When Perrier, the iconic green bottled water, was discovered to contain quantities of benzene, the company first tried to ignore the issue, then claimed that the problem was confined to the US. Three days later, there was a global recall of all its bottles. The result was that consumers' trust in the company rose and sales of the fizzy water continued - once the bottles had been cleaned properly. It seems that even the most picky customers will forgive mistakes, as long as they feel that something is being done to put it right.
In contrast, it is nearly a week since the ATM and credit card crisis that has swept the UAE was made public, and few people are any the wiser as to what has happened, how much money has been lost, and when it will be safe to use their cards again. Despite repeated assurances from the banks, some people are beginning to question whether they should continue to trust them. The first occasion that most people realised there was a problem was when they were sent a text message and invited to change their pin numbers. These warnings came from, among others, HSBC, Barclays and Emirates NBD.
Barclays reacted to an earlier incident on Friday, Aug 22. Visa International informed Barclays officials that the security of 1,469 debit and credit cards had been compromised following a breach of Visa's UAE database. Visa identified the cards and cardholders believed to be at risk. "Barclays blocked and replaced all affected cards within 48 hours and customers were duly informed and consented for the action," the bank said. "With this pre-emptive action Barclays has avoided any misuse of customer cards. We at Barclays attach top-most priority to customer service and customer account security as per our Treating Customer Fairly framework that is followed globally."
That would be fine, but it was not the end of the problem. On Aug 26, the US Embassy posted warnings on its website. HSBC's initial text message last week was more urgent - and more widespread. It read: "Banks in UAE have reported incidences of ATM misuse. As a precaution we strongly urge you to immediately change your ATM pin at the nearest HSBC ATM in the UAE." However, not every account holder received this message.
In response to growing pressure, Barclays issued a statement yesterday reassuring clients that "in reference to the reports of credit card ATM fraud, Barclays is working with all related parties including the card association". The bank is still in the process of "contacting all affected cardholders to provide instruction". The National Bank of Abu Dhabi has prohibited the use of its cards outside the country, which is not very helpful if you are travelling. Some 23 days later, many of its customers are none the wiser as to what they should be doing.
An executive at one of the country's largest banks said there had been 58 confirmed cases of fraudulent ATM cash withdrawals from its customer accounts. Most banks reimburse their customers for any losses. Nearly all the transactions are taking place outside the country, all the way from the Far East to North America. Taking advantage of consumers' and banks' downtime, most of the fraudulent activities are transacted at night, typically between 1am and 4am.
"It's a well co-ordinated, well organised fraud network," said Arup Mukhopadhyay, the executive vice president of retail banking at Abu Dhabi Commercial Bank (ADCB). As a result, he said, ADCB had increased its monitoring of the system to around the clock. He also said the company had blocked ATM transactions on its cards in some countries after midnight. Mr Mukhopadhyay said that ADCB informed or cancelled the cards of its consumers that it identified as potentially compromised, based on similar transaction trends. It did not send universal alerts because it did not want to cause a panic.
"If you send blanket messages to all your customer base in that scenario, you actually do the reverse of what you're trying to get done and completely erase confidence, so it is best to narrow the problem," he said. "You shouldn't be worried about the banking system, you should look at how your bank is." The industry is in the dark about how the entire banking system was compromised, but one thing clear is that it was not an amateurish job. Several bankers yesterday referred to the network as the "gang". One banker said: "It could not be the work of one or two people."
There are reports of people being stranded overseas, unable to withdraw any money with their cards; of accounts that have been emptied; of long queues snaking through shopping malls, with people waiting patiently to change their pin numbers. For in this hi-tech era, it seems the only defence against credit card fraud is to change your pin number regularly. While some are wondering when the matter will be resolved, others believe the issues will continue almost indefinitely. This is not good news for those hoping to turn Dubai and Abu Dhabi into regional banking centres.
"It is part of the game that hackers and thieves play with banks that will lead the banks to tighten security features and prevent a reoccurrence, but the hackers will get smarter and try other things," said Deepak Tolani, a research analyst at Al Mal Capital. Such incidents occurred regularly abroad and the financial impact to the bottom line was usually "negligible", he said. Although Mr Tolani believes there is no cause for alarm in the UAE, credit card fraud is projected to total US$830 million (Dh3 billion) in the UK alone. The UAE is increasingly becoming part of a card-skimming industry where the global cost is billions of dollars a year.
"This is a big issue for Visa and Mastercard and sending these security warnings to most of the regional banks indicates that this breach of security information has clearly gone on for some time and is not a one-off event," said a banking analyst. "The problem is a lack of transparency in the system." It is not just a matter of transparency, but also one of confusion. No one seems willing to say how big the problem is, or how or when it will be resolved. Bankers remain confident that this latest security breach will be resolved, although few are willing to predict when this will be. A woman who answered at the Central Bank's office of banking supervision had not heard of the issue and said yesterday that "nothing has been issued from the Central Bank".
However, the governor of the Central Bank was understood to be attending a board meeting last night. Let's hope that he will persuade his peers to adopt a more coherent and unified approach. Additional reporting by Michael Jalili shamdan@thenational.ae rwright@thenational.ae