If someone steals your wallet, takes the money and uses it to buy something that is theft against you. If someone steals your wallet, takes the bank card and uses that to buy something what crime are they committing, against whom?

This is prompted by the story in the news about this happening:

A woman has described how criminals raided her gym locker, stole her wallet and went on an £8,000 shopping spree while she was exercising.

Charlotte said she was told her card had been used to make about £8,000 worth of purchases from her current account, with goods bought from the Apple store at Westfield shopping centre in Shepherd's Bush, the Apple store in Regent Street, and Selfridges on Oxford Street - all within 90 minutes.

While Santander had managed to stop some of the purchases, she would still be £5,000 out of pocket.

"I was very rudely and bluntly told 'you will not be getting your money back. It's your fault because they've used your PIN'," she said.


Santander apologised for initially "incorrectly declining her refund request and for the customer service she received", and it has paid her £750 in compensation [after the story went viral and attracted press attention].

If the crime was theft against the account holder this would make sense, as the money was taken from the account holder. If the crime was fraud against the bank, it seems like this would not directly affect the account holder. What actually is happening here, what crime is being committed against whom?

The case and myself are in the UK but any jurisdiction would be interesting.

  • 7
    It's worth noting that "I was very rudely and bluntly told 'you will not be getting your money back. It's your fault because they've used your PIN'" doesn't imply that there's no crime. It only means that the bank is disclaiming liability because the person spending the money had the PIN.
    – phoog
    Sep 5, 2022 at 12:44
  • 3
    You have to wonder how did the thieves get the PIN? Sep 5, 2022 at 19:57
  • 1
    "If the crime was fraud against the bank, it seems like this would not directly affect the account holder." How do you figure? As a trivial counter-example, imagine you defraud the bank into thinking that you are the account holder and withdraw some money. You lied to the bank to obtain a thing of value that was in the bank's custody and control. But you also stole from the account holder since the thing of value you got belonged to them. Any insurance coverage or possible recourse they might have isn't legally relevant to what you did. Sep 6, 2022 at 6:49
  • 1
    @Neil While it's true that the Santander mobile app can show you the PIN - you need to log in to the app first and the app will ask for a re-authorisation of fingerprint/passcode before displaying it. Basically "just" taking the phone would be insufficient. Sep 6, 2022 at 8:31
  • 1
    @Neil sure.. but on most phones doesn't registering a new fingerprint itself require you to enter the phone's PIN? (mine does, I just checked) i.e. you can't just grab an unlocked phone and add your own finger print. Sep 6, 2022 at 10:39

3 Answers 3


The answer by @DaleM covers part of the answer, but not all of it. The complication is that it depends whether the card in question is a credit card or a debit card.

If the card is a credit card, there is no actual transfer of money. The bank pays the vendor, and if the purchase was not authorised by the cardholder then the bank and the vendor are victims of fraud. The bank and vendor then go through their agreed procedure for dividing the loss, in the first instance, and perhaps in future (if anyone is caught) get to sue the culprit. The cardholder is not a victim, because one of the key benefits of credit cards is that the cardholder cannot be held responsible for unauthorised payments.

(Aside: This is why all purchases not made in person should always be made by credit card wherever possible. It's also why some vendors will impose charges for using credit cards, because the bank typically charges fees to vendors which will cover those losses.)

If the card is a debit card, payments made on it represent direct transfers of money out of your account. In this case the victim is the cardholder, and the crime is theft from the cardholder. The bank may optionally reimburse you, but there is no legal requirement for them to do so until you've cancelled the card. As this case shows, it's good PR for the bank to cover this (and bad PR for them to refuse to), but strictly they have no responsibility for it.

  • This is answering the question I really wanted to ask. To clarify, in the case of a debit card, the thief is taking your money from the bank and giving it to the merchant. In taking it from the bank they intend to permanently deprive you, so it is theft from you.
    – User65535
    Sep 6, 2022 at 18:53

Burglary, theft and fraud(s)

The burglary and theft are trivial and unlikely to be prosecuted - it’s the breaking in (burglary) and taking (theft) of the possessions including the physical card itself. Using someone else’s credit card without permission is fraud - in this case it appears there were several frauds.

All are crimes against the Queen. While crimes may have victims, they are perpetrated against the state, which, in the UK is the Sovereign. The gym was a victim of burglary, the cardholder was a victim of theft, the cardholder and the bank are victims of frauds.

