Intellectual Property Law

Banking Code: user liability for losses from online banking

Out-law reports on the new Banking Code, which will see customers regarded as liable for losses from their bank (e.g. from hackers gaining access to their account) if they do not act with reasonable care.

One of the key examples of not using reasonable care given by the Code is failing to comply with the advice in clause 12.9. The clause is a vague list of steps that customers should take to keep safe online, including not using "out of date" anti-virus/firewall software. On the one-hand, such vagueness is arguably a necessity because being over-specific would risk the Code being out-of-date (just like that anti-virus software!) very quickly. On the other hand, given that we are talking about the difference between a bank customer being able and not being able to recover from the bank what could be a significant amount of their money, this is a point that many will feel should be addressed clearly and comprehensively.

Andres at Technollama does a nice job of pulling apart 12.9. To his list of questions, I would add:

• The "anti-virus" requirement seems to be only relevant to bank customers who use the various versions of Windows, all of which are the target of thousands of viruses and bits of spyware. The other 2 main types of operating system, Apple Mac OSX and Linux, have few reported items of viruses/malware on the loose. If a customer using Mac/Linux calls their bank about losses from their account and tells them they use Mac/Linux and therefore don't have anti-virus installed, they may struggle to reclaim their losses from the bank simply through technical ignorance on the part of their bank.
• What about bank losses if a customer has in the past accessed their account in an internet cafe or from their office PC? Access to your bank anywhere is one of the main benefits of online banking, but in using another organisation's PC, you have to trust that organisation to have good IT security but you cannot guarantee this.
• What about losses suffered if the customer uses their mobile phone as a method of accessing their account? Mobile banking is predicted to be a big growth area, but IT security software for mobile phones isn't exactly commonly used.

Full post as published by IMPACT on April 04, 2008 (boomark / email).