Can your bank hold you responsible for fraud?

Posted in 'Banking' by Barry Stamp

28 November 2011

Fears still remain that a small amendment to the Banking Code, made as long ago as the end of March 2008, enables banks to hold consumers responsible for online losses to fraud if they are deemed not to have a satisfactory level of anti-virus protection in place.

Despite banks introducing ever-more effective measures to combat online fraud, criminals still find ever-new ways to defraud innocent account holders. These include the use of phishing emails, spyware and Trojans that can see accounts emptied in the blink of an eye.

An earlier update to the Banking Code in 2005 (Section 12.9, which also covers the security of your PIN) advised consumers to “use up-to-date antivirus and spyware software and a personal firewall”, whilst many banks now go as far as to offer specific versions of anti-virus software to their customers, and to offer free security packages as part of their online banking services.

The potential minefield within the Banking Code centres around Section 12.13, which states “Unless you have acted fraudulently or without reasonable care (for example, by not following the advice in section 12.9), you will not be liable for losses caused by someone else which take place through your online banking service".

There are a couple of problems with this revision unfortunately. First off, the legal definitions used in the clause are very difficult to define – there is no definition of what constitutes the level of protection Section 12.9 covers, and whilst anti-virus software is updated constantly, it is generally reactive to known threats, and so is always vulnerable to new attacks.

Although this clause in the Banking Code may be seen by some as an attempt by banks to pass some of the cost of online fraud onto consumers, the chances of them actually being able to do so are very low.

This is further backed up by the fact that there is no law that says that you have to be accountable for the fraudulent actions of others. The banks have no authority to charge your account without your authority, and this is based on a safety net of old legislations including the Cheques Act 1957 and the Bills of Exchange Act 1882.

One thing is for certain though. For as long as banks continue to suffer huge losses to online fraud, they’ll be looking for every opportunity to stem their losses. Urging customers to take every reasonable care is, in our opinion, perfectly acceptable. But allowing any inference to linger that this may hinge on whether an anti-virus programme is adequate or kept up-to-date is a step too far.

You can see whether your overall lifestyle puts you at an increased risk of falling victim to identity theft by using our Free Identity Theft Check Service. You’ll be able to see where you might be vulnerable, and what steps you can take to cover yourself. It’s completely free, impartial and quick – just click here.