You handed over your card and PIN. Can the bank still share liability?

CASE UPDATE

Ng Choon Luk (Deceased) v. CIMB Bank Bhd [2026] 6 CLJ 479

High Court, Johor Bahru — 3 March 2026

Disclosing your PIN and handing over your debit card can expose your savings to fraud. But if unusual withdrawals continue for days, does the customer’s mistake necessarily release the bank from all responsibility?

In this case, the High Court found fault on both sides and reduced the compensation to reflect the customer’s own negligence.

BRIEF FACTS

An 85-year-old customer was deceived by scammers impersonating police officers. He disclosed his PIN and surrendered his debit card.

Between 24 June and 7 July 2022, unauthorised withdrawals and transfers depleted his account by RM529,774.79. This continued for 14 days and was markedly different from his usual banking activity over a relationship of about 30 years.

His estate, through its administrator, sued the bank. The bank relied, among other things, on his disclosure of the PIN and surrender of the card.

DECISION

The High Court held the bank liable in negligence and for breach of its contractual duty, while rejecting the separate claim based on fiduciary duty. Its findings included:

1. The pattern of transactions mattered. The repeated, substantial withdrawals departed sharply from the customer’s established profile. The bank had fraud-detection capabilities and contractual powers to restrict the account, yet it did not contact the customer or intervene during the 14-day period.

2. The customer’s mistake did not explain away the bank’s later failure. Giving the scammers access caused the initial exposure to loss. However, the bank’s failure to respond as the abnormal pattern continued also contributed to further loss that timely intervention could have prevented.

3. The customer had not personally instructed the disputed transfers. The court distinguished a situation where a customer personally directs a bank to make payments after being deceived. Here, the scammers themselves used the card and PIN. That factual distinction mattered to the court’s treatment of the bank’s duty.

4. The customer’s own negligence reduced recovery. Applying contributory negligence under section 12(1) of the Civil Law Act 1956, the court apportioned responsibility at 40% to the customer and 60% to the bank. It awarded the estate RM317,864.87 out of the established loss of RM529,774.79. The additional claim for general damages was dismissed for lack of supporting evidence.

WHAT’S NEXT?

For scam victims, giving away a card or PIN is a serious factor in assessing responsibility, but it does not necessarily answer every question about the bank’s conduct. The transaction pattern, duration of the fraud, available warning signs and the bank’s ability to intervene may all matter.

Report the fraud promptly and preserve account statements, communications with the scammers, the police report and records of when the bank was notified. Earlier statements may be particularly useful in showing how the disputed transactions differed from normal activity.

For banks, the decision highlights the importance of acting on unusual transaction patterns, particularly where the evidence shows a prolonged opportunity to intervene.

This is a High Court decision on its particular facts. It does not establish that banks must reimburse every scam victim, or that the same result follows where a customer personally authorises the payments.

Share this article