German Court Rules That Clients Responsible For Phishing Losses 245
benfrog writes "A German court has ruled that clients, not banks, are responsible for losses in phishing scams. The German Federal Court of Justice (the country's highest civil court) ruled in the case of a German retiree who lost €5,000 ($6,608) in a bank transfer fraudulently sent to Greece. According to The Local, a German news site, the man entered 10 transaction codes into a site designed to look like his bank's web site and his bank is not liable as it specifically warned against such phishing attacks."
Online banking uses outdated crypto (Score:5, Informative)
Re: (Score:2)
My bank uses a token that require me to insert my debit card into the token, enter my PIN and type in resulting code to log in. For transferring money I need to insert my card, enter PIN, enter code from the screen into token and then type in code from token.
Never heard of a proper bank requiring just a password.
Re:Online banking uses outdated crypto (Score:4, Interesting)
I have a US bank account which is very much like the grandparent described. I also managed to get them to give me the login credentials over the phone knowing only my name, address, and date of birth. Security there is appalling and in any other vaguely civilised country would mean that they would be liable for pretty much anything bad that happened to my account.
In contrast, my UK bank has an authentication scheme much as you describe. Any time I pay a new person (or a large amount), I need to separately authenticate that transaction, including typing the amount into the external device that generates a single-use token from the chip on my card. The debit card from my US bank doesn't even have a chip...
Re: (Score:2)
Couldn't such a site could alter transaction data (changing amount, destination account for payments/transfers, etc), and pass that along with proxied credentials? Or simply create new transac
Re: (Score:2)
Re: (Score:2)
My bank uses a token that require me to insert my debit card into the token, enter my PIN and type in resulting code to log in. For transferring money I need to insert my card, enter PIN, enter code from the screen into token and then type in code from token.
Never heard of a proper bank requiring just a password.
(this is probably a CAP (chip authentication program) 2FA [wikipedia.org] solution) - I was a designer of a CAP 2FA solution for a large uk bank that was commissioned about 4 years ago. The customer uses an EMV card (a debit card in this case) to create a one time code that can be entered into the online system whilst performing a transaction. The CAP standard actually had three operations identify, respond and sign and any CAP reader can be used with any EMV card. (not a lot of people realise this)
identify just respon
Re: (Score:2)
"TWO" factor?
Although the website to my bank is now more secure (it actually allows me to use password, rather than just using the old 4-digit PIN), the account still has a routing+account number that requires no cryptographic token (or even a one-time-use-with-a-limit number) to allow anyone full access to do anything with the account..
Also, it prints this routing number on the paper, "personal checks" that it issues to every checking customer.
I would love to have a bank that uses two factor authentication
Re: (Score:2)
I wouldn't know about HSBC like the sibling AC said, but Citizens seems to have relatively intelligent security practices.
Thing is, even big banks often aren't available in certain parts of the country.
Re: (Score:2)
Whats even worse is some banks have such outdated system they limit the security you can have.
One of my bank sites has a MAX of 6 characters, and no special non-alphanumeric characters.
Re: (Score:2)
Theses sort of cases are really hurting the customer, banks have no reason to invest in a serious authentication scheme for online banking. It's a joke, my bank uses a password and some random question about me. At the very least they need to offer a true two factor solution, preferably token or certificate based.
Well, it hurts the bank's customer, because the bank's customer was the one who entered ten transaction codes into a fraudulent website himself. With a token based solution, you will come back screaming when a scammer convinces a customer to hand over their token.
Re: (Score:3)
Shouldn't your first thought be to change bank then? And inform them WHY you've changed bank?
Security tokens are a pain in the bum but there are banks that offer them in just about any country you want to pick.
And, how, precisely would it have stopped this attack? He typed security information (which would also include his one-time tokens) into a website that was fraudulent. There's nothing stopping them recording those tokens and typing them into the REAL account just the same and nobody would know unti
Very true (Score:5, Interesting)
Re: (Score:2)
Thank you. The entire paper is actually a very good read.
Re: (Score:2)
In the world of ultimate surveillance, like one we are becoming (and fast) - some kind of rollback mechanism is (at least to me) most logical thing to do.
Money can be followed, to the moment when a person gets it from ATM or bank clerk. Also, it can be found later - serial numbers are there to be used and I do not doubt they are.
On the other hand, bank can make better authentication (as GeneralTurgidson implies) but also some mechanism for keeping a customer in loop. Some banks report transactions through S
Re: (Score:2)
ome banks report transactions through SMS, for example. Mechanism where transaction is delayed for some time, during which customer can take action. If I don't get SMS confirmation in 3 hours, for example - call bank hotline to stop everything.
And many other things, other than - let customer pay.
So does the bank pay for a mobile phone plan for the customer? No? Then how is it not "let the customer pay"?
