Who's Really Responsible In Online Banking Fraud?

TheRealStyro writes "According to this article a Miami businessman is suing a bank because of a fraudulent fund transfer possibly caused by the coreflood virus/trojan. He claims the bank is responsible because the bank failed to protect him from known online banking risks. It is obvious that this guy should have had an anti-virus package active, but shouldn't the bank have questioned such a large transfer to a republic of the former Soviet Union (these republics having gained the unfortunate notoriety of being dens of villainy and hackerdom)?"

Comments

Banks should not allow funds to be transferred...

[DoorFrame]

I went to my bank the other day to see if I could put a hold on all transfers of money coming out of my account with the exception of those going to two (and only two) credit card companies. Specifically I wanted to block all money going OUT to my paypal account (I only use the account to receive funds). They said they were not able to stop companies from transferring money out of my account if they had the proper information to do so.

What the hell?

Why not demand pre-verfication on this sort of thing? Why not give the option to request a phone call confirmation of fund transfers, especially when the funds aren't simply going to Visa or the gas company? Or just allow me to set up a list of comanies/websites that are permitted to transfer funds out of my account. There's no reason the banks can't set this up, it's not very difficult. If anyone knows of a national bank that has an option for something like this, I'd be glad to hear about it.

Bank of America does not.

Cooling Off For New Transfer Destinations

[Boricle]

Here in Australia, one of my financial institutions have recently changed their transfer policies so that transfers to a new destination (ie, one that you have not already transferred to) are "held" for 48 hours before the transfer completes (compared to overnight for regular transfers).

I believe that this is to facilitate a few things, such as:

* Easier to rollback "Oops, Wrong Account Number" problems.
* Easier to prevent the channelling of money to accounts from pishing victims (rough guess, if destination account is receiving several transfers in 24 hours, then raise red flag).

Of course, the cynical side of me thinks that its just an excuse for the bank to use the money on the short term money market for an extra 24 hours. ;)

Boris.

No

[temojen]

I'm betting if the Bank had called him questioning the transfer the story would be is the bank violating his privacy rights by questioning transfers.

Phoning someone and asking them if they really did make a transfer is not an invasion of privacy as the customer should already know about it, and the bank definitely does.

I've gotten this kind of call before, and I'm glad of it... In my case though, I really had made a withdrawl in one city, then a $2000 interac purchase in annother city 2 hours later, then another interac transaction a few hours later in the first city.

Re:Banks should not allow funds to be transferred.

[Znork]

Any online bank that doesnt use offline one-time keys as transaction verification is insecure and vulnerable to client computer hacking.

The technology to solve the problem is available, and many banks use it, so frankly I'd say any bank which does not offer such an option should be held at least partially responsible for losses incurred through lax security policies.

What happened to BofA $0 Liability?

[mjh]

This guy's bank is Bank of America. Here's a notable quote from the BofA Website:

$0 liability

With our Online Banking service, you can be confident that your Bank of America accounts will be secure and protected. We guarantee $0 liability for any unauthorized activity originating from Online Banking, including Bill Payment. Read Your Responsibilities for information about reporting unauthorized transactions to preserve your rights under this guarantee.

Unless I'm missing it, I don't see anywhere that it says the customer is responsible for running virus protection. Is there some reason that I'm missing as to why this very public guarantee does not apply?

There is a difference

[cOdEgUru]

An ATM limits you by preventing the amount you can withdraw from the account (upto 300).

A Wire transfer of 90,000 to a country which is known in Financial circles to be a haven to cybercriminals should have sent up some flags.

Heck, I spent over a grand on a credit card transaction, Discover used to call me up and "harass" me. Why? Because they stand to lose money if its a fraudulent transaction.

Why didnt BOA do the same? Coz it aint their money? Safeguards are only built in when its your ass on the line.

Re:PayPal

[LadyLucky]

You can actually listen to this happen. Someone recorded their conversation with them. Read about it here:

http://paypal.ctyme.com/paypal/paypalsucks.htm

The best bit is how PayPal allows you to record their conversations :-)