UK Banking Law Blames Customers For Insecure OS 430
twitter writes "If you use an insecure OS in the UK and someone drains your bank account, the banks say it's your fault. The Register reports: 'The Banking Code produced by the British Bankers' Association (BBA), and followed by most banks, makes it clear that banks will not be responsible for losses on online bank accounts if consumers do not have up to date anti-virus, anti-spyware, and firewall software installed on their machines.'" twitter went on to note that the majority of consumer PCs use an operating system with a history of security issues. Should end users be ultimately responsible for the state of their systems?
Banks hate responsibility (Score:5, Interesting)
If there is a lawyer in the house can they confirm this?
Not sure what the state of the laws are elsewhere, but knowing what a bunch of whining snivelers the banking industry is it's probably the same. The bank is always right and the depositors and the taxpayer pick up the bill.
ummm ... it's not the consumers property (Score:5, Interesting)
The Microsoft Windows OS is not the property of the consumer using it. It is the property of Microsoft used under a license from Microsoft. If the usage of the OS complies with the license then surely any inadvertent behavior on the part of the OS is the responsibility of the owner (Microsoft) and not the license holder (the end user).
]{
My two cents (Score:4, Interesting)
2. Bank customers do have some responsibility in security. Analogy: A homeowner has no locks, leaves door unlocked all day long, then tries getting his or her insurance company to pay out when he or she is ripped off.
3. AV, anti-spyware, and firewall. All three must be done? I think most people are familiar with the AV and firewalls, but how many know about anti-spyware software? (I believe Lavasoft's AdAware is one program.) What they should do is say that the person must make a reasonable attempt at securing their computer. (This could include having a separate computer used solely for banking, and nothing else.)
4. A thought just crossed my mind. Will they deny a claim if someone just happens to have an unsecured computer, even if the computer never was used for banking?
Re:Scare tactics (Score:5, Interesting)
In any case, do you really want the bank to be responsible for the security of your system? Because, honestly, I REALLY DO NOT want the banks 'staff of professionals' ensuring my security by requiring I install some type of custom 'security' software.
]{
A finance company gave me antivirus software. (Score:1, Interesting)
I know that several ISPs do the same thing for their customers.
This seems to be a *far better* preemptive solution to the problem - trying to make sure the customer never gets infected in the first place.
Re:Scare tactics (Score:3, Interesting)
How ironic. I just switched from Barclays because they implemented this scheme. Note that Barclays give you everything you need for free.
You need a user id, password, your card and the PINSentry device to access the site. That's sort of OK when you're at home. It's not great when you leave your card in the reader and don't realize until the next day when you're in the shop. It's not great when you travel and you have a few different accounts setup. Although Mr G [mrg9999.com] overcame that he wouldn't have his card to make payments with!
It's spectacularly bad when you have a Python script screen-scraping their site twice a day and you're running the transactions through your local "suspicious transactions" algorithm. I record the bulk of my future transactions, so it's easy for me to spot erroneous ones - heck, I even have a secure RSS feed for the transactions from my five accounts. There's no way to give my bank this payment information (yet) so their heuristics are running without the data that would really help them. I had a heart-to-heart with my Premier Account Manager at Barclays about this and his hands were tied - they just aren't advanced at all. If they want to keep the data in their closed world then they need to give me the tools in that world to manage my money (and yes, OpenPlan [barclays.co.uk] is a step in that direction - great if you only use Barclays I guess).
Re:Scare tactics (Score:3, Interesting)
Of course, that's been tempered with the anti-money-laundering laws requiring identification for cash transactions exceeding $10 000. But still, if you owe $10, then the debtor must accept a $10 bill as payment in full.
Re:Scare tactics (Score:5, Interesting)
Interestingly, according to wikipedia [wikipedia.org], the "legal tender" phrase was added because the government couldn't pay its debts with gold or silver, and nobody wanted paper money instead. The phrase was added to compel them to accept the paper money.
Re:Scare tactics (Score:5, Interesting)
Re:Scare tactics (Score:2, Interesting)
It is just the same as if you magic markered your PIN onto the back of your ATM card and someone stole it and drained your account. I GUARANTEE you the bank will wash its hands of your loss. And rightly so.
There is another factor involved. If the bank has to eat the losses, then the bank will pass them on to ALL the customers. So now you're not charging 'the bank' for the loss, your charging ALL THE PEOPLE THAT DIDN'T let themselves get ripped off!
So the question becomes "Why the hell should I pay for YOUR negligence/incompetence?' Let the idiot that let someone steal his private data off his machine pay for his own mistakes!
Of course, it makes sense for both parties to deploy a technology that is as secure as possible. The bank which doesn't should be loosing business (no matter who pays for the fraud). Still, I see NO reason why the financial institution should be liable unless the loss occured because of their act of negligence. Which exactly dovetails with liability law pretty much the world over.
Re:Humourous call (Score:3, Interesting)
Yes I did try to use Barclays on-line banking using Firefox on OpenBSD on Sparc64 hardware, and No it doesnt work.
In fact Opera on FreeBSD doesnt either, and Opera on WinXP is barely useable.
In short, Barclays have clearly never tested with anything other than IE on XP.
But they have issued me with a PINSentry device which looks like a fisher-price toy, but is allegedly secure.
Re:Same thing in New Zealand, but... (Score:3, Interesting)
Re:Scare tactics (Score:3, Interesting)
Well, now; it seems this situation is ripe for a nice setup. Get an account at a bank such as the Egg mentioned in other messages here, which strongly encourages use of IE and includes Active-X code in its pages. Arrange for your account data to be stolen by malware from a site that uses Active X as an infection vector. When the bank's investigators find the malware on your machine and disclaims responsibility, file suit against the bank, claiming fraud and entrapment (or whatever those are called in UK law). Show in court that they strongly encourage use of IE and Active X, which are well known to be major security risks.
I'd think some UK solicitors with a bit of tech knowledge might have a bit of fun taking on such a case.
Of course, you'd want to do this with a new account, and don't put a whole lot of your money into it.
It's only a matter of time before such a case happens. It might be best if it happens to people with the technical knowledge to show in court what's really going on. Maybe you can force the banks to not require customer use of the least secure software available.
Re:Scare tactics (Score:3, Interesting)
You slot in your smart card, enter your pin into the device, followed by the challenge code, and it returns the response code which you must transcribe into the site. It is something that works on the internet but it probably would not work well for commercial transactions because most users would consider it too cumbersome.
In any case there is a pretty straightforward way to bypass this security. You spoof the bank site and, in real time, interact with the real site sending the user the real challenge code so they provide the real response code and then, once your in, you transfer the funds from the users account to some other account (which you presumable set up under an assumed name). If you are a reasonable competent crook this actual transfer process is automated and once you've completed the transfer you change the users pin code so they cannot see the transaction for the X days it takes them to order a new pin code from the bank.
]{
Re:Scare tactics (Score:3, Interesting)
My bank has an authentication method which is OS and browser independent too.
When I, or anyone else, attempts a transfer which exceeds my set limit, the bank sends me a text message (SMS) with a one-time PIN. I then have three minutes to input the PIN to approve the transfer.
If the PIN isn't correct, or if it's not typed in within the time limit, I get another SMS telling me of the attempt.