Straight to the point!


My friend used her ATM card in September to withdraw some funds from her account. Early hours of the next morning while asleep (12 am to 1 am) , she received message notifications from Access bank (her account holder). Due to the timing, she did not attend to her phone.

When she woke up the next day, about six (6) different transactions were authorized on her Access bank account. Apparently, these transactions occurred in those early hours accrueling to over 400k.

She then checked for her ATM card and did not find it. This meant that she had misplaced it during her movement from the bank to the house. Now, she went to the bank to lodge a complaint. The bank's rep told her there was nothing they could do to help her. As far as the bank's help goes, they gave her the platform on which the fraudster had used her card... wish.com. In a time like this, someone lost over 400k and it is not even treated with any urgency.

A few days later, there was another transaction initiated on her account and OTP was sent for her approval. Of course, they could not access the funds anymore.

Now my questions are these!

1. Are banks not required to send OTP to customers as a security measure before approving transactions?

2. Even without a card's PIN, transactions are approved by banks. Shouldn't PIN and other details be prerequisites for approving transactions?

3. If a bank fails to protect her customers, shouldn't such a bank take responsibility for her shortcomings?

4. How is it that my friend never got OTPs for all those transaction before the complaint but got after the complaint?

Some fraudster are good @ outstanding some banks security