I know, you probably meant let the customer pay when being swindled. Which I think is very reasonable. If there's gross negligence on the side of the bank, they should pay for that, and if there's gross negligence on the side of the customer, they should pay for that. And if both, let the customer lose his money and fine the bank.
(And, if a customer engages in what he thinks is an illegal activi
Re: (Score:2)
So does the bank pay for a mobile phone plan for the customer? No? Then how is it not "let the customer pay"?
The bank pays for sending the sms. So unless you have internet but no cell phone, there's no additional cost for security on the customer side.
Re: (Score:2)
Not over here. Sounds like a US problem to me.
Re: (Score:2)
Your bank being a joke does not make it the norm. Certainly every bank I dealt with uses some form of two factor authentication often combined with multiple identifiers. My previous bank went like this:
Login: User / Password
External Transaction: SMS an ID number to the elected phone number which is not visible nor can it be changed online.
External transaction over $1000 or to a new account: SMS + two identification questions chosen from a pool of ~10.
My current bank uses a RSA token:
Login: User / Password
Re: (Score:2)
Re: (Score:3)
Not to mention that if the issuer of the token is hacked, the token becomes a liability.
Re: (Score:2)
Re: (Score:2)
Eh.. just make your password longer.
Use this formula:
n=m*ln(s_m)/ln(s_n)
where m is the length of your old password, s_m is the size you thought the character space was and s_n is the size the character space really is. Use conservative values for s_n if you're not certain about other characters.
Depending on the length of your original password, you'll probably be surprised that you only need to add a couple characters to beat the original password's security, and the new password may well be easier to reme
Re: (Score:2)
Yea, one of my bank sites has a MAX of 6 characters, and no special non-alphanumeric characters.
I closed my account there.
Re: (Score:3)
Theses sort of cases are really hurting the customer, banks have no reason to invest in a serious authentication scheme for online banking. It's a joke, my bank uses a password and some random question about me. At the very least they need to offer a true two factor solution, preferably token or certificate based.
I know it's customary not to read the article, but seriously, please read the article before making these kinds of assumptions. This bank actually had good 2-factor token-based security. German banks usually do. The judge made the right call in this case.
And yes, I do realize that there are lousy banks out there. I know at least one major bank in the US that has super shitty security (even worse than your bank). Thankfully, not all US banks are that bad, it's a mixed-bag really. Sometimes, the blame can be
Re: (Score:2)
This TAN code is probably a set of codes on a card that the customer is instructed to input based on [ column, row ], when they want to do something on line. I have something similar here in France. Seems this customer was fooled into putting more than one of them, along with username & password most likely, into the fake web page and the bad guys then were able to use one of them to make the transfer.
I have a business account in Hong Kong that they've provided me a one time token similar to Secure ID
Re: (Score:2)
Tricky (Score:4, Insightful)
I do kind of agree with this; beyond a certain point of security measures, information campaigns and automated fraud-protection mechanisms it starts getting unreasonable to expect the banks to take financial responsibility for their customers' stupidity.
Now I agree that the bar should be set very high, but at some point you have to accept that there are very stupid people out there who will do everything in their power to circumvent the things you put in place to protect them from themselves and it's not really fair that the rest of us should have to pay to bail them out (which is essentially what happens, the banks inevitably pass on the costs of fraud to their customers).
Re: (Score:3)
Duty of care by the Bank should have warranted a check of unusual transaction. Bank was too lazy and cheap to make a single phone call to check out of pattern transactions, especially in the case of the most vulnerable in the community, pensioners.
Bank should should have been held at least 50% liable for the fraudulent transactions.
shitty lawyer (Score:2)
Even though i agree with Zappa's plan to get rid of suckers...
All it would take was for the lawyer to ask one bank member to do one transaction. Most banks would require 2 keys.
One for login, another to complete the transaction.
Both with messages that the bank only asks one per session.
There is a maximum level of customer stupidity... (Score:5, Insightful)
... for which the bank still is liable. In this case, the customer grossly exceeded that level IMO.
However, what I am wondering is why the Greek bank (that could not identify where the money had gone to) is not liable. That is the real problem I see here. AFAIK, a bank has to be able to cancel a transfer up to 6 weeks after the transfer at the sending bank's request. So either the customer not only gave away 10 TANs despite being warned, he also failed to notice the transfer for quite some time, or something else is amiss here that the news story does not tell.
Re: (Score:2)
Despite you being an AC, I will answer that: This is an European case, the laws are different here.
Re: (Score:2)
Despite you being an AC, I will answer that:
Cash withdrawals that exceed the booked balance (i.e. plus 6 weeks in the case of a bank transfer) plus the credit limit are not possible or at the risk of the bank. Remember though that this is Europe, in the states this is likely very much different. I admit that my knowledge of this is a few years old. It is possible that they have changes some things.
