Users divided about customer liability for online fraud losses

Posted by   Virus Bulletin on   May 6, 2008

Many users worried about lack of knowledge.

In a poll of more than 700 visitors to the VB website, users were divided on whether or not it is fair for online banking customers to be held liable for losses via phishing/online scams if they don't have adequate protection on their PCs.

While 46% of respondents thought it fair to hold underprotected users liable for their own losses, 45% of respondents felt that it is not fair - at least not under current circumstances.

The poll results come a month after a new banking code was launched by the British Bankers' Association (BBA), which states that customers who 'use up-to-date anti-virus and anti-spyware software and a personal firewall' cannot be held liable for losses caused by online theft - and suggesting that those that do not have such protection in place may be held liable for their own losses.

"Anyone using a computer has to realize that it is like the Wild West: using online banking without adequate protection almost guarantees 24-hour assaults," said home-user John Mazzeo, arguing that customers of online banking should "protect themselves or suffer the consequences".

However, others wondered whether the average user of online banking is sufficiently well informed to expect to have their systems properly secured. "A lot of people don't know how to protect themselves and don't even know what a virus or a trojan is," said user Niall Collins. This feeling was echoed by others: "There should be some sort of education initiative to attempt to alert the uninformed to the potential risks and preventative measures that they can take to avoid them."

Some respondents wondered whether the new Banking Code could be used by banks to pass the blame for online fraud on to customers, saying they believed that victims, regardless of installed protection, will never have what their bank considers adequate.

Brian Mairs, spokesman for the BBA, admits that a very strict interpretation of the Code might lead readers to believe they are liable for losses if their anti-virus software is inadequate, but he says this is quite a leap from what is written in the code. In a blog post on the BBA's website, he expands on this: "Customers are not responsible for losses on any of their bank accounts unless they have acted fraudulently or without reasonable care."

When asked why the Banking Code did not specify minimum security requirements for the banks' systems - something that had worried some users - Mairs explained that this is a commercial matter for individual banks, on which the BBA would not take a view.

While the importance of having your computer properly secured cannot be stressed enough, there certainly is a big gap between what users know and what they should know when it comes to the risks of using a computer in general and online banking in particular. This was clearly demonstrated six months ago when 50% of users voting in a poll on this site said they consider online banking to be safe.

As major targets of today's malware, banks and other financial institutions certainly have a role to play when it comes to user education - particularly as users are increasingly being encouraged by the banks to use their online banking facilities. At the same time, it is imperative that the banks make sure they pay attention to keeping their own systems as secure as possible.

VB has invited a panel of security experts from the banking and financial services sector to speak at VB2008 on the efforts their organizations are making to counter online fraud - it is hoped that such an open forum will facilitate the exchange of ideas and sharing of knowledge between the banking and anti-malware communities. VB2008 takes place 1-3 October 2008 in Ottawa, Canada. For details of the rest of the programme and online registration, see here.

Posted on 06 May 2008 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Mostly blocked, but still good enough: Necurs sending pump-and-dump spam

The Necurs botnet has started sending pump-and-dump spam. Almost all of these emails are blocked by spam filters, yet the stock price still increased.

Why the SHA-1 collision means you should stop using the algorithm

Realistically speaking, if your software or system uses the SHA-1 hashing algorithm, it is unlikely that it will be exploited in the foreseeable future. But it is also extremely difficult to be certain that your system won't be the exception.

VB2017 Call for Papers: frequently asked questions

The call for papers for VB2017, which takes place 4 to 6 October in Madrid, Spain, is currently open. We're always on the look out for new speakers and new content, so to help anyone who's unfamiliar with the VB conference, we've prepared a list of…

Throwback Thursday: Michelangelo - Graffiti Not Art

This week marked the 25th anniversary of the trigger date of the infamous Michelangelo virus. In January 1992, VB published an analysis of the boot sector virus that captured the imagination of the press and kicked up a media storm.

How are you defending your network? Come and tell us at VB2017!

Is it your job to defend your company’s network? Are you defending a government’s systems? Do you help secure the devices used by activists operating in less open societies? Do you work with abuse victims targeted by spyware? Share your experiences…