Anyone who keeps their PIN in their wallet together with their EC card is acting with gross negligence. However, if you keep your giro card with an encrypted PIN in your wallet, in the event of theft, your bank will have to compensate you for the damage caused by thieves with the card – at least for the most part, as the Munich district court has now determined in a civil case.
The plaintiff in the proceedings was a bank customer from Munich. On a holiday in Italy, thieves stole his wallet and EC card from a motorway service station near Modena in Emilia-Romagna. When he noticed the loss, he had the card blocked immediately. But by then the thieves had already withdrawn 1000 euros. The Munich resident’s account was then debited by his bank for this amount and a fee of eleven euros.
As it turned out later, the withdrawal by the thieves at an ATM had technically been completely problem-free. The defendant bank concluded that the perpetrators had also found the plaintiff’s PIN in his wallet. However, the plaintiff, who was obviously mathematically talented, split his PIN into prime numbers in two steps and formed a five-digit number sequence from them. He wrote these down on a small piece of paper with phone numbers and put it in his wallet. He explained in court that the thieves had nevertheless managed to withdraw money from his account by saying that the perpetrators probably had a specific technique that did not require the PIN.
The district court largely followed the arguments of the plaintiff and ordered his bank to pay an amount of 861 euros. The court only granted the bank a claim for damages of 150 euros for the stolen EC card. In the grounds for the judgement, the court pointed out that “the plaintiff’s provision of the PIN in encrypted form was sufficiently secure” and did not even violate “simple duties of care”. The plaintiff has also developed a “complex, individual encryption method” which the court considers sufficiently secure.
Even a commissioned expert was initially unsuccessful in decoding the PIN, which had been converted into a prime number – although he knew how the plaintiff had proceeded. Last but not least, as the court stated in its reasoning, the plaintiff wrote down the formed prime number, behind which his PIN was hidden, “incoherently on a piece of paper with telephone numbers” – without mentioning that it was a PIN. The court was also unable to clarify how the thieves managed to withdraw money.
The judgment of the district court (Az. 142 C 19233/19) is not yet final.