Fraud losses by banks shifted onto consumers
(01/05/2008)

The newly revised UK British Banking code means that fraud losses by banks will now be shifted onto consumers. The new code allows banks to hold customers personally responsible if they have not taken adequate security measures to protect themselves.

The research, published this month by analyst firm Gartner, documented that 37% of respondents were unsure how they had become victims of credit card fraud and a further 19% attributed credit card account breaches to retailers, government agencies or third parties. Data from the US and the rest of Europe also suggests that similar trends exist, as companies in these regions are looking to adopt a similar policy.

While the new guidelines advise that customers' computers must be kept secure to protect sensitive data, it offers little or no real assistance on how to use firewall and antivirus/spyware protection effectively or ensure adequate security standards.

Alan Coburn, managing consultant at dns, believes that despite advising customers to practice safe computing, banks have to take a greater responsibility for their customers instead of charging them for their misfortunes:

“It is disappointing that the new legislation means banks can absolve themselves of their responsibility to protect customers. This could be considered as another indication that financial institutions are still struggling with basic compliance and as yet, still can’t adequately protect themselves or customer data. The research shows that current forms of protection are piecemeal and have clearly weakened, especially as evolving threats have become increasingly sophisticated.”

“It is all well and good advising customers to ensure their PCs are secure, but the truth is that many customers have not been educated to maintain a high enough level of vigilance when it comes to security, and are often unaware about how to ward off attacks by fraudsters. To ensure better protection for customers and to remain compliant, banks can seek assistance from dedicated security experts on how to enforce a more effective security policy, implementing real-time transaction verification systems, anti-malware systems and stronger user authentication. This leaves them in a much stronger position to mitigate potential risks, rather than shifting responsibility.”