How banks are refusing to shoulder responsibility for fraud
telegraph.co.uk
telegraph.co.uk
From a risk management perspective it's never a good idea to separate liability from control. If the banks don't provide adequate security controls to their customers why should their customers be liable?
Even though the controls that a customer has are less than what Gmail provides the banks continue to push the the illusion that the customer is actually in control. Even the vocabulary they use implies the customer was always in control.
For example you were a victim of identity theft. How crazy is that? How can somebody steal my identity? Oh, I woke up this morning and I wasn't me!!!
Nope.. Checked my identity and I'm still me. Why did you allow somebody to steal all my money?
Barclays UK does device identification. Barclays is actually very sophisticated technologically speaking. Source: I reverse engineered their app to implement my own API client.
This could be one of the reasons why Google is seen as biggest threat by retails banks. If Google starts providing retail banking service, I would prefer them to sluggish retails banks which sees technology as a cost center and most are embarrassingly lagging in technical advancements.
I wonder why they aren't doing it.
Banking requires customer service and is highly regulated - both things that Google dislikes.
Fidelity is a large US brokerage with $2T under management. Only last year did they start to offer two factor authentication as an option (had to ask). I have accounts with one US regional bank and one US credit union which use basic device recognition and a security question when logging in from an unknown device.
Other anecdotes..
My account at Fidelity is a joint account. After setting up online access and funding the account I discovered a year later that it was possible to get full access to the account by creating online access under my wife's name using the account number and a semi-trivial validation process.
Accounts in the US typically have all features enabled by default or can be enabled in a trivial manner and this can't be disabled. Why should a typical account have the ability to wire funds internationally?
It typically isn't possible to configure a second level of authentication for higher risk transactions.
Limited ability to configure alerts based on unusual behavior. For example access from a new device or a transfer over a threshold. No ability to alert when those alerts are changed.
Opaque account recovery processes. Even if additional security measures are implemented it may be possible to have them disabled trivially by phone.
Almost zero customer education around risks and ways to reduce risk. stupid things like "Don't use your bank's password on other sites, it should be unique!"
I have family oversees, I have friends oversees, I have bank accounts in three countries.
In the US at least a typical customer will never initiate an international wire transfer. Even those with friends and family overseas will typically transfer funds through a money transfer service or via ATM networks to avoid the associated high fees.
When a US customer walks into a bank asking to initiate a wire transfer its usually a red flag they are a victim of fraud.
It definitely couldn't happen with my former main bank - they will not allow any kind of ID aside from in-person photo ID or 2FA, to the point where my parents are actually locked out of their account since the battery ran out in their 2FA device, they never set up a mobile app 2FA, and they live abroad so they can't go into an office. The bank actually told them "tough luck, you're going to have to fly across half the planet to get the 2FA device replaced". My parents are obviously upset, but I thought it was pretty impressive.
Unless these bank people know you personally, it's just a way to make certain frauds a little harder while making other, very common frauds much easier.
Is this also coming from a US perspective, where photo ID is basically useless and everyone relies on a "secret" number (SSN) that was specifically not meant to be used for identification?
All the ideologic resistance against a properly designed and handled ID number means that a number that was never meant to be used for ID is used instead. Madness.
SSN is a component, but they are no longer accepting it blindly for transactions with higher assigned risk. It needs to be correlated against other data to authenticate.
For higher assurance transactions (TSA pre-check, access to criminal data, privileged account access, etc), biometrics and photos are used establish who you are. You don't need that for common banking transactions.
Where you see it used blindly, its generally scenarios where fraud is low risk and low impact activity.
Your account number is a "secret" shared among potentially hundreds of merchants and all it takes is one of them to leak it.
Online banking webapps are mostly a read-only view of your transaction history. Sometimes they are capable of pushing money out, but for a new payee this generally requires phone verification, and in all cases it sends a lot of emails and takes a few days.
But even just by virtue of having a password (which you have not shared with every store you've ever visited) it's already much harder to attack online banking than it is to make fraudulent credit card or ACH transactions.
Since email is used as the focal point of trust in most online transactions, it should be the most secure.
I have all of those things with a standard checking account from Chase. I do wish that I could use Google Authenticator/TOTP for 2FA rather than texts/emails, though.
What am I missing?
More importantly, the customer referenced in the article basically wired all the funds in her account to a scammer then asked the bank for it back. Sorry, but that is the customer's fault, not the bank's fault.
One example given is if you admit you had written your banking pin down somewhere, the bank can say "well there you go, it's your fault" and stop helping you there.