As to your scenario: That is easy. The idiot that gave their bank card gets full liability. Same as for "financ
Re: (Score:2)
european banks will let you withdraw your balance to zero(even if you had bad credit rating) the minute the cash hits the account. the canceling of valid(technically) transfers is definitely not available to private individuals either, so the 6 week limit if it exists might just as well not exist at all(I suppose they might use it in cases of botched db run transfers etc, which do happen, some people got their tax refunds in finland twice last fall for example..).
no doubt emptying was done at the greek end
Just my two cents (Score:5, Informative)
since noone here seems to bother to actually find out what was going on:
german banks do use a two factor authentication scheme:
- to log in you need your account number and a five digit pin
- to authorize a transaction after logging in, you need one out of 100 one-time-use 4 digit pins; The bank issues you 100 of those at a time, and then chooses one of them randomly when you enter a transaction ("Please enter pin number 17").
In this particular case the victim had:
- fallen for a phising website / trojan / keylogger, even after all the warnings in the german IT press (how else would the crooks get his account number and superpin)
- entered at least ten different PINs on one page, which the banksspecifically tell customers to NEVER do. all the bank pages have a big fat "We NEVER ask you for more than one pin" warning labels.
In other news: man drank nitroglycerine then went to jump around on a trampoline, widow sues maker of nitroglycerine.
Re: (Score:2)
You are accurate but a one time physical token (ie SecureID) would still be safer for the customer. The bank SHOULD be using these (my bank does) and as they are not then arguably they are to some degree or another responsible.
Re: (Score:2)
entered at least ten different PINs on one page, which the banksspecifically tell customers to NEVER do. all the bank pages have a big fat "We NEVER ask you for more than one pin" warning labels.
One common trick to defeat that is the fake "sorry you entered the wrong PIN, please enter a different one" scam. Admittedly doing this 10 times is a bit excessive, but of course we don't know that it was all in one transaction and may have been spread over several.
In fact you are assuming it was all done in one go, where as it sounds like he probably made 10 separate legit transactions and each of them was hijacked and turned into a non-legit one. Maybe he paid some bills online over the course of a month
Re: (Score:2)
Nowadays, yes. The case from the article happend 2008.
Re: (Score:2)
german banks do use a two factor authentication scheme:
- to log in you need your account number and a five digit pin
- to authorize a transaction after logging in, you need one out of 100 one-time-use 4 digit pins; The bank issues you 100 of those at a time, and then chooses one of them randomly when you enter a transaction ("Please enter pin number 17").
While I agree with your general point, what you're describing might be the minimum requirements; for example, at ING-DiBa [ing-diba.de]:
- to log in you need your account number + an 'ID' number at least 7 digits long + a virtual keyboard-input 6-digit PIN
- to authorize a transaction, you need a 6-digit m-TAN sent by SMS
In short, you can often find a bank paying more attention to security...
My (German) bank recently switch to a smart TAN system with a card reader. To authorize any transaction, you need to insert your debit card into the reader and then have the reader pick up some flashing bar code transmission from your screen. You then can verify the transaction on the display of the reader (amount, account number, etc.) and if everything is correct, you then use the TAN the card reader generated to authorize the transaction on your computer. So if anybody wants to transfer some money from y
Re: (Score:2)
Actually it used to be taken as medicine, so I'm guessing it's more or less safe in small amounts.
Bi-directional authentication (Score:5, Interesting)
It has irked me for quite a while how lacking internet banking is in terms of security. That is not to say that the measures they have implemented are ineffective, but rather that they miss out on entire classes of security. It's as though they stick a bunch of locks on the front door, but leave the bathroom window wide open.
The most obvious one: bi-directional authentication. Banks require you to prove you are who you say you are. This is done by a variety of methods from passwords to hardware card reading gizmos which spew out a limited time code. What they neglect to do is prove that they are who they say they are.
If the first step in authenticating your identity was one which authenticated the bank's then it would be a lot harder for phishers to pretend to be your bank.
They do what they can (Score:4, Interesting)
My bank authenticates itself in two ways:
1) Using an Extended Validation certificate, so it shows up in green in the browser (instead of blue) and lists the full name of the bank.
2) By showing me an image and phrase I chose on the login page.
I can't really think of how they can do more to prove it is them, without really getting annoying. They also allow me to use two factor authentication (which I have elected to use) and require it when any change is being made to the account like adding a payee or the like.
Is it perfect? No but I'm not seeing a whole lot more they can do and still keep things easy.
Some clarifications (Score:5, Informative)
#1: this happend in 2008. Since October 2009, there is new legislation in place that, that shifts liability to the bank (except in cases of gross negligence on the side of the customer) It's the bank that save money by offering online banking instead of traditional counters, so they are responsible for making that process secure.
