Slashdot Mirror
Can Banks Shift Phishing Losses to Customers?
1sockchuck writes to mention a Netcraft article wondering who should bear the brunt of phishing costs. A group of customers with the Bank of Ireland recently had $202,000 drained from their accounts by phishers. The bank initially resisted the request to refund their money, but allowed it after a suit was threatened. From the article: "The Bank of Ireland incident is one of the first public cases of a bank seeking to force phishing victims to accept financial responsibility for their losses, but it likely won't be the last. Phishing scams continue to proliferate, as Netcraft has blocked more than 100,000 URLs already in 2006, up from 41,000 in all of 2005. Financial institutions continue to cover most customer losses from unauthorized withdrawals. But after several years of intensive customer education efforts, the details of phishing cases are coming under closer scrutiny, and the effectiveness of anti-phishing efforts taken by both the customer and the bank are likely to become an issue in a larger number of cases." So, should a bank be forced to pay back a customer who has lost money to phishers? Or is it ultimately the customer's responsibility to make educated use of technology?
My mom actually got an email supposedly from PayPal that she was worried about. I've warned her many times in the past, but you never know if people are really listening or not. She called up PayPal (with the number off the website itself), talked to them, and had it confirmed that it wasn't a legit email. I was pretty impressed that a 54 year old woman who doesn't know hardly anything about computers, was able to do all of this on her own. If someone with very little computer experince can use common sense when it comes to personal information and avoid being ripped off, why can't everyone. It falls on the customers to police themselves. If I fell victim to one of these scams, I wouldn't look for the bank to pay me back. It wasn't their fault, it was my fault.