> what makes it 'clearly not right' It doesn't add up with my experience of how banks (incl. HSBC) deal with transfers. > Victim blame much? If we can't have

> what makes it 'clearly not right' It doesn't add up with my experience of how banks (incl. HSBC) deal with transfers. > Victim blame much? If we can't have a rational conversation about the actual factors leading to these sorts of events (i.e. exactly how the transfers were authorised, where the weakest link in the security chain was), how are we supposed to prevent future occurrences? We can have all of the technical measures in the world in place, but if a customer explicitly consents to someone else logging in, or making these transfers - we should be discussing non-technical solutions instead. Equally, if it turns out that the UI design of the existing security measures was poor and that lead to this case, then that's something that industry can and should improve upon (or be forced to, via regulation).