#2: There is not a single bank anymore that uses plain one-time transaction codes anymore.
#3: A few months ago another german court ruled that it's enough for a customer to have up to date virus software for due diligence. That's all a bank can expect from customers with typical, average computer knowledge.
#4. On the other hand (and that's what's the actual rationale behind this story here), a bank can expect customers to understand and remember a security advice along the lines of "We will never ask you for more than one transaction code in a row and we will never ask you for a transaction code at all unless you want to make a transaction in the first place"
So there is not much relevance to this story.
Re: (Score:2)
I find it easy enough to image someone who is not an expert in computers going to the wrong web page (ie typo in the bank name www.banksrsu.com instead of www.banksrus.com) and being faced with username, login and ONE code entry...which doesn't work and so the page reloads and they're asked for ANOTHER code entry. Granted most people would give up after trying a few times but nonetheless it's trivial to get a minimum of three or four codes + username and password information.
I have a card from one of my ba
Re: (Score:2)
It's the bank that save money by offering online banking instead of traditional counters
Plus they want everyone to shop online with confidence because that means credit/debit card fees going to them. Making all purchases with plastic instead of cash is a bank's wet dream.
A few months ago another german court ruled that it's enough for a customer to have up to date virus software for due diligence.
Interesting. How do they check? Do you have to submit your PC as evidence? Also I have anti-virus software installed and up to date but not in active scanning mode, I just do on-demand scanning of downloads and a weekly full scan. Does that still count?
Come to think of it Windows 7 ships with Windows Defender built in and acti
Re: (Score:2)
You raised a few valid points, but they haven't been decided on by the courts as far as I know.
The attack vector from your last paragraph won't work with the security measures currently in place. Before clearing a transaction, you receive a SMS with the details of your transaction and you have to confirm it with a hash that's included in that message. Alomst all security systems require a confirmation with an externally generated hash, be it mTAN as I desecribed or TANS generated by an external device.
Re: (Score:2)
He ignored the banks security warnings, and that's why _he_ is responsible for his losses.
Nothing to see here. please move on.
Stupidity still isn't protected by the law.
Re: (Score:2)
The difference as I see it is, that before, as in this case, a whole number of one time codes (called TAN) was issued to a customer at once.
Any one of these TANs (by free choice of the customer) would be enough to permit a single transaction. After that it would be 'used up'.
Nowadays, the banks (that I know of) still issue a lot of TANs to their customers. But when an order needs to be authorized, they now ask for a specific TAN.
As in "give us TAN number 42". Any other TAN, even though not used yet, won't d
German courts (Score:2)
As an example: the Bundesverfassungsgericht (the highest German conlaw court, not the highest "ordinary" court in TFA) decreed it unconstitutional to publicly print (or run big news stories about) the names of notorious, convicted criminals, once the crimina
I'm a little confused here. (Score:3)
From some of the comments I've read, the banks are responsible for the stupidity of individuals? Am I reading that correctly?
That it falls to a court to decide that in fact the opposite is true, and that just maybe for one tiny moment common sense kicks in and the court says "Actually, you did a dumb thing, despite the warnings all over your account literature, newspapers and broadcast media, now eat the consequences of your ill-considered actions", and the bandwagon collapses under the weight of people who bleat as one "But it's all the banks' fault! They can eat the losses!" Maybe they can, but then if one pensioner does it, and the bank eats it, how many more before it becomes too many and "too big to fail" actually... fails?
Unbefuckinglievable.
I'm with the court on this one. Idiot did idiot thing, idiot can reap the consequences.
Re:I'm a little confused here. (Score:4, Informative)
"the banks are responsible for the stupidity of individuals"
No, the banks are responsible for their lack of transaction security.
Makes sense in the German context (Score:2)
(I just lost a longer response because I followed the Options link from the preview, not knowing that if I change my options it will nuke my comment.)
First you should keep in mind that the banks love internet banking because it saves them a lot of money. And from a purely formal point of view the fraud started with the bank transferring money abroad in the mistaken believe that their customer asked them to do that. As he didn't, he can ask for his money back *unless* they can prove it was really his fault.
I
Financial meltdown (Score:3)
Well, it's good to see that Germany is finally sending money to Greece.
A bank can cancel a transaction (Score:2)
My bank would have taken responsibility. (Score:2)
This has happened several times when I've lent money to a few of my friends.
New Business model? (Score:2)
Phishing insurance.
No SPF, no DKIM (Score:3)
nslookup of SPARDA.DE. shows no SPF record for the German bank's domain. They probably haven't implemented DKIM either.
I'd say the bank is liable. Any bank should a security IT professional telling them that a combinationof SPF and DKIM is a necessity for any bank with customers prone to pfishing. It's not enough to tell customers to "watch out for pfishing". If the bank acknowledges pfishing, then it needs to do something to prevent it. This usually means a strict SPF setting to filter out spam, plus a DKIM/Domainkey infrastructure to distinguish false positives.
