable for no more than £32, with the bank liable for the remaining amount. If the theft is reported within 60 days, the consumer is liable for up to £325, with the bank liable for the remaining amount. If sixty days pass from the bank statement date showing the fraudulent transaction, the bank is no longer liable for the misappropriated funds.
Account transfers that move money from one account to another are often only discovered by consumers through their regular bank statements. Banks are required to show the amount of each transfer, date debited from your account and the type of accounts involved in the transfer. The consumer must report a fraudulent transfer within 60 days of the date of the statement reporting the transfer.
After 60 days, the bank has no liability and no obligation to investigate the theft of funds. Upon notification, the bank has 10 business days to investigate the theft, three days to report the investigative finds and one day to correct determined errors. However, certain situations allow the bank to take up to 45 days to investigate the theft of funds from an account, but the bank must return the full amount of the transaction to the account until the investigation is completed.
Third-Party Tort Liability
Banks face increasing legal pressure to protect consumers or face tort liability in identity theft cases.
The basis of a bank's liability as a third party is based in negligence on the behalf of the banking institution. The bank has a duty to protect the consumer. If the bank acts in a manner that enables or helps identity theft to occur, the bank has breached its contract with the consumer and may be liable under court order for the losses incurred.
- Javelin Strategy and Research: 2010 Indentity Fraud Survey Report
- "Identity Theft: Developments in Third Party Liability"; Stephen L. Wood and Bradley I. Schecter; 2002
- Privacy Rights Clearinghouse; Identity Theft: What to Do If It Happens to You; January 1997
- Federal Trade Commission; Credit, ATM and Debit Cards: What to Do If They're Lost or Stolen; June 2008
- Federal Trade Commission; Electronic Banking; December 2006