Restaurant has charged held card after 1 year

[HJG]

Wife purchased a restaurant gift card for a friend a year ago.
It was redeemed last week, but it appears there has been an issue with payment by her friend who was dining, and so my wife's debit card has now been charged for the amount owed. Obviously she'll take it up with her friend but is it OK for the restaurant 1) to have held her card details for so long and 2) charge her this amount of money without telling her first?
What's to stop them charging her completely random amounts whenever they want?

[bad company]

That’s pretty awful. Firstly your wife’s friend should have paid for anything over the amount gifted and secondly the restaurant shouldn’t assume that they can charge her for any extra.

Shame it was a debit card, easier to apply for a refund on a credit card but still worth speaking with the bank.

[Dan_1981]

Surely you just report it as an unauthorized transaction?

[HJG]

Rang bank the moment the phone notification came up. They said take it up with the restaurant.

[InitialDave]

HJG said:

Rang bank the moment the phone notification came up. They said take it up with the restaurant.

I'd at least call them first, yes, if it's simply a mistake, it may be easily rectified.

[HJG]

I think the restaurant will sort it (helpfully no phone number), but my bigger concern was the holding and subsequent charging of the debit card.

[skyebear]

Is a restaurant, or any business, retaining card details (without express authority) not a significant breach of PCI DSS?

You buy a gift card, you pay with bank/credit card and swipe or scan your card at merchant terminal. The retailer doesn't/shouldn't see the card details apart from last four digits which will appear on any receipt.

Or you read your card details over the phone, and the business inputs these into merchant terminal.

Sounds like this restaurant is retaining card details in plain text which is very naughty and would be in breach of various legislation. That's even before the utter misuse detailed by the OP to have them pay another person's debt.

Even if they retain the card details in an encrypted format they need to have a reason to do so, e.g. subscription service as well as the cardholder's permission.

Edited by skyebear on Sunday 10th August 19:35

[bad company]

Dear Bank

A year ago I spent £xxx at ABC restaurant. They seem to have retained my card details and charged an additional £xxx on (date). This transaction was not authorised by me and they were not authorised to retain my card details.

Please reverse the payment and credit my account.

[Pica-Pica]

InitialDave said:

HJG said:

Rang bank the moment the phone notification came up. They said take it up with the restaurant.

I'd at least call them first, yes, if it's simply a mistake, it may be easily rectified.

Is it a mistake, though? Your friend spent beyond the token’s value and couldn’t pay up, the restaurant claimed against the token’s bank details. It is to avoid ‘dine and dash’.

[Super Sonic]

Pica-Pica said:

Is it a mistake, though? Your friend spent beyond the token’s value and couldn’t pay up, the restaurant claimed against the token’s bank details. It is to avoid ‘dine and dash’.

If the friend spent more than the face value on the voucher, it is up to them to pay the difference, not the person who bought the voucher.
If you were to give someone a £50 voucher, and they want to buy something for £75, should you be liable for the extra £25? Of course not.

Edited by Super Sonic on Sunday 10th August 20:19

[InitialDave]

Pica-Pica said:

Is it a mistake, though? Your friend spent beyond the token’s value and couldn’t pay up, the restaurant claimed against the token’s bank details. It is to avoid ‘dine and dash’.

I generally have a policy of opening the conversation on such matters with a strong implication it's a mistake/oversight of some kind, I'd rather get the problem sorted first, and giving people a way to save face by putting it down to an error can help grease the wheels there.

Can always escalate from there easily enough if necessary.

[ATM]

Super Sonic said:

Pica-Pica said:

Is it a mistake, though? Your friend spent beyond the token’s value and couldn’t pay up, the restaurant claimed against the token’s bank details. It is to avoid ‘dine and dash’.

If the friend spent more than the face value on the voucher, it is up to them to pay the difference, not the person who bought the voucher.

This

[Dan_1981]

Dispute payment with bank. Usually an option in your app.

Raise a complaint with the ICO.

That's as long as you've checked the small print and ensured any gift card purchase doesnt include some weird clause for. Overspending etc.

Because at the moment it appears that the restaurant not only has retained payment details and reused them. But they have also linked the purchase of a specific gift card to a specific person and payment methodology.

[Lo-Fi]

Just to clarify, was it a top up payment taken from your wife's card or the whole bill?

[Pica-Pica]

ATM said:

Super Sonic said:

Pica-Pica said:

Is it a mistake, though? Your friend spent beyond the token’s value and couldn’t pay up, the restaurant claimed against the token’s bank details. It is to avoid ‘dine and dash’.

If the friend spent more than the face value on the voucher, it is up to them to pay the difference, not the person who bought the voucher.

This

What do Ts & Cs say, though?
It seems the friend’s card was refused.

[vaud]

Pica-Pica said:

ATM said:

Super Sonic said:

Pica-Pica said:

Is it a mistake, though? Your friend spent beyond the token’s value and couldn’t pay up, the restaurant claimed against the token’s bank details. It is to avoid ‘dine and dash’.

If the friend spent more than the face value on the voucher, it is up to them to pay the difference, not the person who bought the voucher.

This

What do Ts & Cs say, though?
It seems the friend’s card was refused.

Ts & Cs are irrelevant. The voucher was bought as a gift. They cannot charge any more.

Bank / complaint / etc

It would also be a breach of merchant services IIRC.

[PeteTaylor99]

vaud said:

Pica-Pica said:

ATM said:

Super Sonic said:

Pica-Pica said:

Is it a mistake, though? Your friend spent beyond the token’s value and couldn’t pay up, the restaurant claimed against the token’s bank details. It is to avoid ‘dine and dash’.

If the friend spent more than the face value on the voucher, it is up to them to pay the difference, not the person who bought the voucher.

This

What do Ts & Cs say, though?
It seems the friend’s card was refused.

Ts & Cs are irrelevant. The voucher was bought as a gift. They cannot charge any more.

Bank / complaint / etc

It would also be a breach of merchant services IIRC.

This-there is no scope for T&C's overriding statutory breaches-numerous. Just call the bank and tell them to verse it. 3 laws broken including data breach. And yes you can charge back on a debit card. The fundamental issue is absence of explicit concept which can not be obtained by any T&cs, regardless of how they are worded.

[Southerner]

I’d be inclined to visit/contact the restaurant and ‘advise’ them that they are acting very much illegally, are about to be reported for such and may find themselves in trouble as a result, and offer them the opportunity to reimburse you (with or without an additional token amount for your inconvenience, depending how irritated you might be!) - and then report them anyhow, seeing as they have a major problem with their business practices.

Presumably you’ve already had dialogue with them to have established why the card has been charged?

[ATM]

PeteTaylor99 said:

vaud said:

Pica-Pica said:

ATM said:

Super Sonic said:

Pica-Pica said:

Is it a mistake, though? Your friend spent beyond the token’s value and couldn’t pay up, the restaurant claimed against the token’s bank details. It is to avoid ‘dine and dash’.

If the friend spent more than the face value on the voucher, it is up to them to pay the difference, not the person who bought the voucher.

This

What do Ts & Cs say, though?
It seems the friend’s card was refused.

Ts & Cs are irrelevant. The voucher was bought as a gift. They cannot charge any more.

Bank / complaint / etc

It would also be a breach of merchant services IIRC.

This-there is no scope for T&C's overriding statutory breaches-numerous. Just call the bank and tell them to verse it. 3 laws broken including data breach. And yes you can charge back on a debit card. The fundamental issue is absence of explicit concept which can not be obtained by any T&cs, regardless of how they are worded.

It doesn't matter if the friend's card was refused. They can't have their cake and eat it too.