Any of these aggrieved people may seek damages from the perpetrator(s) (who appear to be unknown at this time) for whatever their losses are. Their most likely causes of action are the torts of conversion (the civil equivalent of theft) and fraud (the civil equivalent of, well, fraud).

The allocation of the loss between the bank and the cardholder is a matter of the contract between them and financial regulations.

  • in California there's also "Misuse of a banking card", might there be something similar?
    – Trish
    Sep 5, 2022 at 11:29
  • 1
    Probably the vendor(s) that the card was spent at can also consider themselves victims of fraud.
    – bdsl
    Sep 6, 2022 at 14:15
  • @bdsl why? They got paid.
    – Dale M
    Sep 6, 2022 at 20:28
  • 1
    @DaleM Someone entered into a transaction with them and relied on a lie to obtain their goods or services. I'm not sure if it's guaranteed that they get to keep the money, or even receive it at all from the payment processor. If they do receive it and it happens enough it could put at risk their relationship with the financial institutions.
    – bdsl
    Sep 6, 2022 at 20:59

In the US, there are more answers because there are more jurisdictions, also a distinction between "credit card" and "debit card" (banks issue both but there are separate laws). "What happens" is largely unknowable to the card-holder past a certain point. Credit cards in the US usually do not have PINs associated with them, though it is possible, so I will assume a credit card, with PIN, the card was physically stolen and used – presented – in-state, in Washington state. Federal or state law could be relevant. We start with federal law, 15 USC 1644 which says

(a) Whoever knowingly in a transaction affecting interstate or foreign commerce, uses or attempts or conspires to use any counterfeit, fictitious, altered, forged, lost, stolen, or fraudulently obtained credit card to obtain money, goods, services, or anything else of value which within any one-year period has a value aggregating $1,000 or more...

(is a criminal and shall be punished). In your story (transplanted) they crossed the dollar amount, but this is not clearly a case involving interstate commerce, so the federal law may not be applicable. The reason for the hedge is that the expression "a transaction affecting interstate or foreign commerce" is a quasi-magic expression that justifies federal intervention, since Congress does not exactly have unbounded powers to meddle in local affairs. If the federal prosecutor can devise an good reason to think that little Billy stealing a card and buying $1,000 worth of bubblegum at the local dime-store "affects interstate commerce", then you have the legal possibility of federal prosecution. It is then a discretionary matter: does the US attorney want to prosecute little Billy? (Is little Billy a cog in a vast interstate criminal enterprise). Anyhow, if they find Billy and can prove that he did the deed, he can be fined and imprisoned (10 years). This is highly unlikely, though. Also note that this law pertains to credit cards, not debit cards (there is a special law pertaining to credit transactions).

State law, RCW 9a.56.290, similarly criminalizes the act, broader language that covers more bases and which lumps all cards together, be they debit, credit or any other kind of payment card (gift card for example). Under state law, there is no minimum amount for prosecution, therefore you can be state-prosecuted for a $1 usage.

In both of these cases, the act of fraudulently using a card is a crime, even if the person initially suffering the loss is fully compensated.

There is no federal provision for breaking into a gym locker and stealing an item: it is a state-level crime. It Washington, it is theft. A credit card is an "access device", as distinct from a wallet photo. Theft of an access device is a class C felony (theft in the second degree) under RCW 9A.56.040 (even if it is not used).

Burglary is precluded as a charge if the thief is authorized to be in the gym. Washington law draws the line at the premise, and not the box.

Finally, with attention to the card-holder's loss, 15 USC 1643 limits cardholder liability for unauthorized use of a credit card (credit card, not debit card). The wording of the law is a bit confusing since it says that the card-holder is not liable unless... and then states conditions that have to be true in order to make the card-holder liable. The limit on liability is $50, the issuer must adequately warn of potential liability, also say how to alert the issuer, and the card-holder is only liable (up to $50) for charges before the issuer was notified.

  • 3
    I believe that you will find that since the major credit card payment networks all operate on an interstate basis, any transactions on those networks are considered to "affect interstate commerce" even if all parties are in the same state, and so the federal law applies to all such transaction. The state law will generally also apply. Sep 5, 2022 at 19:01
  • 2
    We know from Wickard v. Filburn that a business doesn't even have to be "interstate" to fall within the imaginable scope of a commerce-clause invoking law. My non-major state-internal credit card can be used in a neighboring state, so state-internal fraud ultimately affects interstate commerce.
    – user6726
    Sep 5, 2022 at 19:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .