4 ms·

Back in June 2022 there was a landmark decision in the Swedish supreme court (https://www.domstol.se/hogsta-domstolen/avgoranden/2022/115592/ https://www.domsto

by tpmx 3y ago

Back in June 2022 there was a landmark decision in the Swedish supreme court (https://www.domstol.se/hogsta-domstolen/avgoranden/2022/115592/ https://www.domstol.se/hogsta-domstolen/avgoranden/2022/1155...) that made the banks responsible in most of these kinds of cases. The same thing needs to happen in other countries. I love the British comedian David Mitchell's long time campaign against this kind of bank behavior: https://www.theguardian.com/commentisfree/2018/nov/25/identity-theft-is-daylight-robbery-banks https://www.theguardian.com/commentisfree/2018/nov/25/identi... ('’Identity theft’? It’s daylight robbery by the banks' - 2018) https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E (Mitchell & Webb - Identity Theft, 2007)

ghusto 3y ago
I always took the bank's sudden intense interest in my security as serving there concerns, not mine. Not only did it smell insincere and fishy, but it didn't make sense either. Why should I care so much for _their_ service? If they get scammed into giving all my money to someone else, that sounds very much like a _them_ problem, and not a me problem.
- jfim 3y ago
  Even if it's caused by their incompetence, you'll have to sort it out if it happens, and they won't really care all that much.
  - ghusto 3y ago
    At least here, their care isn't really optional. It's their responsibility, since it's their service. I think they have to prove it was through my own fault in order to brush it off, and that's difficult. Difficult enough that when I had to get my money back (lost due to fraud), they didn't ask more than a nominal set of questions.
thfuran 3y ago
I don't understand how the liability could lie elsewhere. I understand why the bank might want to tell a customer "someone else took your money. It sucks to be you", but it seems pretty clear cut that it's no different than the bank somehow misplacing funds for any other reason (at least as far as the customer is concerned. The bank's insurer presumably cares about the particulars of how they're misplacing money).
- chatmasta 3y ago
  Not to mention they seem to have no problem treating it as "their" money while lending it out to other people, but as soon as someone tricks them into sending it to the wrong place, suddenly it was "your" money. It reminds me of when I was a kid, my sister and I got two identical fish and couldn't disambiguate which was mine and which was hers. But when one of them died, she made sure to let me know that was my fish.
  - FredPret 3y ago
    It is their money. You lent it to them when you made the deposit. All you now own is an admission from the bank that they owe you $x. The whole point of getting hacked is that the bank doesn't know it's not you, so of course they'll try to get out of refunding you. There are some asterisks to this statement due to the large amount of regulation around bank accounts.
    - close04 3y ago
      That would imply that if the bank loans me money, and then I deposit it into a fake/scam bank I can claim that I didn't know it's not them and get out of repaying the loan. But it doesn't work that way because I'm expected to do my due diligence. So should the bank. Not knowing it's me just means they have to find a way to guarantee that knowledge. Because the failure to properly identify a client is the bank's not the client's.
    - thfuran 3y ago
      >so of course they'll try to get out of refunding you. Yes, in the same way that companies will often try to avoid honoring their warranties. That it's in their financial interest to do so doesn't mean they can just ignore their contract with you.
avianlyric 3y ago
The Payment Services Regulations (2009 & 2017) already encode this liability in UK law. It outlines a very clear set of standards that need to met for payments to be “authorised”, and make it clear that banks are 100% liable for any unauthorised payments. Banks of course will do everything in their power to shirk their responsibilities. But reading the legislation, and writing a well worded letter, plus a follow up with the Financial Ombudsman (FOS) is pretty much sure fire way to get your money back. The FCA set clear rules around how banks must deal with complaints, and the FOS makes it easy to escalate complaints when banks refuse to acknowledge they’re responsibilities, and are extremely consumer friendly (I say this as someone who’s dealt with the FOS from the banks perspective)
- tpmx 3y ago
  Since you seem to have a grasp on those regulations; which are those very clear standards that need be met for payments to be "authorised"? A brief overview would be much appreciated. Please include a link to the actual law text if you're able to.
  - avianlyric 3y ago
    Legislation is online and written in some pretty clear English, knock yourself out[0]. But broadly the bank is completely responsible for any transaction the account owner claims is “unauthorised” unless the bank can demonstrate the account owner was “grossly negligent” with their payment credentials, or can demonstrate the account owner is making a fraudulent claim. The standard of “grossly negligent” is something you need to look to case law to understand, but it’s generally very hard to prove gross negligence, and the account owners personal situation must be considered. A relevant example of non-gross negligence, was an older individual who entrusted their debit card and PIN number to their carer so they could buy them groceries. The carer used the card and PIN to steal money from the account holder, and bank claimed that sharing their PIN with a carer was gross negligence, but the FOS and courts disagreed on the grounds the individual needed to provide their card and PIN because their personal situation made buying groceries themselves effectively impossible. But the TL;DR is that law places the burden on banks to prove that any transaction a customer claims is “unauthorised” was actually “authorised” by the customer, that the customer isn’t acting fraudulently, and wasn’t grossly negligent. There is no assumption of fault on the customer part. [0] https://www.legislation.gov.uk/uksi/2017/752/part/7/crossheading/authorisation-of-payment-transactions/made https://www.legislation.gov.uk/uksi/2017/752/part/7/crosshea...

by tpmx 3y ago

ghusto 3y ago

I always took the bank's sudden intense interest in my security as serving there concerns, not mine. Not only did it smell insincere and fishy, but it didn't make sense either. Why should I care so much for _their_ service? If they get scammed into giving all my money to someone else, that sounds very much like a _them_ problem, and not a me problem.

jfim 3y ago
Even if it's caused by their incompetence, you'll have to sort it out if it happens, and they won't really care all that much.
- ghusto 3y ago
  At least here, their care isn't really optional. It's their responsibility, since it's their service. I think they have to prove it was through my own fault in order to brush it off, and that's difficult. Difficult enough that when I had to get my money back (lost due to fraud), they didn't ask more than a nominal set of questions.

thfuran 3y ago

I don't understand how the liability could lie elsewhere. I understand why the bank might want to tell a customer "someone else took your money. It sucks to be you", but it seems pretty clear cut that it's no different than the bank somehow misplacing funds for any other reason (at least as far as the customer is concerned. The bank's insurer presumably cares about the particulars of how they're misplacing money).

chatmasta 3y ago
Not to mention they seem to have no problem treating it as "their" money while lending it out to other people, but as soon as someone tricks them into sending it to the wrong place, suddenly it was "your" money. It reminds me of when I was a kid, my sister and I got two identical fish and couldn't disambiguate which was mine and which was hers. But when one of them died, she made sure to let me know that was my fish.
- FredPret 3y ago
  It is their money. You lent it to them when you made the deposit. All you now own is an admission from the bank that they owe you $x. The whole point of getting hacked is that the bank doesn't know it's not you, so of course they'll try to get out of refunding you. There are some asterisks to this statement due to the large amount of regulation around bank accounts.
  - close04 3y ago
    That would imply that if the bank loans me money, and then I deposit it into a fake/scam bank I can claim that I didn't know it's not them and get out of repaying the loan. But it doesn't work that way because I'm expected to do my due diligence. So should the bank. Not knowing it's me just means they have to find a way to guarantee that knowledge. Because the failure to properly identify a client is the bank's not the client's.
  - thfuran 3y ago
    >so of course they'll try to get out of refunding you. Yes, in the same way that companies will often try to avoid honoring their warranties. That it's in their financial interest to do so doesn't mean they can just ignore their contract with you.

avianlyric 3y ago

The Payment Services Regulations (2009 & 2017) already encode this liability in UK law. It outlines a very clear set of standards that need to met for payments to be “authorised”, and make it clear that banks are 100% liable for any unauthorised payments. Banks of course will do everything in their power to shirk their responsibilities. But reading the legislation, and writing a well worded letter, plus a follow up with the Financial Ombudsman (FOS) is pretty much sure fire way to get your money back. The FCA set clear rules around how banks must deal with complaints, and the FOS makes it easy to escalate complaints when banks refuse to acknowledge they’re responsibilities, and are extremely consumer friendly (I say this as someone who’s dealt with the FOS from the banks perspective)

tpmx 3y ago
Since you seem to have a grasp on those regulations; which are those very clear standards that need be met for payments to be "authorised"? A brief overview would be much appreciated. Please include a link to the actual law text if you're able to.
- avianlyric 3y ago
  Legislation is online and written in some pretty clear English, knock yourself out[0]. But broadly the bank is completely responsible for any transaction the account owner claims is “unauthorised” unless the bank can demonstrate the account owner was “grossly negligent” with their payment credentials, or can demonstrate the account owner is making a fraudulent claim. The standard of “grossly negligent” is something you need to look to case law to understand, but it’s generally very hard to prove gross negligence, and the account owners personal situation must be considered. A relevant example of non-gross negligence, was an older individual who entrusted their debit card and PIN number to their carer so they could buy them groceries. The carer used the card and PIN to steal money from the account holder, and bank claimed that sharing their PIN with a carer was gross negligence, but the FOS and courts disagreed on the grounds the individual needed to provide their card and PIN because their personal situation made buying groceries themselves effectively impossible. But the TL;DR is that law places the burden on banks to prove that any transaction a customer claims is “unauthorised” was actually “authorised” by the customer, that the customer isn’t acting fraudulently, and wasn’t grossly negligent. There is no assumption of fault on the customer part. [0] https://www.legislation.gov.uk/uksi/2017/752/part/7/crossheading/authorisation-of-payment-transactions/made https://www.legislation.gov.uk/uksi/2017/752/part/7/crosshea...