Users divided about customer liability for online fraud losses

Posted by   Virus Bulletin on   May 6, 2008

Many users worried about lack of knowledge.

In a poll of more than 700 visitors to the VB website, users were divided on whether or not it is fair for online banking customers to be held liable for losses via phishing/online scams if they don't have adequate protection on their PCs.

While 46% of respondents thought it fair to hold underprotected users liable for their own losses, 45% of respondents felt that it is not fair - at least not under current circumstances.

The poll results come a month after a new banking code was launched by the British Bankers' Association (BBA), which states that customers who 'use up-to-date anti-virus and anti-spyware software and a personal firewall' cannot be held liable for losses caused by online theft - and suggesting that those that do not have such protection in place may be held liable for their own losses.

"Anyone using a computer has to realize that it is like the Wild West: using online banking without adequate protection almost guarantees 24-hour assaults," said home-user John Mazzeo, arguing that customers of online banking should "protect themselves or suffer the consequences".

However, others wondered whether the average user of online banking is sufficiently well informed to expect to have their systems properly secured. "A lot of people don't know how to protect themselves and don't even know what a virus or a trojan is," said user Niall Collins. This feeling was echoed by others: "There should be some sort of education initiative to attempt to alert the uninformed to the potential risks and preventative measures that they can take to avoid them."

Some respondents wondered whether the new Banking Code could be used by banks to pass the blame for online fraud on to customers, saying they believed that victims, regardless of installed protection, will never have what their bank considers adequate.

Brian Mairs, spokesman for the BBA, admits that a very strict interpretation of the Code might lead readers to believe they are liable for losses if their anti-virus software is inadequate, but he says this is quite a leap from what is written in the code. In a blog post on the BBA's website, he expands on this: "Customers are not responsible for losses on any of their bank accounts unless they have acted fraudulently or without reasonable care."

When asked why the Banking Code did not specify minimum security requirements for the banks' systems - something that had worried some users - Mairs explained that this is a commercial matter for individual banks, on which the BBA would not take a view.

While the importance of having your computer properly secured cannot be stressed enough, there certainly is a big gap between what users know and what they should know when it comes to the risks of using a computer in general and online banking in particular. This was clearly demonstrated six months ago when 50% of users voting in a poll on this site said they consider online banking to be safe.

As major targets of today's malware, banks and other financial institutions certainly have a role to play when it comes to user education - particularly as users are increasingly being encouraged by the banks to use their online banking facilities. At the same time, it is imperative that the banks make sure they pay attention to keeping their own systems as secure as possible.

VB has invited a panel of security experts from the banking and financial services sector to speak at VB2008 on the efforts their organizations are making to counter online fraud - it is hoped that such an open forum will facilitate the exchange of ideas and sharing of knowledge between the banking and anti-malware communities. VB2008 takes place 1-3 October 2008 in Ottawa, Canada. For details of the rest of the programme and online registration, see here.

Posted on 06 May 2008 by Virus Bulletin

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2021 localhost call for last-minute papers

The call for last-minute papers for VB2021 localhost is now open. Submit before 20 August to have your paper considered for one of the slots reserved for 'hot' research!

New article: Run your malicious VBA macros anywhere!

Kurt Natvig explains how he recompiled malicious VBA macro code to valid harmless Python 3.x code.

New article: Dissecting the design and vulnerabilities in AZORult C&C panels

In a new article, Aditya K Sood looks at the command-and-control (C&C) design of the AZORult malware, discussing his team's findings related to the C&C design and some security issues they identified.

VB2021 localhost call for papers: a great opportunity

VB2021 localhost presents an exciting opportunity to share your research with an even wider cross section of the IT security community around the world than usual, without having to take time out of your work schedule (or budget) to travel.

New article: Excel Formula/Macro in .xlsb?

In a follow-up to an article published last week, Kurt Natvig takes us through the analysis of a new malicious sample using the .xlsb file format.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.