So you think you are safe doing internet banking?

 Going, going, gone … most online banking fraud victims never see their money again.

Britain’s leading expert on cyber security refuses to bank online. We ask if you should follow suit

He is one of Britain’s foremost experts on cyber security, a man who has spent 30 years following the development of first telephone, and then online, banking. The professor of security engineering at the University of Cambridge’s computer laboratory has witnessed the mass take up of online banking, and more recently the explosion in fraudulent activity.

So when Ross Anderson says he has never banked online – and has no plans to do so primarily because the customers carry the risks of fraud – the rest of us might want to take notice.

Until recently it would have been unthinkable to suggest consumers should consider ditching online banking, so much a part of the financial world has it become. But online bank fraud is the UK’s fastest growing area of crime – doubling from £60m in 2014 to an expected total beyond £130m this year – and the losses to consumers have in some cases been of the life-changing order of £90,000 each.

Crucially, and contrary to what you will find in the banks’ marketing materials, if you fall victim to an online fraud the chances are you will never see your money again.

 

e is one of Britain’s foremost experts on cyber security, a man who has spent 30 years following the development of first telephone, and then online, banking. The professor of security engineering at the University of Cambridge’s computer laboratory has witnessed the mass take up of online banking, and more recently the explosion in fraudulent activity.

So when Ross Anderson says he has never banked online – and has no plans to do so primarily because the customers carry the risks of fraud – the rest of us might want to take notice.

Until recently it would have been unthinkable to suggest consumers should consider ditching online banking, so much a part of the financial world has it become. But online bank fraud is the UK’s fastest growing area of crime – doubling from £60m in 2014 to an expected total beyond £130m this year – and the losses to consumers have in some cases been of the life-changing order of £90,000 each.

Crucially, and contrary to what you will find in the banks’ marketing materials, if you fall victim to an online fraud the chances are you will never see your money again.

Last month RBS revealed that between January and September this year almost 5,000 customers fell victim to scams – at a cost of more than £25m. The bank says the average loss was £13,000, and warned that 70% of its customers who are scammed do not get a single penny back.

“I’ve seen far too many scams, and I’ve tracked the evolution of the banks’ bad attitude to customer complaints,” Anderson says. “Since the late 1990s the move to phone banking and then the internet has led to contract terms and conditions along the lines of ‘You agree to be liable for any transactions which, according to our records, were made using your password, whether you actually made them or not’. Basically, the banks used the move online as an opportunity to dump the fraud risk on the customer.”

Anderson says online banking in the UK contains many vulnerabilities, and he does not believe the official figures tell anything like the full story. “The government changed the rules so that fraud is reported to the banks, not to the police. This made the crime figures go down. The banks for their part have changed the rules so that most of the frauds reported to them are seen as customers attempting to defraud the bank.

“They take the view that if your password or pin was used you were either complicit or grossly negligent, so if you complain it is you who is trying to get money you’re not entitled to. So much of the fraud reported by customers doesn’t end up in the official figures.”

Another expert in this area, Richard Emery, who runs security consultancy 4Keys International, is similarly critical of the way the banks operate online.

Emery, who has appeared in these pages before and on BBC’s Watchdog, investigates alleged card fraud for the criminal courts and helps customers in battles with their banks. He would be loath to give up internet banking as he has come to rely on it, but says it needs major reform to make it fit for purpose.

“In their rush to give customers faster payment services the banks have compromised security for the sake of convenience. Faster payments allow people to move significant sums instantly, but also allow fraudsters to do the same. The banks need to bring in a 24-hour cooling-off period that would mean you couldn’t send a large sum, say over £250, to a newly set up payee for a day. How often do you need to pay large sums to someone you have never paid before without a day’s warning?” he asks.

Emery says the other crucial loophole that must be closed is the “account name”. Many people believe that if an account name is their name then a transfer is safe, but it is not. Banks do not match account names with account details, a loophole used by fraudsters to con people into shifting money into another account they believe is theirs. As Guardian Money revealed following a spate of complaints, you can put Mickey Mouse into an online transfer and the money will still be moved into the account.

“A solution would be that when you set up a new payee your bank should automatically contact the payee’s bank which would then send back the account name,” Emery says. “This would not only reduce fraud, but would eliminate the problems that occur when the payor enters the wrong payee account details.”

Advertisement

These two measures would halt the vast majority of online bank fraud. “Why the banks have not introduced them is beyond me,” Emery says.

Like Anderson, Emery says he has no faith that the FOS will come to a consumer’s aid where there is disputed fraud, as too often it simply accepts the bank’s word that the customer has been grossly negligent – even when there is no evidence to support that claim.

“Often the banks hold information that would resolve the customer’s claim but refuse to release it,” Emery says. “The FOS should compel the banks to disclose such information, and if it refuses the FOS should find against them. In fact the opposite happens and the FOS supports the bank’s decision to not disclose it. It’s a scandal that needs to be addressed,” he says.

An FOS spokesman says: “Where consumers have been tricked into handing over passwords or codes allowing the fraudster to make the transactions themselves the regulations say the obligation is on the bank to prove the consumer has been negligent – and if they’re not able to do so we can potentially help.” It admits that in 60% of cases it does not have the evidence and can’t insist the bank repays the money.

A British Bankers’ Association told Money: “Customers rightly expect high levels of security when they are banking online. Banks are continually developing their systems to ensure consumers are as secure as possible from fraudsters. The more people know about the risks of fraud and how to protect themselves, the less likely they are to become a victim.”

How the scams work

The phone rings and it’s someone pretending to be from your bank, the police or a company with which you have a relationship. You are told your credit card or bank account has been accessed by fraudsters, or that your computer has been hacked and you will lose internet access for several days.

In many cases the scammer tells you to ring off then call the bank again using the number on the back of your card. But they hold the line open, so when you dial you go straight back to them. You are asked to move your cash to a “safe” account, only for it to disappear.

TalkTalk customers were conned when rung by people quoting their own account numbers and other personal details back to them, warning them that their computer was infected by a virus. Their accounts were emptied after their computers were taken over remotely. Some victims say they didn’t give out pass codes sent their phones, and the suspicion is that their mobile accounts were also hacked to allow the fraudsters to gain access to such codes.

Banks are required to refund victims for any payments that are “unauthorised”. Victims question how a payment to themselves can be considered authorised if it goes to someone else. Others say they didn’t even make the payment – that it was done by the fraudster. But the banks’ default position is to assume the victim has acted in a grossly negligent manner, and to refuse a refund.

What constitutes an “authorised payment” is yet to be been tested in court, and the Financial Conduct Authority defers to the Financial Ombudsman.

http://www.theguardian.com/money/2015/nov/21/safe-internet-banking-cyber-security-online

 

Download File