Re:Lets just hope (Score:5, Insightful)
Why? How should a bank discover the fraud, if everything is authenticated correctly?
Is a bank also responsible for your losses if a guy comes to your front door, poses as a bank clerk and you cut him a cheque?
It's always the fault of that 1% (Score:5, Insightful)
Phishing, as we all know (at least those of us who frequent sites like /.) is a scam - and we also know that we should be responsible for our own action, however stupid it might turn out to be
But there are people who will never want to be responsible for any of their own action, and they will tell you that it's all the fault of that "1%" --- including those "banksters", and those "judge"
Re:It's always the fault of that 1% (Score:5, Insightful)
Not necessarily - You can take responsibility for your actions and still believe that bankers (more precisely, many investors) are not held accountable for their losses.
That "1%" has the ability to screw things up and still get huge bonuses/payments equal to what would take someone with an average salary 50-100 years to make. Not is not being held responsible. Even someone who is responsible for their actions, ESPECIALLY someone who is responsible for their actions, can see that.
* note - I had not money lost in the meltdown, but at the same time, if I screw up like some of those people did, in my job, then I'd be fired on the spot, and rightfully so. Likewise, if I were dumb enough to enter my data to fraudulent site, then it would be my responsibility to fix the issue, and rightfully so.
Re:It's always the fault of that 1% (Score:4, Insightful)
Likewise, if I were dumb enough to enter my data to fraudulent site, then it would be my responsibility to fix the issue, and rightfully so.
Does that apply if you are unaware of the fraud? For instance DNS hijack, MITM attack, both of which ensuring the first instance of you knowing of compromise is when you check your statement or the bank freezes your account? What about if your card is skimmed? [geek.com] It's happened to me, and I only ever use ATMs on bank buildings and am meticulous about shielding my PIN.
A lot of this isn't relevant to the story, but your statement is overly vague.
Re:It's always the fault of that 1% (Score:5, Insightful)
Yes! Absolutely! Why does everyone feel so entitled to be unaware of their own finances and security to the point of blaming the BANK for a scam?
Obviously the scammer broke the law. But if you can't catch the scammer, it doesn't give you the right to go find the next convenient party and blame it on them.
In this case, the scammer made a site that looked like the banks, but if the site looked like paypal's or the state lottery, and demanded your bank information, do you blame it on paypal/lottery? Obviously not, because they had nothing to do with the scam. Same with the bank.
Welcome to the real world, where if you're unaware of a mistake, it's still your mistake (for giving out 10 TAN codes and ignoring the phishing warning). Catch the crook if you can, but don't blame the service provider for not making their service idiot-proof, especially if you have other banking options anyway.
Re: (Score:3)
>Does that apply if you are unaware of the fraud? For instance DNS hijack, MITM attack, both of which ensuring the first instance of you knowing of
> compromise is when you check your statement or the bank freezes your account? What about if your card is skimmed? [geek.com] It's happened to me,
> and I only ever use ATMs on bank buildings and am meticulous about shielding my PIN.
The only case that I really think could be the bank's fault, is the first two, and then only if the hacker got the bank's c
Re:Lets just hope (Score:5, Interesting)
The problem with this ruling is that the customer hardly had a chance. The bank offers an authentication protocol that is vulnerable to a widespread and difficult to defend against type of attack. The bank knew that the protocol isn't secure and even warned about the vulnerability. All this despite the availability of protocols which are much more secure.
Suppose a credit card company told you to keep your credit card number secret and declined responsibility for fraudulent transactions because you once handed your credit card to a waiter. Would that be OK? If the bank offers a vulnerable protocol, it should bear the damage.
Re:Lets just hope (Score:5, Interesting)
That security protocol isn't in use anymore.
The bank specifically issued a warning against exactly the type of attack the customer fell for.
That ruling is in line with the laws in place 2008, when that happend, Laws have been changed since then.
Re:Lets just hope (Score:4, Informative)
Plus many banks in Germany phased out the iTAN system in favor of SMS-codes or TAN-generators that require the debit card to operate and are only valid for the transaction that was entered to generate the TAN (amount, target account etc...).
Re: (Score:3)
No, in practice you can not enter in multiple TAN codes for no reason.
The whole point of TAN codes is that it provides a good measure of protection against a having compromised system.
It's your own responsibility to be suitably paranoid about secrets assigned to you, and this guy didn't. If the pizza guy asks for your social security number, don't. Even if the man missed the notice on the login page, he's still negligent.
Re: (Score:2)
Why? How should a bank discover the fraud,
Answer a) is whatevery way they want. b) is; if need be by calling the guy back on his phone number; If they are suspicious enough, by having him come into the office and sign it personally whilst being compared against a photo. By requiring him to use a hardware token. Whatever.
