4 ms·

Since you seem to have a grasp on those regulations; which are those very clear standards that need be met for payments to be "authorised"? A brief overview wou

by tpmx 3y ago

Since you seem to have a grasp on those regulations; which are those very clear standards that need be met for payments to be "authorised"? A brief overview would be much appreciated. Please include a link to the actual law text if you're able to.

avianlyric 3y ago
Legislation is online and written in some pretty clear English, knock yourself out[0]. But broadly the bank is completely responsible for any transaction the account owner claims is “unauthorised” unless the bank can demonstrate the account owner was “grossly negligent” with their payment credentials, or can demonstrate the account owner is making a fraudulent claim. The standard of “grossly negligent” is something you need to look to case law to understand, but it’s generally very hard to prove gross negligence, and the account owners personal situation must be considered. A relevant example of non-gross negligence, was an older individual who entrusted their debit card and PIN number to their carer so they could buy them groceries. The carer used the card and PIN to steal money from the account holder, and bank claimed that sharing their PIN with a carer was gross negligence, but the FOS and courts disagreed on the grounds the individual needed to provide their card and PIN because their personal situation made buying groceries themselves effectively impossible. But the TL;DR is that law places the burden on banks to prove that any transaction a customer claims is “unauthorised” was actually “authorised” by the customer, that the customer isn’t acting fraudulently, and wasn’t grossly negligent. There is no assumption of fault on the customer part. [0] https://www.legislation.gov.uk/uksi/2017/752/part/7/crossheading/authorisation-of-payment-transactions/made https://www.legislation.gov.uk/uksi/2017/752/part/7/crosshea...
- deleted 3y ago
  [deleted]
- tpmx 3y ago
  Thanks! In the Swedish supreme court case I quoted above: Background information: - Sweden has a public personal identification number for every citizen (except for like 10k people with protected identities) - The four main banks in Sweden have collaborated to create something called "Bank Id". It's often used as a secure authentication tool combined with the personal identification number (something you have - the cert in the mobile app, something you know - PIN or face id). Someone convinced an elderly person over the phone to authorize the creation of a new Bank Id on the attacker's phone. This was fairly complicated and required the old person to use their physical RSA SecurID token. The court found that the elderly person had behaved reasonably well and that the attacker was very competent. Still, the supreme court felt that the bank should have been more careful about letting strangers steal their money.
  - avianlyric 3y ago
    In the UK authorised push payment fraud, where customers are tricked into authorising payments to fraudster accounts has a similar smell to Swedish case you mention. Rulings by the regulators and courts have reached basically identical conclusions to the Swedish courts. Fs the customers acted in a reasonable manner, then it’s the banks failure, customers aren’t expected to become security and fraud experts just to access their bank accounts.
- danmaz74 3y ago
  If you give your card and your PIN to somebody and that somebody steals from you, how can this be the bank's fault?
  - deleted 3y ago
    [deleted]
  - growse 3y ago
    Presumably because the bank thinks that card and pin possession is sufficient to authorise all transactions regardless of personal circumstance. As this case shows, this isn't always true.
  - avianlyric 3y ago
    Banks have an obligation to ensure that people can access and use their funds. This isn’t email, being unable to spend your own money has very serious consequences for people. It’s their duty to provide security measures that both ensure transactions are authorised correctly, and allow people reasonable access to their money. If you’re house bound, entirely dependent on a trusted third party help for your day-to-day living, and your bank only provides a debit card and PIN facility to authorise your transactions, then what choice do you have but to share those credentials with a trusted third party so they can buy food for you? The bank chooses the authentication mechanism, their customers don’t get a choice. If that mechanism doesn’t work as intended when faced with common and entirely reasonable living situations, that’s the banks failure, not the customers failure.
    - danmaz74 3y ago
      It's easy to pick on banks, but I really don't see what should the bank do here.
      - Fire-Dragon-DoL 3y ago
        This is basically, it's bank's fault for having chosen their cheapest mechanism and not have changed anything. In the end, the bank could have provided a digital one off pin with a fixed amount fir the debit card. From a tech perspective this seems easy to implement and could have solved the casr, the bank just does not provide it.

by tpmx 3y ago

avianlyric 3y ago

Legislation is online and written in some pretty clear English, knock yourself out[0]. But broadly the bank is completely responsible for any transaction the account owner claims is “unauthorised” unless the bank can demonstrate the account owner was “grossly negligent” with their payment credentials, or can demonstrate the account owner is making a fraudulent claim. The standard of “grossly negligent” is something you need to look to case law to understand, but it’s generally very hard to prove gross negligence, and the account owners personal situation must be considered. A relevant example of non-gross negligence, was an older individual who entrusted their debit card and PIN number to their carer so they could buy them groceries. The carer used the card and PIN to steal money from the account holder, and bank claimed that sharing their PIN with a carer was gross negligence, but the FOS and courts disagreed on the grounds the individual needed to provide their card and PIN because their personal situation made buying groceries themselves effectively impossible. But the TL;DR is that law places the burden on banks to prove that any transaction a customer claims is “unauthorised” was actually “authorised” by the customer, that the customer isn’t acting fraudulently, and wasn’t grossly negligent. There is no assumption of fault on the customer part. [0] https://www.legislation.gov.uk/uksi/2017/752/part/7/crossheading/authorisation-of-payment-transactions/made https://www.legislation.gov.uk/uksi/2017/752/part/7/crosshea...

deleted 3y ago
[deleted]
tpmx 3y ago
Thanks! In the Swedish supreme court case I quoted above: Background information: - Sweden has a public personal identification number for every citizen (except for like 10k people with protected identities) - The four main banks in Sweden have collaborated to create something called "Bank Id". It's often used as a secure authentication tool combined with the personal identification number (something you have - the cert in the mobile app, something you know - PIN or face id). Someone convinced an elderly person over the phone to authorize the creation of a new Bank Id on the attacker's phone. This was fairly complicated and required the old person to use their physical RSA SecurID token. The court found that the elderly person had behaved reasonably well and that the attacker was very competent. Still, the supreme court felt that the bank should have been more careful about letting strangers steal their money.
- avianlyric 3y ago
  In the UK authorised push payment fraud, where customers are tricked into authorising payments to fraudster accounts has a similar smell to Swedish case you mention. Rulings by the regulators and courts have reached basically identical conclusions to the Swedish courts. Fs the customers acted in a reasonable manner, then it’s the banks failure, customers aren’t expected to become security and fraud experts just to access their bank accounts.
danmaz74 3y ago
If you give your card and your PIN to somebody and that somebody steals from you, how can this be the bank's fault?
- deleted 3y ago
  [deleted]
- growse 3y ago
  Presumably because the bank thinks that card and pin possession is sufficient to authorise all transactions regardless of personal circumstance. As this case shows, this isn't always true.
- avianlyric 3y ago
  Banks have an obligation to ensure that people can access and use their funds. This isn’t email, being unable to spend your own money has very serious consequences for people. It’s their duty to provide security measures that both ensure transactions are authorised correctly, and allow people reasonable access to their money. If you’re house bound, entirely dependent on a trusted third party help for your day-to-day living, and your bank only provides a debit card and PIN facility to authorise your transactions, then what choice do you have but to share those credentials with a trusted third party so they can buy food for you? The bank chooses the authentication mechanism, their customers don’t get a choice. If that mechanism doesn’t work as intended when faced with common and entirely reasonable living situations, that’s the banks failure, not the customers failure.
  - danmaz74 3y ago
    It's easy to pick on banks, but I really don't see what should the bank do here.
    - Fire-Dragon-DoL 3y ago
      This is basically, it's bank's fault for having chosen their cheapest mechanism and not have changed anything. In the end, the bank could have provided a digital one off pin with a fixed amount fir the debit card. From a tech perspective this seems easy to implement and could have solved the casr, the bank just does not provide it.