My wife was recently expecting a delivery and received a text informing her that she had to pay an additional Dh12 customer fee. She clicked on the link and entered her credit card details, but when she was asked for the PIN, she became suspicious and alerted our bank immediately.
In response, the bank froze my wife’s credit card, which is a supplementary card to mine as the main account holder. It has a limit of Dh30,000. Thankfully, the scammers were unable to gain access to the account.
However, the bank also wanted to freeze our joint current account and both debit cards, which we objected to as we had a credit card payment due in two days. If this was necessary, then why didn’t they freeze the main credit card?
To renew the blocked cards, unfreeze the current account and regain access to internet banking, we were told that we had to sign an indemnity form. I refused to sign it due to its unreasonable terms, which included a point that I would undertake to sign and enact any document that the bank presents to me in the future. Several bank representatives told me that it was standard, had been drawn up by the bank’s lawyers and could not be amended.
I told the bank that I would remove my deposits and open up an account elsewhere, but they said that was not possible as the account was still frozen. Under duress, I signed the indemnity, which had been slightly amended by the bank to remove reference to my current account. Ironically, the scammers would have had an opportunity to steal Dh30,000 from my credit card, but the bank was now taking control of the Dh350,000 in my current account.
When I requested a copy of the signed indemnity form, the bank refused to give it to me despite it being a legally binding document. I have been told by the bank that it is likely my complaint will be rejected as they followed procedure. But I would argue that their procedure is wrong and I was pressured to sign the indemnity form to gain access to my money. What rights do I have and can I get the indemnity form withdrawn? CB, Dubai
Debt panellist 1: Steve Cronin, founder of DeadSimpleSaving.com
Your experience is an important warning to us all. There are many entities out there, not all of them private, that are using texts or emails to get access to our information. Either they persuade you to enter your card details or click on a link that downloads malware onto your device. The package delivery ruse is very common. None of us should provide card details or click on any link unless we are 100 per cent sure it is legitimate.
I assume that your wife did not enter the PIN, so the potential damage was limited. If you do feel your card is compromised, you can request a temporary block on your card – credit cards are safer than debit cards because the money does not leave your account immediately.
Your story suggests it might be prudent not to reveal too many details initially about why you want a block, which will enable you to cancel it later. The freezing of your current account seems like a big over-reaction by the bank as it could have just put a Dh30,000 hold on your current account.
I do not recommend having joint accounts in the UAE, as one or both of you can have problems if the account is frozen due to a blocked card, such as falling seriously ill or losing your job. At the least, you must each have your own account as a back-up, even if it only contains Dh5,000 to Dh10,000.
As a couple, you should also maintain at least two banking relationships in the UAE, just in case your bank gets annoyed with you or you get annoyed with your bank. Again, you do not have to keep a huge amount with the other bank.
It is also a mistake to have Dh350,000 in your current account. It is earning no interest and vulnerable to being frozen or stolen. It also implies you are not making the most of your money, though you are certainly not the only people to build up too much cash in the bank.
As it is getting eroded by inflation of 2 to 3 per cent a year on average, you are losing the equivalent of the cost of more than three return flights to the UK each year with your money just sitting there. You should have a cash buffer of six months in total expenses and sinking funds for major future purchases, but beyond that, invest your money in a global stock and bond portfolio or real estate.
While the legal agreement you had to sign was quite heavy handed, it refers specifically to the action of unblocking your accounts. There is a simple solution. Cancel the cards, transfer your money to one or more other banks, close your accounts and never use the bank again.
Then there is no risk whatsoever of losses being incurred that the bank could chase you for, and the indemnity form no longer matters. There is enough choice of banks in the UAE that you are not tied to it, even if you have a mortgage.
Debt panellist 2: Tala Azar, associate at BSA Ahmad Bin Hezeem & Associates
We cannot provide a formal opinion without reviewing all documents involved in the above circumstances, in particular the terms and conditions relating to the bank account and credit and debit card issuance.
It is standard procedure by banks in the UAE to protect against unauthorised access to a customer’s bank account by freezing it when a customer reports a phishing concern.
The period during which the bank account is frozen should not exceed the time period reasonably required to address the security concern and should not exceed a certain number of days as per the contractual provisions or the Central Bank of the UAE’s regulations. There is a general obligation under the UAE Central Bank’s consumer protection regulation that all consumers be treated “equitably, honestly and fairly at all stages of their relationship” with banks.
Regarding the indemnity form you were required to sign, the bank does not have the right to refuse to provide you with a copy. Should the content of the indemnity form not be reasonably proportional to and aimed at protecting the bank against any claims relating to your phishing report or any other legitimate concern of the bank, it could constitute undue and coercive pressure by the bank on consumers in contravention of the UAE Central Bank’s consumer protection regulations.
The regulator has set out clear guidelines under its consumer protection regulations that allow customers to submit a complaint for breach of their rights by banks in the UAE. Local lenders have a legal obligation to address complaints submitted by their customers within 30 days. If the matter has been dealt with by your bank but remains unresolved, you can then register a complaint with the UAE Central Bank’s Consumer Protection Department.
Debt panellist 3: Carol Glynn, founder of Conscious Finance Coaching
Firstly, well done to your wife for identifying the attempted fraud. Fraudsters are becoming more sophisticated and it’s becoming harder to identify them. She was correct to report the issue immediately to the bank to protect your credit card account. It was a reasonable expectation for the card to be cancelled and a new one issued in its place. This is standard practice in such situations.
Based on your situation, it is surprising the bank took such extensive steps to protect your entire assets when only the credit card was at risk. My advice would be to document in detail what has happened, who you spoke to and include details of both verbal and written communications with bank representatives. Submit a formal complaint to the bank through it’s complaints process, including a request to nullify the indemnity letter.
Separately, I can sense your understandable frustration with your current bank. I would suggest you consider moving your assets to another bank. If they do not withdraw the indemnity letter and you are unable to find an acceptable resolution, then any dealings with your bank in the future are likely to be tainted by this experience.
For your own stress management, consider moving your assets to another bank and starting afresh. With such large cash assets, many banks will warmly welcome your business.