What my bank does is sends out an SMS which contains the sum of the transaction; the person it's being paid to and, at the end, an authorization code. As long as my phone isn't hacked they can be pretty sure that I actually a
Re: (Score:2)
You're right about one thing: you didn't RTFA.
Re:Lets just hope (Score:4, Interesting)
Why? How should a bank discover the fraud, if everything is authenticated correctly?
Because they (possibly) enabled the fraud to take place. Quoting from the artcle:
According to the Süddeutsche Zeitung, the transfer occurred three months after he entered ten transaction numbers, or TAN codes, on what turned out to be an illegally manipulated version of his bank’s website.
So, how was the site manipulated? Did the attacker actually modify the bank's server? ==> In that case, bank clearly bears the responsibility, as they have a duty to keep their service secure.
Or did the attacker take advantage of a fault in the user's OS or browser. ==> in that case, at first glance, the user would be responsible to run such shoddy software where this is possible. However, in the past, and possibly even now, many banks forced/are forcing their users to use such vulnerable software. If this is the case, again the bank should be responsible. The user would be well advised to go through the "General Conditions" for the web service of the last ten years, and search for any clauses such as "the user agrees to only use Windows and/or Internet Explorer to access the service". If any are found, he should clearly get his money back.
Is a bank also responsible for your losses if a guy comes to your front door, poses as a bank clerk and you cut him a cheque?
Yes, if the bank habitually conducts its business in such a fashion.
Re: (Score:2)
That's kind of the thing isn't it? Authentication? The authentication systems are stupidly weak and without human involvement. For big business, let them run their banking and transactions automated and all that all day long. Let the credit reporting system be their guides. But for the little people? The working individuals? The ID fraud and all other things related are a big problem. People should be able to talk to a real person, face to face, to discuss things when there is any question about whe
Re: (Score:2)
I can talk to a real person.
I can go into the bank between 9 and 5.
I can wait in line. I can do my transaction and I can be safe.
Or.... I can get money and make transfers whenever I want. I can choose convenience.
If I choose the latter then I need to take care with what I am doing.
Re: (Score:3)
Bank transfers money to a Greek bank.
First bank calls Greek bank, says money was stolen and asks for money back
The Greek bank can now either take the money out of the account, send cops after the thief or acknowledge that they have no idea who really has accounts with them and that they shouldn't be allowed access to the secured banking transfer network. They don't want to do the last one because solving it costs them money and it's hard.
Re:Lets just hope (Score:5, Insightful)
What? Read the article. The person who committed the act of stupidity is the person paying for it. This is the way it has to be.
If the banks payed for the stupidity of this man there'd be no incentive not to be stupid.
Re: (Score:3)
Shouldn't the criminal phisher be responsible? So I leave my car unlocked and someone steals it. You could say "you idiot you deserve that". Does the thief gain legal rights to my car now?
The bank is in a better position to try to reduce this type of scam. The non-security aware Joe, is really a victim who was pushed on to internet banking and then duped. Banks could require (or recommend) security awareness training for anyone who uses their sites, but afaik, they do not.
Re: (Score:2)
Shouldn't the criminal phisher be responsible? So I leave my car unlocked and someone steals it. You could say "you idiot you deserve that". Does the thief gain legal rights to my car now?
Who pays for your replacement car (or repairs to it if it is found damaged)? The owner of the car park you left it unlocked in? No, you pay either directly or via your insurance. So what happens in the case of you leaving your car door unlocked is exactly the same as the situation here - the owner pays one way or another, the cost of fixing the situation doesn't rest with some other entity. The only difference is that I'm not aware of companies selling "phishing insurance".
Banks could require (or recommend) security awareness training for anyone who uses their sites, but afaik, they do not.
They could. And it would be commer
Re: (Score:2)
the phisher is responsible, I just suppose they couldn't reach him now.
If the bank had been responsible, then .. well, then you could double your money, just phish yourself.
Re: (Score:2)
Re:Lets just hope (Score:4, Insightful)
Shouldn't the criminal phisher be responsible? So I leave my car unlocked and someone steals it. You could say "you idiot you deserve that". Does the thief gain legal rights to my car now?
You mix up things.
Of course the one stealing your car commits theft, as does the one stealling the 5000 Euro from this person's bank account. And those criminals, when caught, will be held responsible.
The question here is who's liable for the damage incurred by the theft. In case of your car being stolen, you will not be able to get any damages from the car manufacturer arguing, say, not good enough locks on the doors. Just like in case of the money stolen from the bank account, the bank is not liable, and the judge ruled that the locks the bank put in place were good enough, and that the bank client should have taken better care.
And even if the criminal gets caught, that doesn't mean the victim will get their money or car back. So they still lose out.
