The Financial Consumer Agency of Canada (FCAC) has released a new bulletin to remind federally regulated financial institutions (FIs) of its expectations regarding unauthorized credit and debit card transactions.
Thorough investigations expected
The FCAC expects FIs to thoroughly investigate the circumstances before finding a cardholder liable for an alleged unauthorized transaction. The key question is whether circumstances beyond the cardholder’s control resulted in the transaction. The FCAC provides that FIs must not rely solely on authentication technologies for these investigations, but rather, comprehensive investigations must be conducted. For example, FIs cannot find that a cardholder is liable for a transaction solely on the basis that a transaction was completed the correct chip and PIN combination.
Documentation of investigative steps
FCAC expects FIs to report on the specific investigative steps taken before issuing a finding of liability against a cardholder but it is not clear from the bulletin whether the report is expected to be made to the cardholder or to the FCAC. I checked with a Senior Officer at the FCAC who advised that reports are expected to be provided to both the cardholder and the FCAC: (1) once an investigation into an alleged unauthorized transaction is completed, if the cardholder is held liable for the transaction, the FI is expected to provide specific reasons to the cardholder for the finding; and (2) when the FCAC is investigating unauthorized card transactions, the FI would be expected to report to the FCAC on the specific investigative steps taken before finding a cardholder liable.