Ahmed, an Indian expatriate working as a sales manager for the Riyadh office of an international company, was hit with more than SR21,000 in fraudulent transactions on his Mastercard and Visa credit cards. A year ago, Ahmed’s credit cards expired. He contacted the local bank which had issued the cards and was advised that the new credit cards would be sent to the Saudi post office box listed as his mailing address in the Kingdom.

Ahmed had a habit of checking his bank account online about every ten days. On April 24, 2009, he checked his account and everything was fine. On May 4, 2009, he telephoned the bank to ask what had happened to his new credit cards as the others were now expired. To his horror, the bank informed him that his new credit cards had not only been activated, but had also been used to charge SR21,000 in goods and services at locations in Riyadh, Dubai and India.

The credit cards had been sent by registered mail to the international company’s Riyadh post office box, where a company driver had signed for their receipt. The driver swore that he had turned the mail over to the administration and that he knew nothing further about the credit cards. Based on Ahmed’s complaint, the bank’s anti-fraud representative chaired a meeting of the concerned parties at the bank. During the meeting, the bank advised Ahmed that they had a recording of the call during which the credit cards were activated.

When the recording was played, it was clear that the customer’s voice was not Ahmed’s. Additionally, the information requested by the bank’s representative to confirm identity during the cards’ activation process could easily have been gathered by anyone working at Ahmed’s office. Ahmed proved that he was neither in India nor Dubai when the charges were made there.

Nevertheless, in June 2009 Ahmed received a letter from the bank that read: “Based on your request, we regret to inform you that we are unable to reverse the disputed transactions since the cards were sent by registered mail to your mailing address as per your request and in compliance with bank records.”

Ahmed was forced to begin paying off the SR21,000 in fraudulent charges, including associated service charges. Not to do so, would find his name placed on the “C” list — the dreaded Saudi banking blacklist, which would prevent him from leaving Saudi Arabia. While Ahmed kept paying, he also kept fighting against the charges and contacted Arab News for assistance.

In conversations and e-mail with the Saudi bank, Arab News pointed out that during the cards’ activation process, the bank had allowed the criminal to change the mobile telephone number to which cards’ activity alerts were sent. This meant that Ahmed was prevented from knowing about his card activity in a timely manner. The bank also neglected to use a multiple factor authentication system for the cards’ activation, such as a requirement to enter the phone banking PIN, answer challenge questions and provide a confirmation sent to the mobile telephone number registered by Ahmed for his online banking. How was such negligence acceptable? Arab News recommended that Ahmed file a case with the police since the bank suspected that someone in Ahmed’s office was responsible for the credit card fraud. In a surprise move, on Saturday the bank telephoned Ahmed and advised him that they had reversed their decision and his account would be credited.

There are lessons to be learned from Ahmed’s experience. If at all possible, pick up new credit cards at a bank branch. Courier delivery of credit cards is a trend. However, Arab News has received two reports of credit cards that were delivered by courier to janitorial staff at local businesses instead of the named card holders. In one of these instances the card was abandoned by the cleaner on a reception desk outside the main office for the entire weekend.

It is definitely time for employees to ask what measures are being taken by their employers in the handling of registered mail and in the securing of national identification numbers, birth dates and other personal details. Corporate personnel officers have a responsibility to protect information which could be used for identity theft, which is a growing problem in the Kingdom. Individuals must be proactive in following up with the issuing bank when a credit card is due for renewal and in checking accounts online every day until the card is safely delivered. Lastly, the Saudi Arabian Monetary Agency (SAMA) needs to issue stricter regulations for credit card activation and transactions, plus put forward a transparent process to enable consumers to challenge bank decisions regarding disputed charges.