Re: (Score:2)
You could say "you idiot you deserve that".
But your insurance company will. Most insurance will only pay if there is evidence of theft, damage to the locks, etc. If there is no visible damage, then the loss is your fault for not securing the vehicle.
I am not sure about "evidence of theft", people have had cars opened by hacking remotes, or even being loaded onto a tow truck and claimed succesfully
Re:Lets just hope (Score:4, Interesting)
I often leave my car unlocked. Why?
Thief breaks in, I lose maybe $5 in change form the console and some 15-year old CDs. If my car were locked, I'd lose that, PLUS a $200 car window they smashed to get said items. It is not worth locking my car.
I'm okay with this ruling, but .. (Score:2)
In fact, creating an "incentive not to be stupid" is an incredibly stupid reason that almost no court would adopt.
In this case, the bank has already taken all measures the court felt "reasonable". Ain't possible to reverse international bank transfers like one reverses credit card transfers though.
It isn't that the customer was stupid, but that the customer has exhausted the banks serious attempt at securing their money. And trust me German banks foist much more security upon their customers than American
Re: (Score:2)
What? Read the article. The person who committed the act of stupidity is the person paying for it. This is the way it has to be.
If the banks payed for the stupidity of this man there'd be no incentive not to be stupid.
Assuming that intelligence and common sense has anything to do with current law and litigation these days is an act of stupidity in itself.
Ever notice that warning on electric hairdryers that says to not use them in a tub full of water? The label on an iron that says do not iron clothes while trying to wear them? The baby washtub label that reminds parents to not throw their baby out with the bath water?
People get awarded millions for being stupid all the time in the US, and every label that you see like
Re: (Score:2)
As much as I dislike the bubble wrap world we are moving towards electronic fraud seems to be one area where it is still everyone for themselves. I have had to deal with it a couple of times, one was someone who was probably just guessing card numbers and seeing what ones worked and used
Re: (Score:2)
What? Read the article. The person who committed the act of stupidity is the person paying for it. This is the way it has to be.
If the banks payed for the stupidity of this man there'd be no incentive not to be stupid.
I work for an international bank and I can assure you we take phishing attacks on our customers very seriously. Almost all banks have an email address where you can forward phishing emails or websites to. I'll agree there is some blame to be put on the users, but the banks should not be off the hook. Banks have the man power and clout to actually shut these sites down.
Re:Lets just hope (Score:4, Insightful)
Banks could also require people to show up in person at a designated branch, present five different forms of identification, sign fifteen release forms, and swear a blood oath to Odin before agreeing to any transaction whatsoever.
My point is very simple: it is not the bank's fault that the client acted in a manner contrary to his own financial interest. Society as a whole operates on the principle that services are generally tailored to the majority. The majority isn't suffering from these issues. If the minority affected by these issues so desires, they're more than welcome to resume good old fashioned "drive down to the bank" methods.
What you're advocating is just another step toward a total nanny state where everyone walks around in government-mandated plastic bubbles. Have fun with that; I won't be attending your party.
Re:Lets just hope (Score:5, Insightful)
To be fair, the banks do not allow you to opt in to security features or opt-out of security liabilities.
I'd love if my bank would allow me to secure my checking account to restrict outgoing payments to a list of accounts/payees confirrmed by the branch.
I'd love to opt-in to a second factor token authentication and 2nd bank card pin that has a lower withdrawl limit or one time pin that I can use in sketchy ATMs POS systems.
I pay the bank dearly to protect my money and deliver service. They have had years to spend on R&D. Luckily, I have not been affected by the lack of security or insurance from my bank.
Re: (Score:2)
To be fair, the banks do not allow you to opt in to security features or opt-out of security liabilities.
Really? Your bank insists that you do online banking? That you conduct money transfers over the Internet? They do not allow you to go down to a bank location to conduct your banking business? Those are all options available to you and if you were to follow them would allow you to opt out of many security liabilities. I am pretty confident that if you never conduct any banking transactions online the courts would find the bank liable if someone hacked into your account and took your money.
Re: (Score:2)
His computer was infected with a trojan that made it look like it was his bank's web site.
How much like it? Was it his bank's url at the top? I have actually seen one phishing site in my life that attempted to graphically overwrite the url bar, but it was a little off.
Anyway, malware or not, in this case he should have asked himself why he was entering the codes. (What is this TAN code shit anyway?)
In other cases you might have an argument, because not everyone is observational enough to realize if their bank's site has been altered, or if an ATM has had a skimmer attached.
Re:Lets just hope (Score:4, Informative)
You got a sealed numbered list of 100 six or eight digit codes. Whenever you wanted to transfer money you had to enter one of the numbers (later a specific one, like #74). This authorized the transfer and you crossed out the number on your list. When around 90% of the list was used up, you got a new on by mail.