Another is that some bank fraud departments have worse hours than banks themselves. In a fun little phrase "Friday afternoon fraud" you'll find the explanation that much bank transfer fraud happens on Friday afternoons after fraud departments have gone home for the weekend, giving criminals ample time to retrieve ill-gotten gains before the fraud department comes in Monday morning.
Not a great article, but it ends by calling on banks to be more responsible - so, it's also funny.
That's not even considering that passwords suck anyway.
a four digit PIN is pretty secure when you have centralized authentication (the one bank) and get very very few tries before account lock-out, which is how Debit cards work.
If you had 3000 stolen debit cards, you'd have a shot at guessing a few of them while locking out 2990+ other ones, and I'm kinda thinking the bank might notice you doing that.
have you heard that thieves are guessing PINs someplace in the world? I haven't, and the world is full of dedicated thieves.
and even then, do you know how long that would take versus what you get when you guess one? $500? you might actually make more money panhandling or flipping burgers; of course you've got to trade that off against free meals and healthcare in prison :)
Not so much guessing, but there have been several cases, at least one very well publicised, where thieves have gamed the PIN generator sequences[1].
What often happens, of course, in cases where wide systemic problems exist in banking is it's very effectively hushed. For rather obvious reasons.
[1] http://www.theregister.co.uk/2005/10/21/phantoms_and_rogues/...
Today, pretty sure that a solicitor in the same situation would be required by law to report the information to the Serious Organized Crime Agency.
Now, it may be encrypted (not during renewal) or hashed (10000 values, <1s verification) but neither gives any security. (It's safer however than sending a new PIN with the card or in another letter)
The security is based on how hardened the server storing those PINs is.
This however needs a way to send your initial PIN over an insecure channel. To limit the attack surface go to the secure website to receive your PIN (no humans) (either an old card/digital state ID) or go in person and force a new PIN.
> Of course the bank has your PIN (or hashed PIN)
All the previous poster said was that the bank said they sent him a card with the same PIN. The bank can do this by storing PINs or hashed PINs.
As rrobukef noted, storing a PIN hashed offers little additional security as storing them unhashed because of the small number of unique PINS that are possible.
Essentially it's insurance. If someone else crashes into me, and it's their fault, their insurance pays. That's why they're insured.
Secondly, if banks have to cover the mistakes of their other customers, they will need to make that money back somehow, by higher fees for customers like you.
(That's not to say that 50% is the right split, but 0% seems too low.)
She may well have had an automated call to confirm, I get them from my British bank whenever I transfer money to someone new.
Transfers are instant up to £20000, or something like that. This is very useful.
That's a shame, because giving people warnings about common scams when they're transferring large sums of money might reduce the amount of successful scamming.
And this is the whole point of anti-money laundering and fraud detection controls within banks.
There's not enough information in the story to tell if the customer turned controls off, if a transfer of this type was unusual, if the customer confirmed an alert, etc.
Reporting in the story is horrendous, almost to the point it appears it is intentionally exploiting the victim and misinforming the public.
Bear in mind the bank had no reason to expect there was anything wrong with this transaction.
Do you really pay that much in bank fees to warrant covering you making a mistake like that?
There are special accounts that come with travel insurance, a personal advisor etc, which charge a fee.
- Traditional banks are jacking up fees - For people who already don't need it (good credit, savings) those fees can be waived - Credit unions can reject you for credit scores (obvs)
Where do the online banks fall on that spectrum? If you need good credit or stable cash you can't spend, it leaves a whole lot of people out in the cold. Never mind that a lot of the same class of people can't always reliably use the tubes to do their transactions (phone primary Internet device, often shut off, often changing numbers).
The UK ATM phantom withdrawals fiasco rather demonstrated that in the 80s.
It took 15-20 years in court before banks stopped always blaming the customer and stopped claiming their systems (computer and otherwise) were infallible. A position they've generally returned to, despite holes in chip and pin and internet systems.
Are you implying that being a victim of fraud automatically results in the damages being covered by someone other than the victim? If so, you're wrong; yes, some types of transaction do, but not this type of transaction.
In the end, here, she made the transfer - after the fraudsters were able to do multiple things that emulated the behavior of the bank - sending activation codes to her that were genuine, because they were able to get that from the bank.
Using that logic, why would the scammer even need to call the victim?
>> "after the fraudsters were able to do multiple things that emulated the behavior of the bank - sending activation codes to her that were genuine, because they were able to get that from the bank."
According to the victim, who's story does not add up and appears to have been coached by the expert hired by the paper.
