Users divided about customer liability for online fraud losses

Posted by   Virus Bulletin on   May 6, 2008

Many users worried about lack of knowledge.

In a poll of more than 700 visitors to the VB website, users were divided on whether or not it is fair for online banking customers to be held liable for losses via phishing/online scams if they don't have adequate protection on their PCs.

While 46% of respondents thought it fair to hold underprotected users liable for their own losses, 45% of respondents felt that it is not fair - at least not under current circumstances.

The poll results come a month after a new banking code was launched by the British Bankers' Association (BBA), which states that customers who 'use up-to-date anti-virus and anti-spyware software and a personal firewall' cannot be held liable for losses caused by online theft - and suggesting that those that do not have such protection in place may be held liable for their own losses.

"Anyone using a computer has to realize that it is like the Wild West: using online banking without adequate protection almost guarantees 24-hour assaults," said home-user John Mazzeo, arguing that customers of online banking should "protect themselves or suffer the consequences".

However, others wondered whether the average user of online banking is sufficiently well informed to expect to have their systems properly secured. "A lot of people don't know how to protect themselves and don't even know what a virus or a trojan is," said user Niall Collins. This feeling was echoed by others: "There should be some sort of education initiative to attempt to alert the uninformed to the potential risks and preventative measures that they can take to avoid them."

Some respondents wondered whether the new Banking Code could be used by banks to pass the blame for online fraud on to customers, saying they believed that victims, regardless of installed protection, will never have what their bank considers adequate.

Brian Mairs, spokesman for the BBA, admits that a very strict interpretation of the Code might lead readers to believe they are liable for losses if their anti-virus software is inadequate, but he says this is quite a leap from what is written in the code. In a blog post on the BBA's website, he expands on this: "Customers are not responsible for losses on any of their bank accounts unless they have acted fraudulently or without reasonable care."

When asked why the Banking Code did not specify minimum security requirements for the banks' systems - something that had worried some users - Mairs explained that this is a commercial matter for individual banks, on which the BBA would not take a view.

While the importance of having your computer properly secured cannot be stressed enough, there certainly is a big gap between what users know and what they should know when it comes to the risks of using a computer in general and online banking in particular. This was clearly demonstrated six months ago when 50% of users voting in a poll on this site said they consider online banking to be safe.

As major targets of today's malware, banks and other financial institutions certainly have a role to play when it comes to user education - particularly as users are increasingly being encouraged by the banks to use their online banking facilities. At the same time, it is imperative that the banks make sure they pay attention to keeping their own systems as secure as possible.

VB has invited a panel of security experts from the banking and financial services sector to speak at VB2008 on the efforts their organizations are making to counter online fraud - it is hoped that such an open forum will facilitate the exchange of ideas and sharing of knowledge between the banking and anti-malware communities. VB2008 takes place 1-3 October 2008 in Ottawa, Canada. For details of the rest of the programme and online registration, see here.

Posted on 06 May 2008 by Virus Bulletin

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VBSpam tests to be executed under the AMTSO framework

VB is excited to announce that, starting from the Q3 test, all VBSpam tests of email security products will be executed under the AMTSO framework.

In memoriam: Prof. Ross Anderson

We were very sorry to learn of the passing of Professor Ross Anderson a few days ago.

In memoriam: Dr Alan Solomon

We were very sorry to learn of the passing of industry pioneer Dr Alan Solomon earlier this week.

New paper: Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

In a new paper, researchers Aditya K Sood and Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited in order to gather threat intelligence, and present a model of mobile AppInjects.

New paper: Collector-stealer: a Russian origin credential and information extractor

In a new paper, F5 researchers Aditya K Sood and Rohit Chaturvedi present a 360 analysis of Collector-stealer, a Russian-origin credential and information extractor.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.