5 ms·

Actually, in some cases the liability shifts to the customer: As few customers object to terms and conditions, banks are free to set terms that shift liab

by junto 12y ago

Actually, in some cases the liability shifts to the customer: As few customers object to terms and conditions, banks are free to set terms that shift liability to customers. For example, the Royal Bank of Scotland says [2]: “You understand that you are financially responsible for all uses of RBS Secure.” So despite the bank having made many poor security choices, the customer must accept the losses – a clear example of misplaced incentives. The use of password also harms customer interests because they no longer have the statutory protection afforded by signatures where, in the UK at least, the law makes a forged signature void and thus prevents banks from using their terms and conditions to make customers liable for forged cheques. It has already been documented that many banks used the move away from manuscript signatures to make customers liable for fraud [4]. See "Verified by Visa and MasterCard SecureCode: or, How Not to Design Authentication" http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf In other words, the customer gets both a user interface problem and a liability shift. It is called in the trade "getting shafted"!

lorddoig 12y ago
"Getting shafted" is a bit strong - it's quite understandable really. Card fraud, and particularly the statutory liability incumbent on banks/card issuers, is a major thorn in institutions' sides. It's the perfect incentive to make the system more secure. If you were the CEO of a payment processor you'd do the same (or get fired.) It's exactly the same story with chip+pin: when the customer is the creator, owner, and maintainer of the ultimate authorization (fraudsters can passively steal your card number/name/expiry/CVV2, but your PIN and/or 3DSecure password is on you) and fraud occurs then it's the customer's fault for not protecting said PIN/password. Assuming the bank's security doesn't lapse (in which case they are liable, not you) then this is perfectly sensible, no? Are we seriously suggesting a bank should be liable for you not taking password security seriously enough? Or that we should stick to bullshit authorization methods like a signature purely because it takes liability away from the "little guy"? We wouldn't blame Facebook if our accounts got hacked because we kept our password on a post-it note stuck to a monitor. The logic here is the same - to imply it's any different because it's an evil bank is letting our hearts rule our heads.
jasonjei 12y ago
I just find it hard to believe a bank can be absolved of any liability since fraud can still happen electronically, just like signatures are forged. Most Internet users aren't savvy enough to look for SSL or legit looking URLs. There's still the possibility of a MITM attack. Does case law actually allow credit card companies to shift liability just like that?

by junto 12y ago

lorddoig 12y ago

"Getting shafted" is a bit strong - it's quite understandable really. Card fraud, and particularly the statutory liability incumbent on banks/card issuers, is a major thorn in institutions' sides. It's the perfect incentive to make the system more secure. If you were the CEO of a payment processor you'd do the same (or get fired.) It's exactly the same story with chip+pin: when the customer is the creator, owner, and maintainer of the ultimate authorization (fraudsters can passively steal your card number/name/expiry/CVV2, but your PIN and/or 3DSecure password is on you) and fraud occurs then it's the customer's fault for not protecting said PIN/password. Assuming the bank's security doesn't lapse (in which case they are liable, not you) then this is perfectly sensible, no? Are we seriously suggesting a bank should be liable for you not taking password security seriously enough? Or that we should stick to bullshit authorization methods like a signature purely because it takes liability away from the "little guy"? We wouldn't blame Facebook if our accounts got hacked because we kept our password on a post-it note stuck to a monitor. The logic here is the same - to imply it's any different because it's an evil bank is letting our hearts rule our heads.

jasonjei 12y ago

I just find it hard to believe a bank can be absolved of any liability since fraud can still happen electronically, just like signatures are forged. Most Internet users aren't savvy enough to look for SSL or legit looking URLs. There's still the possibility of a MITM attack. Does case law actually allow credit card companies to shift liability just like that?