## Facts

- Frederick P. Ognibene used a Citibank ATM card and entered his PIN to withdraw $20 at a Citibank ATM.
- A third party stood nearby and observed Ognibene’s PIN entry, then obtained physical possession of Ognibene’s card.
- Using the card and the observed PIN, the third party made unauthorized withdrawals totaling $400 from an adjacent ATM.
- Ognibene did not authorize the $400 withdrawals, did not participate in them, and received no benefit.
- Citibank had prior knowledge of a recurring scam in which a perpetrator watches a customer enter a PIN and then asks for the card under the guise of testing a machine.
- Citibank posted general warnings not to let others use customers’ cards, but the warnings did not describe the known scam, did not warn about PIN observation, and did not expressly instruct customers not to surrender cards to anyone in the ATM area.
- Citibank did not establish that it had clearly disclosed to Ognibene his potential liability for unauthorized electronic fund transfers as required by federal law.

## Issues

1. Whether the $400 withdrawals were “unauthorized electronic fund transfers” under the Electronic Fund Transfer Act (EFTA) when the perpetrator used both the card and a PIN observed without the consumer’s knowledge.
2. Whether the statutory exclusion from “unauthorized” transfers applied because the consumer “furnished” the “means of access” to the perpetrator.
3. Whether Citibank could impose any customer liability for the loss without proving compliance with the EFTA’s disclosure requirements concerning consumer liability for unauthorized transfers.

## Decision

- The court entered judgment for Ognibene for $400.
- The court held the withdrawals were “unauthorized electronic fund transfers” under the EFTA.
- The court found Ognibene did not “furnish” the “means of access” within the meaning of the EFTA’s exclusion because he did not knowingly provide the PIN to the perpetrator.
- The court held Citibank failed to prove it provided the disclosures required by the EFTA regarding customer liability for unauthorized transfers, preventing the bank from shifting the loss to Ognibene.

## Legal Principles

- Under the EFTA, an “unauthorized electronic fund transfer” is a transfer initiated by someone other than the consumer without actual authority and from which the consumer receives no benefit.
- A transfer is not “unauthorized” if initiated by a person to whom the consumer has furnished the “means of access,” unless the consumer previously notified the institution that such access was no longer authorized.
- For ATM access, the “means of access” may require both possession of the card and knowledge of the PIN; surreptitious observation of a PIN is not equivalent to a consumer’s knowing furnishing of access credentials.
- A financial institution must clearly disclose the consumer’s potential liability for unauthorized electronic fund transfers; absent proof of compliant disclosure, the institution may not enforce liability allocation against the consumer.

## Conclusion

The court placed the $400 loss on the bank because the withdrawals were unauthorized under the EFTA, the consumer did not knowingly furnish the access credentials, and the bank did not prove that it gave the statutory disclosures needed to hold the consumer liable for unauthorized transfers.


Ognibene v. Citibank, N.A., 446 N.Y.S.2d 845 (N.Y. Civ. Ct. 1981)