He is one of Britain’s foremost experts on cyber security, a man who has spent 30 years following the development of first telephone, and then online, banking. The professor of security engineering at the University of Cambridge’s computer laboratory has witnessed the mass take up of online banking, and more recently the explosion in fraudulent activity.
So when Ross Anderson says he has never banked online – and has no plans to do so primarily because the customers carry the risks of fraud – the rest of us might want to take notice.
RELATED: Prevent Credit Card Fraud this Holiday Season
Until recently it would have been unthinkable to suggest consumers should consider ditching online banking, so much a part of the financial world has it become. But online bank fraud is the UK’s fastest growing area of crime – doubling from £60m in 2014 to an expected total beyond £130m this year – and the losses to consumers have in some cases been of the life-changing order of £90,000 each.
Crucially, and contrary to what you will find in the banks’ marketing materials, if you fall victim to an online fraud the chances are you will never see your money again.
According to Anderson and other security experts, one of the banks’ most extraordinary feats of recent years has been their ability to shift liability away from themselves and on to the customer – aided by a Financial Ombudsman Service (FOS) that they claim rarely challenges the banks following a fraud.
On top of antiquated banking and phone systems, the introduction of faster payments has greatly aided the fraudsters ability to scam people, most of who would not have lost out if they didn’t bank online (see box below).
Basically, the banks used the move online as an opportunity to dump the fraud risk on the customer
Ros Anderson
Last month RBS revealed that between January and September this year almost 5,000 customers fell victim to scams – at a cost of more than £25m. The bank says the average loss was £13,000, and warned that 70% of its customers who are scammed do not get a single penny back.
“I’ve seen far too many scams, and I’ve tracked the evolution of the banks’ bad attitude to customer complaints,” Anderson says. “Since the late 1990s the move to phone banking and then the internet has led to contract terms and conditions along the lines of ‘You agree to be liable for any transactions which, according to our records, were made using your password, whether you actually made them or not’. Basically, the banks used the move online as an opportunity to dump the fraud risk on the customer.”
Anderson says online banking in the UK contains many vulnerabilities, and he does not believe the official figures tell anything like the full story. “The government changed the rules so that fraud is reported to the banks, not to the police. This made the crime figures go down. The banks for their part have changed the rules so that most of the frauds reported to them are seen as customers attempting to defraud the bank.
RELATED: National Identity Theft Prevention and Awareness Month
“They take the view that if your password or pin was used you were either complicit or grossly negligent, so if you complain it is you who is trying to get money you’re not entitled to. So much of the fraud reported by customers doesn’t end up in the official figures.”
Another expert in this area, Richard Emery, who runs security consultancy 4Keys International, is similarly critical of the way the banks operate online.
Emery, who has appeared in these pages before and on BBC’s Watchdog, investigates alleged card fraud for the criminal courts and helps customers in battles with their banks. He would be loath to give up internet banking as he has come to rely on it, but says it needs major reform to make it fit for purpose.
“In their rush to give customers faster payment services the banks have compromised security for the sake of convenience. Faster payments allow people to move significant sums instantly, but also allow fraudsters to do the same. The banks need to bring in a 24-hour cooling-off period that would mean you couldn’t send a large sum, say over £250, to a newly set up payee for a day. How often do you need to pay large sums to someone you have never paid before without a day’s warning?” he asks.
Often the banks hold information that would resolve the customer’s claim but refuse to release it
Richard Emery
Emery says the other crucial loophole that must be closed is the “account name”. Many people believe that if an account name is their name then a transfer is safe, but it is not. Banks do not match account names with account details, a loophole used by fraudsters to con people into shifting money into another account they believe is theirs. As Guardian Money revealed following a spate of complaints, you can put Mickey Mouse into an online transfer and the money will still be moved into the account.
“A solution would be that when you set up a new payee your bank should automatically contact the payee’s bank which would then send back the account name,” Emery says. “This would not only reduce fraud, but would eliminate the problems that occur when the payor enters the wrong payee account details.”
These two measures would halt the vast majority of online bank fraud. “Why the banks have not introduced them is beyond me,” Emery says.
Like Anderson, Emery says he has no faith that the FOS will come to a consumer’s aid where there is disputed fraud, as too often it simply accepts the bank’s word that the customer has been grossly negligent – even when there is no evidence to support that claim.
“Often the banks hold information that would resolve the customer’s claim but refuse to release it,” Emery says. “The FOS should compel the banks to disclose such information, and if it refuses the FOS should find against them. In fact the opposite happens and the FOS supports the bank’s decision to not disclose it. It’s a scandal that needs to be addressed,” he says.
An FOS spokesman says: “Where consumers have been tricked into handing over passwords or codes allowing the fraudster to make the transactions themselves the regulations say the obligation is on the bank to prove the consumer has been negligent – and if they’re not able to do so we can potentially help.” It admits that in 60% of cases it does not have the evidence and can’t insist the bank repays the money.
RELATED: Online Scam Asks Shoppers to Buy Gift Card
A British Bankers’ Association told Money: “Customers rightly expect high levels of security when they are banking online. Banks are continually developing their systems to ensure consumers are as secure as possible from fraudsters. The more people know about the risks of fraud and how to protect themselves, the less likely they are to become a victim.”
How the scams work:
The phone rings and it’s someone pretending to be from your bank, the police or a company with which you have a relationship. You are told your credit card or bank account has been accessed by fraudsters, or that your computer has been hacked and you will lose internet access for several days.
In many cases the scammer tells you to ring off then call the bank again using the number on the back of your card. But they hold the line open, so when you dial you go straight back to them. You are asked to move your cash to a “safe” account, only for it to disappear.
TalkTalk customers were conned when rung by people quoting their own account numbers and other personal details back to them, warning them that their computer was infected by a virus. Their accounts were emptied after their computers were taken over remotely. Some victims say they didn’t give out pass codes sent their phones, and the suspicion is that their mobile accounts were also hacked to allow the fraudsters to gain access to such codes.
Banks are required to refund victims for any payments that are “unauthorised”. Victims question how a payment to themselves can be considered authorised if it goes to someone else. Others say they didn’t even make the payment – that it was done by the fraudster. But the banks’ default position is to assume the victim has acted in a grossly negligent manner, and to refuse a refund.
What constitutes an “authorised payment” is yet to be been tested in court, and the Financial Conduct Authority defers to the Financial Ombudsman.
Are you a victim of fraud or money scam? Share your story with us on the Money Credit and You Facebook page!
Article & photo source: The Guardian
