Users divided about customer liability for online fraud losses

Posted by   Virus Bulletin on   May 6, 2008

Many users worried about lack of knowledge.

In a poll of more than 700 visitors to the VB website, users were divided on whether or not it is fair for online banking customers to be held liable for losses via phishing/online scams if they don't have adequate protection on their PCs.

While 46% of respondents thought it fair to hold underprotected users liable for their own losses, 45% of respondents felt that it is not fair - at least not under current circumstances.

The poll results come a month after a new banking code was launched by the British Bankers' Association (BBA), which states that customers who 'use up-to-date anti-virus and anti-spyware software and a personal firewall' cannot be held liable for losses caused by online theft - and suggesting that those that do not have such protection in place may be held liable for their own losses.

"Anyone using a computer has to realize that it is like the Wild West: using online banking without adequate protection almost guarantees 24-hour assaults," said home-user John Mazzeo, arguing that customers of online banking should "protect themselves or suffer the consequences".

However, others wondered whether the average user of online banking is sufficiently well informed to expect to have their systems properly secured. "A lot of people don't know how to protect themselves and don't even know what a virus or a trojan is," said user Niall Collins. This feeling was echoed by others: "There should be some sort of education initiative to attempt to alert the uninformed to the potential risks and preventative measures that they can take to avoid them."

Some respondents wondered whether the new Banking Code could be used by banks to pass the blame for online fraud on to customers, saying they believed that victims, regardless of installed protection, will never have what their bank considers adequate.

Brian Mairs, spokesman for the BBA, admits that a very strict interpretation of the Code might lead readers to believe they are liable for losses if their anti-virus software is inadequate, but he says this is quite a leap from what is written in the code. In a blog post on the BBA's website, he expands on this: "Customers are not responsible for losses on any of their bank accounts unless they have acted fraudulently or without reasonable care."

When asked why the Banking Code did not specify minimum security requirements for the banks' systems - something that had worried some users - Mairs explained that this is a commercial matter for individual banks, on which the BBA would not take a view.

While the importance of having your computer properly secured cannot be stressed enough, there certainly is a big gap between what users know and what they should know when it comes to the risks of using a computer in general and online banking in particular. This was clearly demonstrated six months ago when 50% of users voting in a poll on this site said they consider online banking to be safe.

As major targets of today's malware, banks and other financial institutions certainly have a role to play when it comes to user education - particularly as users are increasingly being encouraged by the banks to use their online banking facilities. At the same time, it is imperative that the banks make sure they pay attention to keeping their own systems as secure as possible.

VB has invited a panel of security experts from the banking and financial services sector to speak at VB2008 on the efforts their organizations are making to counter online fraud - it is hoped that such an open forum will facilitate the exchange of ideas and sharing of knowledge between the banking and anti-malware communities. VB2008 takes place 1-3 October 2008 in Ottawa, Canada. For details of the rest of the programme and online registration, see here.

Posted on 06 May 2008 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

VB2016 paper: Steam stealers: it's all fun and games until someone's account gets hijacked

Last year, Kaspersky Lab researcher Santiago Pontiroli and PwC's Bart Parys presented a VB2016 paper analysing the malicious threats faced by users of the Steam online gaming platform, and highlighting how organized criminals are making money with…

Research paper shows it may be possible to distinguish malware traffic using TLS

Researchers at Cisco have published a paper describing how it may be possible to use machine learning to distinguish malware command-and-control traffic using TLS from regular enterprise traffic, and to classify malware families based on their…

Is CVE-2017-0199 the new CVE-2012-0158?

After five years of exploitation in a wide variety of attacks, CVE-2012-0158 may have found a successor in CVE-2017-0199, which is taking the Office exploit scene by storm.

Review: BSides London 2017

Virus Bulletin was a proud sponsor of BSides London 2017 - Martijn Grooten reports on a great event.

VB2017: one of the most international security conferences

It is well known that the problem of cybersecurity is a global one that affects users worldwide - but it's also one that has some unique local flavours. With speakers representing at least 24 countries, VB2017 is one of the most international…