Your Bank Blamed You for Fraud? Here's What To Do

A customer's phone alerted him to two debit card charges in Dubai totalling £3,850, while his actual card sat in a gym locker in London. A third attempt, for £3,500 on a credit card, was blocked. His bank, HSBC, initially refused to refund him, saying the genuine card and correct Pin had been used, and implying he must have written his Pin down somewhere. He hadn't. After Which? stepped in and pointed out that the transactions were, geographically, impossible, HSBC reversed its decision, refunded him in full, and apologised.

A cyber security professor consulted on the case suggested it sounds like a relay attack: fraudsters intercept a card's near-field communication signal and relay it to another device to make a payment elsewhere, without ever touching the physical card. Visa told Which? this kind of attack is technically possible but requires serious criminal coordination and is not something that scales easily. Nobody has confirmed exactly what happened to this card. It is a plausible theory from a specialist, not a proven method, and there is no public data on how often it happens.

What this actually means for you

The headline here is not "a new scam is sweeping Britain". It is that a bank's first answer, when fraud happens, is sometimes wrong, and that you do not have to accept it.

Banks run automated and manual fraud checks. Those checks sometimes conclude that because the correct Pin was used, the customer must be at fault. That conclusion can be wrong, even when the systems insist the card and Pin matched. If you still have your card in your hand and your bank says it was used somewhere else, that is a contradiction worth pushing on, not a personal failing to apologise for.

It is also worth knowing what is not happening. UK Finance has stated there are no recorded cases in the UK of someone walking up with a contactless reader and taking money from a card in your pocket on a train or in a crowd. If you have seen warnings about this, they describe a myth, not a documented risk. The more common route criminals actually use is infecting payment terminals, especially abroad, to capture card data when it is used normally.

What to do if this happens to you

• Act the moment you get an alert. If your bank notifies you of a transaction you did not make, call its fraud line straight away, even if your card is sitting right next to you. Time matters, and an early report strengthens your case later.
• Write down your timeline. Gym check-ins, phone location, receipts, anything that proves where you and your card actually were. This is exactly what resolved the Dubai case: the customer could show the transactions were physically impossible.
• Don't accept a verbal refusal as final. If your bank turns you down, ask in writing for the specific findings behind that decision. A written explanation is harder to maintain if it doesn't hold up to scrutiny.
• Push back on assumptions, politely but firmly. "The correct Pin was used" is not the same as "you were careless with your Pin". You are allowed to disagree with that leap, especially if you can show you still had the card.
• Escalate for free if you're still unsatisfied. Once you've been through your bank's own complaints process and got nowhere, you can take the case to the Financial Ombudsman Service at no cost. It exists precisely for disputes like this.

What this does not fix

None of this is about software. A VPN does not stop point-of-sale fraud, it does not determine who used your card, and it will not get a wrongly refused refund paid out. Those are things only your bank, and if needed the Ombudsman, can resolve.

What a VPN and general good habits do help with is the ordinary run of scam attempts that often follow a fraud incident: fake "your bank has flagged a transaction" texts, phishing emails asking you to "verify your card", or calls pretending to be your bank's fraud team. Genuine banks will never ask you to read out a one-time passcode or move money to a "safe account". If you get a message like that, don't act on it straight away. Checking it first costs you nothing.