Korean Banks Forced to Compensate Hacking Victims

An anonymous reader writes "A brief story over on Finextra reveals that the Korean government is introducing new legislation that will force banks to compensate customers who have been victimized by identity theft even if the banks are not directly responsible. This action obviously will not stem identity theft but the hope is that this will push banks into security improvements that will make identity theft much harder."

Comments

All too brief...

[TripMaster Monkey]

From TFS:

A brief story over on Finextra...

'Brief' is right...'skimpy' is the adjective that comes to my mind.

A much more detailed report on this story can be found at The Korea Times.

Reading through the above referenced story, two things pop out at me:

• The investment to build a safe e-banking environment may result in astronomical increases in systems costs given the insecure nature of the electronic commerce infrastructure.
  
• The biggest challenge to the banking sector would be how to make home PCs secure. Hackers are increasingly preying on the home PCs, the most susceptible online link of all. Many bank customers tap in from home, often on a computer with little or no security software.

Given these two paragraphs, this looks like I'm going to be paying higher systems costs because others can't be bothered to practice responsible computing (when this initiative moves out of Korea into the rest of the world, that is...).

Re:All too brief...

[inoffensif]

To the parent, thanks for the Herald link.

There are many factors which are prompting this in SK. I am not a native but I have been residing in South Korea for 2 years.

-This place is the mecca of broadband internet access. I mean anywhere and everywhere in the country, everyone is connected at speeds that would humble first world nations. Not that SK isn't first world, economically they are, socially it's another story...
-Everyone and their mother, uncle, step-sister uses IE explorer. Most Korean sites are designed for IE and don't work with any other browser.
-The networks are dirty, before I had a physical firewall, ZoneAlarm was registering 1000+ intrusion attempts a day on my system.

Put your average mom and pop who don't know any better, in an online banking situation in this environment, and you are asking for disaster.

It will probably set a precedent for many online banking SOPs in the west.

For those idiot western media brainwashed idiots who don't know a thing about Korea, get a clue, nobody gives a damn about eating dogs or even hears about North Korea more than once a month here, just listen to your dear leader dog tell you who to attack next.

And where will the money come from?

[nharmon]

Does anyone here really think the banks are going to pay this money out from their bottom line? They'll recover it from those customers who do protect their identity through increased fees and interest.

Re:And where will the money come from?

[Jesus IS the Devil]

You are falling for the business spin on things. If fees increase so will volume of transactions, and thus their bottom line. Banks that are able to overcome this hurdle will grab a huge chunk of market share through low prices all the while keeping good security.

The fault here lies with two parties, the bank for not doing enough, and end users for not caring enough about security. I feel that end users should still be partially responsible for their actions. I mean, there are people out there that, despite repeated warnings, will keep getting themselves hacked and scammed. I think most of us know people like that. And really, the only remedy for them is to yank out their computers and never let them go online again.

It's one thing to make banks more responsible for security breaches, but it's another to force them to be completely at fault, when there are so many points of entry for a crook. From the internet router from the ISP, to the user's home line, to his computer, to his keyboard, to the telephone, etc.

Re:And where will the money come from?

[bfields]

Does anyone here really think the banks are going to pay this money out from their bottom line? They'll recover it from those customers who do protect their identity through increased fees and interest.

The whole "identity theft" terminology is screwed up; it's not your "identity" you're protecting--you're still you after someone else manages to clear out your checking account. What the "identity thief" has done is to fool the bank's authentication system into thinking their transactions were authorized by you. You do have some control over whether this happens, by your choice of password, choice of when to type it in, etc. But the decisions with the greatest affect on the security of that authentication system are completely in the bank's hands: e.g. the decision to authenticate you by asking you to enter a password into a form on a web page.

The decision to make banks responsible for losses isn't because of a preference for consumers over banks--as you point out, expenses may be passed on to customers either way--it's because the best way to make the banking system more secure is to make sure that the entities with the most power to fix the system are the ones that see the incentives to fix it.

This is the same reason we limit consumer's liability for credit card losses--it's the credit card company that's in the best position to detect and prevent fraud, and if we pass on the cost to them then we enable them to weigh the costs of fraud against the costs of improved security infrastructure, something that's impossible for an individual consumer to do.

Re:And where will the money come from?

[mumblestheclown]

The fault here lies with two parties, the bank for not doing enough, and end users for not caring enough about security.

Would it be too gratuitous to mention that at least some percntage of the fault lies with the unethical idiots actually doing the theft?

No big deal

[Red Flayer]

FTA: "Under the new legislation customers will still be required to implement safety measures and won't be compensated for losses incurred from online scams if they are careless with card details, PINS and passwords." (emphasis mine)

There's 50% of it right there.

I'm not trolling here, I have a question:

Does using Windows constitute being careless? How about using unpatched Windows? How about using Windows without malware scanners installed?

Schneier likes it

[Anonymous Coward]

This is exactly what Bruce Schneier has been advocating for a while...here's his take on this story.

Better than the Secret Service's crap here...

[chroot_james]

While I was working for Harvard Law School, the Secret Service came and spoke to the different IT communities at Harvard. What they came to tell us was that if there was any security breach, they would help us minimize the damages and then went through their plan on how to do that. The plan was essentially to not scare the public, not tell anyone, and hide as much of the damage as possible and try to recover. That basically does nothing for anyone interested in *actually* knowing how safe they are.

Kudos to to Korea having the balls to blame the people leaving the doors to security breaches WIDE open.

You have to make it hurt

[El Cubano]

This action obviously will not stem identity theft but the hope is that this will push banks into security improvements that will make identity theft much harder.

I agree. I was listening to Clark Howard a couple of weeks ago on the radio and he was talking about how 99.9% of US banks have atrocious security when it comes to online banking. I know that identity theft also happens offline, but I also think that you have to criminalize grossly negligent behavior, or else you end up with a situation like what we have today: banks see it as more fiscally reasonable to absorb the cost of the problem than to even attempt to fix it. The problem is that this has tragic consequences for the individuals that are victimized. Hopefully the US congress will jump on board and start dealing with serious problems, instead of concerning themselves with things like college sports and drug testing among athletes, which ultimately shouldn't be of importance to the federal government.

That's all well and good...

[OakDragon]

...now if the Nigerian government would just do something to get my money back from that doctor fellow!