Feel free to look into it, but I'm not about to go auditing bank security measures without written permission.
This appears to be a completely baseless accusation.
This is not how an investigation is done, regardless of if you're law enforcement or not.
Further, none of the statements from the victim support the speculation provide by the expert, nor does the experts speculative commentary appear to be based on investigation in how the bank process works, what information the bank provided, what information the bank has on record to recover an account, how the account was deactivated without information from the customer, etc. -----
More importantly, this conflicting statement from the expert:
>> Mr Freedman added, “With these frauds, there always comes a point when the victim 'buys’ the story. From that point, evidence to the contrary is ignored or explained away. [...] In cases such as this, it is not the bank’s system that has been hacked, it is the victim.”
One of the reasons I have a contract with a bank, and that I pay the overhead of having the money sit in a savings account instead of growing at market rate, is that they will protect my money from fraud. If the bank is looking into finding ways not to protect me, I'll look into ways not to keep my money with the bank but instead invest it at market rate. That's all.
For my ordinary checking account, I opt for convenience. I don't want transactions randomly declined and I don't want to have to wait for banking hours to authorise activity. To compensate, I limit the amount I keep in the account.
For certain other accounts, I opt for more security. Cheques are blocked; foreign transactions are, by default, blocked; online banking must be two-factor authenticated every time; transfers must be authorised with a phone call below certain amounts and in person at a branch, with ID and a passphrase verified, above certain amounts; et cetera. These are flags one can have enabled on most bank accounts. They're just debilitatingly irritating for ordinary use.
If you make banks responsible for user-authorised fraud, e.g. a customer wiring money to a scammer, you're also asking them to nanny you. Freedom and protection from your own stupidity exist on a spectrum.
The only way this transaction could have been prevented is if the bank told the customer "you want to do X with your money but we aren't going to let you because we find it ill-advised". Not everybody wants that level of oversight and restriction.
You see blocking fraud as a bank's main job. There are times, however, when one can reasonably find facilitating transactions to be their main role. When I'm travelling, a constantly-declining debit card is more of a nuisance than the risk of having a thousand dollars pilfered from my checking account.
There's no way to do both risk management and transactional freedom perfectly, since the former means restricting the latter, even to the point of telling a customer what they can and cannot do with their money.
> a [bank's]...primary responsibility...is safeguarding money
As with everything, there are trade-offs. Absurdly put, a bank which refused to allow anyone to withdraw or transact could score splendidly in terms of "safeguarding money". They'd also be useless, because that's not a bank's only job.
Once had someone ask me how to send their bank account information to someone. I asked why, and they proceed to show me an email from a scammer. I told them it was a scam, and their response was that I was trying to keep them from making money.
First thought was okay, I'll prove it's a scammer; scammer and the person had already exchanged a number of emails, which I exploited to get more information from the scammer.
Using bit of social engineering and data leaked from the scammer, I was able to discover the scammer's exact location.
When I confronted the scammer, they demanded to know how I knew where they were, then stopped responding.
The person that originally asked me how to send bank account info - having watched everything I had done with an explanation added - blamed me for chasing away a valid opportunity.
Week later, scammer contacted them again, and they sent cash requested by the scammer via mail.
Should the bank have asked them what they intented to do with cash withdrawal? Should the bank make sure they're not lying? Is the bank responsible?
If yes, I disagree.
(Scammer was on a street in Lagos, Nigeria.)
This is in contrast to the client reporting "identity theft" or "fraud" when they see an unauthorized charge, which makes it an at-fault issue for fraud & liability.
I thought it seemed believable, but can anyone confirm whether this represents actual internal banking policy?
Key to avoiding fraud is good security and financial controls by ALL parties involved based on valid threat models and risk analysis.
A client doesn't know an unexpected transaction not to be a clerical error any more than they know it to be identity theft. So it's not exactly nefarious not to immediately and unnecessarily claim culpability by using incorrect terminology.
The prevalence of advertisement by banks for fraud protection and identity theft services creates a situation where people are likely to assume unexpected (or unrecognized) transactions are always the concern of the division of the bank that handles "identity theft", and that the correct way to have it investigated is to call those transactions "identity theft", whether or not they are.
From how it was explained to me, using "clerical error" passes the request through an additional filter where the bank attempts to determine whether it was at fault before redirecting the request. It's the difference between starting out by saying "I made a mistake" and "a mistake was made", which could be important later.
I hope you understand that I wasn't condoning fraud, but that people shouldn't be quick to implicitly admit liability for what may not be their own mistakes.