New credit card technology may not protect you like you think

PIN technology could leave you vulnerable Ross McLaughlin on how new chip and PIN technology embedded in credit cards can still put users at risk.

A Vancouver man thought he was protected by his credit card’s PIN technology after his Scotiabank Amex gold card was stolen. But he soon learned the hard way that wasn’t the case.

Edward Hodson was on vacation in Miami Beach when his phone and credit card were stolen. Before he had a chance to report it stolen, more than $4,600 was charged to his card at several pharmacies in the area.

MasterCard, Visa and American Express all tout that customers are protected with zero liability for unauthorized transactions, so Hodson wasn’t worried. Until he was told otherwise.

"Because my PIN was used I am completely liable for the full amount," he explained.

That’s because Scotiabank's revolving credit agreement for lost or stolen cards states, "if your password or PIN is used in such a transaction, you will be liable for the full debt."

“It's baffling. I feel cheated just because someone could easily look over your shoulder, see your PIN, take your card and run up a huge charge until they block it. And the consumer isn't protected," said Hodson.

The new chip and PIN technology embedded in credit cards has saved Canadian banks more than $124 million over a seven-year period.

Yet, you’re still vulnerable. Police say new technology called shimmers can steal data from chip enabled cards. But the jury is still out on whether they can steal personal identification numbers too.

"We're finding that these are starting to pop up all over the place," said Corporal Michael McLaughlin, Coquitlam RCMP.

Regardless, B.C.’s consumer protection laws limited a customer’s liability to just $50.

“There's a small piece in there carved out that speaks to consumer's liability if they have a card lost stolen or misused," explained Tatianna Chabeaux-Smith, "Now the exception to that is if a PIN number is used at an ATM then they are liable but otherwise the act says they are not."

The fraud on Hodson's card occurred at pharmacies, not ATMs. And as for that Scotiabank agreement that holds him liable if the PIN was used? Turns out, B.C. law trumps the cardholder agreement, no matter where the card is used.

"I want them to refund me my full amount. Every fraudulent charge that's on there should be refunded to me," demanded Hodson.

When CTV News contacted Soctiabank it told us, “If a transaction is proven fraudulent, no matter then method used (PIN, swipe, tap) the bank will ensure you are not held liable for that transaction.”

The bank wouldn’t discuss Hodson’s case specifically, but within days all of his charges were cleared.

"As soon as you stepped in they called me up the next day and they gave me the good news," he said, "You know I’m delighted that it's over but it should not have come to this."

Scotiabank told CTV News you wouldn't be liable after you report fraud but didn't answer our questions about the language in their contract that holds you liable for fraud if your PIN is used. So make sure to read the fine print on your cardholder agreement and if you don't like it look around. Not all banks operate the same. For example, Royal Bank's credit card agreement (see below) doesn't hold you responsible if you haven't been reckless or careless with your card or PIN.

According to the Consumer Financial Agency of Canada those zero liability promises are not legal requirements. They are just commitments. So this could happen again until someone decides to take their bank to court, which is exactly where Hodson was headed until he contacted McLaughlin on Your Side.

Scroll through the below PDFs to read the credit agreements for Scotiabank and RBC. The highlighted portions relate to PIN technology.