Users divided about customer liability for online fraud losses

Posted by   Virus Bulletin on   May 6, 2008

Many users worried about lack of knowledge.

In a poll of more than 700 visitors to the VB website, users were divided on whether or not it is fair for online banking customers to be held liable for losses via phishing/online scams if they don't have adequate protection on their PCs.

While 46% of respondents thought it fair to hold underprotected users liable for their own losses, 45% of respondents felt that it is not fair - at least not under current circumstances.

The poll results come a month after a new banking code was launched by the British Bankers' Association (BBA), which states that customers who 'use up-to-date anti-virus and anti-spyware software and a personal firewall' cannot be held liable for losses caused by online theft - and suggesting that those that do not have such protection in place may be held liable for their own losses.

"Anyone using a computer has to realize that it is like the Wild West: using online banking without adequate protection almost guarantees 24-hour assaults," said home-user John Mazzeo, arguing that customers of online banking should "protect themselves or suffer the consequences".

However, others wondered whether the average user of online banking is sufficiently well informed to expect to have their systems properly secured. "A lot of people don't know how to protect themselves and don't even know what a virus or a trojan is," said user Niall Collins. This feeling was echoed by others: "There should be some sort of education initiative to attempt to alert the uninformed to the potential risks and preventative measures that they can take to avoid them."

Some respondents wondered whether the new Banking Code could be used by banks to pass the blame for online fraud on to customers, saying they believed that victims, regardless of installed protection, will never have what their bank considers adequate.

Brian Mairs, spokesman for the BBA, admits that a very strict interpretation of the Code might lead readers to believe they are liable for losses if their anti-virus software is inadequate, but he says this is quite a leap from what is written in the code. In a blog post on the BBA's website, he expands on this: "Customers are not responsible for losses on any of their bank accounts unless they have acted fraudulently or without reasonable care."

When asked why the Banking Code did not specify minimum security requirements for the banks' systems - something that had worried some users - Mairs explained that this is a commercial matter for individual banks, on which the BBA would not take a view.

While the importance of having your computer properly secured cannot be stressed enough, there certainly is a big gap between what users know and what they should know when it comes to the risks of using a computer in general and online banking in particular. This was clearly demonstrated six months ago when 50% of users voting in a poll on this site said they consider online banking to be safe.

As major targets of today's malware, banks and other financial institutions certainly have a role to play when it comes to user education - particularly as users are increasingly being encouraged by the banks to use their online banking facilities. At the same time, it is imperative that the banks make sure they pay attention to keeping their own systems as secure as possible.

VB has invited a panel of security experts from the banking and financial services sector to speak at VB2008 on the efforts their organizations are making to counter online fraud - it is hoped that such an open forum will facilitate the exchange of ideas and sharing of knowledge between the banking and anti-malware communities. VB2008 takes place 1-3 October 2008 in Ottawa, Canada. For details of the rest of the programme and online registration, see here.

Posted on 06 May 2008 by Virus Bulletin

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

Haroon Meer and Adrian Sanabria to deliver VB2019 closing keynote

New additions to the VB2019 conference programme include a closing keynote address from Thinkst duo Haroon Meer and Adrian Sanabria and a talk on attacks against payment systems.

Free VB2019 tickets for students

Virus Bulletin is excited to announce that, thanks to generous sponsorship from Google Android, we are able to offer 20 free tickets to students who want to attend VB2019.

VB2018 paper: Lazarus Group: a mahjong game played with different sets of tiles

The Lazarus Group, generally linked to the North Korean government, is one of the most notorious threat groups seen in recent years. At VB2018 ESET researchers Peter Kálnai and Michal Poslušný presented a paper looking at the group's various…

Book your VB2019 ticket now for a chance to win a ticket for BSides London

Virus Bulletin is proud to sponsor this year's BSides London conference, which will take place next week, and we have a number of tickets to give away.

First 11 partners of VB2019 announced

We are excited to announce the first 11 companies to partner with VB2019, whose support will help ensure a great event.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.