The first version (unnumbered) had the obvious drawback of X numbers stolen = x transfers up the the preset transfer limit (you had to show up in person to change that one). Numbered list had the advantage that one never new in advance which number would be asked for, and a potential thief had to get his hand on the whole list.
Of course all that stuff is outdated now and replaced by code generators that work in connection with your bank card or sms codes. Both of these create codes that only work for the specific transaction (amount, receiving account number, etc which is displayed in advance) and only for a very limited time frame (15 minutes).
Re: (Score:2)
Yup. For simple things and simple people Linux rocks.
Throw a Mint CD in and my Mother in law can have a running linux distro in no time and be checking her email in 30 min.
Takes longer than 30 min to do the user setup on an HP machine with the OS already installed.
Re:Lets just hope (Score:5, Insightful)
Why ?
The judge is right, there's no real viable way the bank can protect against this, even more modern protection schemes involving SMS messages still involve the enduser, and if he happily provides the received code to www.illtakeyourmoneythanks.ru despite numerous warnings from the bank (I have a similar bank, they clearly try to educate their users but as always most users are rather lazy than informed.) well, then there's really no way you can still blame the bank.
I know a large amount of users here are from the US and used to credit payments (as opposed to debit, which is the case here). Credit cards generally involve some (at first glance) better customer protection by laying all the risk at the seller, but debit cards almost never do this (and there's no need really).
I wouldnt go so far as to call the victim in this case an idiot, i don't know the guy, and it sounds like something that 1 in every 5 people who operate a computer would fall for at some point or another. But not following safety instructions from your bank, when they're clearly displayed EVERYWHERE, and get send to you in both real letters and as regular email updates, well i'd say the bank tried. My bank even gives free financial and online security seminars for people who aren't sure they understand what all the fuss is about.
Re: (Score:2)
As you do if you accept to bring the "package of flu medicine" for that "nice gentleman's mum" across border control.
As you do if you don't lock you car and it gets stolen or if you "optimise" the wiring of your house and it burns down.
We have now in a time and age where computers are basically ubiquitous so we must require from people a token level of responsibility.
Re: (Score:3)
The judge is right, there's no real viable way the bank can protect against this, even more modern protection schemes involving SMS messages still involve the enduser, and if he happily provides the received code to www.illtakeyourmoneythanks.ru despite numerous warnings from the bank.
For years, my bank (not one of the world's greatest) has used challenge/response chip-and-PIN authentication, using a small card reader provided free by the bank. You put your card into the reader and enter your PIN, punch in the challenge number given by the website, then type the response code into the website (the reader isn't interfaced with the computer at all), You need to do this every time you add a new payee via online banking. I'm sure its hackable by a sufficiently sophisticated attack, but not y
Re:Lets just hope (Score:5, Insightful)
Lets just hope that it doesn't become European law. Actually I hope the judge loses a million
I'm not sure that I agree with that. Most phishing scams are rather obvious, and people really ought to look before they jump.
What feel is missing is that banks and other take it more serious and clean up their practises. Like, I have on a few occasions had my bank call me about something related to security (eg. an unusual transaction) - and bizarrely, the guy calling is reluctant or even refuses to give information about why he calls or which department he calls from - which makes it feel like yet another scam, even if it is genuine.
Ideally, they should give you a call, then let you call back on a security number posted prominently on their web-site (so that it is well-known). This ought to be basic routine.
Re: (Score:2)
Most phishing scams are rather obvious
Yes. I found an email in my spam filter the other day that claimed to be a notice from my bank. It was worded the same way that notices from my bank are worded. The From address was right. One small detail - it was full of broken images. And, of course, all the links pointed to a site in another country.
Re: (Score:2)
So the issue is taken quiet seriously, you may not agree with some of the methodology, and that's fair enough, but to say banks don't take the issue seriously is misleading.
I'm not really trying to slag them off; but many of the measures seem to be half. You mention scrutinising the logs, which is good and necessary, but why don't they implement some of the simple and easy things that would help a lot - like an easy facility for checking the authenticity of a caller?
Re: (Score:2)
The bank had security in place, the "victim" gave the keys to the kingdom to third parties - why should the bank take the fall for someone who is more than willing to give the criminals everything, voluntarily.
This ruling is pure common sense - if you as a customer aren't willing to take basic precautions then you need to suffer the losses.
Re: (Score:3)
Re: (Score:3)
Re: (Score:3)
Try it in some countries.
Some banks barely have counters any more, and my last bank had one serving member of staff for a whole branch (imagine lunchtimes, where all the local businesses come in to put their cash in, or end-of-the-day queues).
Sure, there are funny machines you can do it on, but not if you're a business, not if you're paying cash, not if the Moon is in the seventh quadrant...
And guess what, the queue forms for the cashier because THEY NEED THE CASHIER, because their concerns cannot be met on