Hello @abac 
According to the clause 9.4 of the Cardholder Terms, given that you did not agree or consented to this people knowing your PIN, and you did not purposefully or negligently revealed your PIN (as required by clause 9.1), I see no reason why :r: could make you liable for the charges 
If you find this situation is unfair (yeah), you should escalate the issue with :r: before going to the Ombudsman (getting in touch with the bank first in an official way is usually a requirement). You can find more info on the escalation options here:
Cardholder Terms