Can Banks Shift Phishing Losses to Customers?

1sockchuck writes to mention a Netcraft article wondering who should bear the brunt of phishing costs. A group of customers with the Bank of Ireland recently had $202,000 drained from their accounts by phishers. The bank initially resisted the request to refund their money, but allowed it after a suit was threatened. From the article: "The Bank of Ireland incident is one of the first public cases of a bank seeking to force phishing victims to accept financial responsibility for their losses, but it likely won't be the last. Phishing scams continue to proliferate, as Netcraft has blocked more than 100,000 URLs already in 2006, up from 41,000 in all of 2005. Financial institutions continue to cover most customer losses from unauthorized withdrawals. But after several years of intensive customer education efforts, the details of phishing cases are coming under closer scrutiny, and the effectiveness of anti-phishing efforts taken by both the customer and the bank are likely to become an issue in a larger number of cases." So, should a bank be forced to pay back a customer who has lost money to phishers? Or is it ultimately the customer's responsibility to make educated use of technology?

Comments

Re:yes, it's the bank's problem

[Jack Pallance]

If someone forged your driver's license and went to the bank to withdraw your money in person, it's the bank's fault for giving it to them

Nice Theory, but this is the real world. In the United States, you don't actually deposit your money into a bank account, you can only give your money to the bank, and then they have the option to give it back to you if you make a withdrawal. That is why they can take $35 dollars from you when you bounce a check, or any amount if some schmuck walks in off the street with a fake drivers license with your name on it. They realize that they stand to make more money if they keep a good public image of not just keeping every depositor's money, so they usually give people "their" money if they ask for it out of "their" account.

If the banks want to keep your money because they want to, they have the law on their side and there is nothing that you can do about it. You gave them your money, after all.

So if someone fraudulently withdraws money from the account, it is not really your place to fight it because it wasn't your money to loose.

If you don't know the law, please don't make one up.

Re:I do what I can to the phishers

[ResidntGeek]

Do you like phishers, or getting their bait in your email?

I don't mind. Takes 5 seconds to delete them all.

Do you think it's OK for them to scam people, just because you don't know the victims in advance?

I wouldn't say it's OK for them to scam people, but why the hell do I care about stupid people getting what's coming to them?