Banks must follow law when repossessing