Indeed. Here's an analogy I like using (warning: ethical argument follows, not a legal advice).
Say, you give your car keys to a valet to park, along with the fee.
You come back to find no car. The valet informs you that they already gave away the vehicle to a homeless person that "kinda looked like you, man" because they asked for it.
You never get your car back.
Now, I personally think it is very fair to hold the company that employed the valet 100% liable for the damages.
The business of operating valet parking comes with certain obligations, one of which is to keep your vehicle safe, and return it to you and only to you. If they can't do that, they shouldn't be in that business. It's not your problem that the valet got high and fulfilled an authorized request. They owe you a vehicle.
Same with a bank. Allowing unauthorized (meaning: unauthorized by you) access to your account is the failure of a bank to do its job and fulfill its obligations to you.
For that, the bank is fully liable. The damages that the thief thus caused to the bank should not be your concern.
------
TL;DR: a thief is guilty for stealing from the bank. The bank is guilty for letting someone else access your account. Both are 100% liable - for different things.
Huh? How is "responsible disclosure" related at all?
I've got news for you, it happens all the time. I can't open my mouth without some Microsoft lackey shouting irresponsible at me.
> This reminds me of a great Mitchell and Webb sketch. https://youtu.be/CS9ptA3Ya9E
So flip that around as well. Instead of a person being required to prove it wasn't them, the bank should be required to prove it was.
I call to report it. The 800 number says you can email the dispute but an operator told me that was outdated. I’d have to mail it into a PO Box. I repeatedly asked if they would inform law enforcement as dozens of other people’s cards were likely stolen.
Approximately a month later, GoBank responds and denies my dispute. I then searched for the executives, emailed them, someone called me and the next day my money was returned. Yet I’m assuming no one investigated the actual theft.
If you ever have problems communicating with customer service people, the only thing you can do is email the executives and suddenly you have a real person capable of understanding and making actual decisions.
I dislike credit cards, but at least with them you can contest fraudulent charges and more often than not, succeed.
You can draw an analogy to price elasticity in economics (more directly, the cost of switching). Because of identity theft, the expected cost of business between you and the bank has gone up. Who has an easier time switching to an alternative: you (to another bank), or the bank (to another customer)? Based on that, you can conclude, fairness aside, who ends up carrying the burden of addressing the identity theft.
Surely the identity thief, the actual criminal who committed fraud, should be liable?
The US generally has a legal system that acknowledges joint and several liability, so the bank and criminal are independently 100% liable...and guess who the damaged party is more likely to get satisfaction from?
Being a bank is a privilege, a highly regulated privilege at that. It sort of goes without saying the bank violate their duties and was not complying with bank regulations where the opened up an account on behalf of someone using the identification of a 3rd party.
Don't like those regulations? Think they are to burdensome? Then Wells Fargo can give their bank charter.
People often wonder how this is fair. If parties D1 and D2 both played a role in allowing some bad thing to happen to P, but it was 90% D1's fault and 10% D2's fault, but D2 has deep pockets and D1 has almost nothing, how is it fair to make D2 pay both their own share and D1's share of the damages to P?
It makes a lot more sense when you realize that these are situations where someone has to get screwed. If D1 is liable to P for 90% of the total damages and D2 is liable to P for 10% of the total damages, P gets screwed. P only gets 10% of what they are owed.
Joint and several liability recognizes that of the parties involved P is the one who least deserves to get screwed, and so allows P to collect the full damage award from whichever D's have the money. If, as in this example, that results in one or more D's getting screwed, those D's can sue the other D's over it.
And that will fairly be debated until the end of time. Some jurisdictions do not have joint and several liability and so your example of liability being capped up to their % of their contributory negligence is a reality. Even in the joint and severally liable jurisdictions, there will be a finding of contributory negligence, but its pretty well understood a jury can't fairly assign %'s of fault anyway.
However, as someone who sees the reality of these cases, the guy with the deep pockets really doesn't pay either, their insurance pays, and this is really where things get both weird and fair. Say you hit me with your car and I file a claim with my insurance and your insurance, the insurance companies work it out behind the scene (and I promise they do these settlements in their own best interest, not the insured (your) or the claimants best interests (mine)) and insurance does this knowing tomorrow they will work together on another claim where the other insurance company will be liable.
Insurance issues aside, if it weren't for joint and several liability these deep pockets you reference would never be liable, they would always out spend the criminal defendant in attorney's fees and likely be attributed almost no % of liability. Joint and several liability encourages the fair settlement of cases to save time and money to all parties, and gives the claimant the best chance of being made whole, whereas these other system encourages outspending the other parties in litigation and disincentives settlements of claims, shifting a lot of costs on tax payers who pay for the courts.
Specifically, my argument would be that Wells Fargo was in a position to verify the criminal's claimed identity, but didn't.
I don't think this is really about liability for the direct cost of the fraudulent transaction, though.
It sounds like third parties (banks, credit providers, etc) have been libelling the reporter by claiming to other third parties (credit agencies, law enforcement, etc) that he did things that he didn't. They should be expected to verify identity more carefully before making such strong claims like that, and should be liable to the reporter for damages caused as a consequence of their negligence.
Likewise, if law enforcement has been told about the fraud, then they should be held to account for harassing this unrelated party.
The Bloomberg reporter's problems weren't that he had to pay a bunch of money because a fraudster did a bunch of stuff using his name. His problems were all related to his damaged reputation (credit score, government lists, etc).
Note that if it was your own bank that defamed you, then you may have signed an arbitration agreement.
If the bank claims that I have a delinquent loan, and that claim is false due to their negligence, then they should be liable for all the consequences.
In Europe a more usual consequence would be that if a bad credit is reported and disputed (because it's not mine) then (a) the disputed bad credit notice would have to be immediately removed until the dispute is resolved; (b) the burden of proof is up to the institution, not the borrower; and (c) "a guy came in, claimed to be you, and knew your ID number and your mom's maiden name" is not considered proof. So the end result is that they'd be out of money and my credit would still be clean.
This also means that any institutions with lax ID policies will be heavily targeted by fraudsters. If you're the only car rental (for example) which doesn't properly verify identity, then every crook in the country (and beyond) will come and visit your office. For example, banks used to take scans of the ID used - if the picture they have is not your real ID, then there's no dispute that it's not you; and if it's your real ID and it was reported as lost/stolen beforehand (companies can query that data), then there's no dispute, their claims are not valid and they're not allowed to tell any other companies (credit registers/etc) that you have a bad debt because that's libel and they'd be liable for any damages.
If they think that I'm just faking that claim, they're free to go to the police and press charges that I did take that loan and I'm defrauding them by these false statements. Then it's a criminal case - serious consequences, but also serious burden of proof.
Or they're free to go to the police with surveillance cam footage of the person who took that loan and have them look for the fraudster.
And things like the regulations for managing credit scores and government lists are things that the gov't can (and should) change to remove undue burden from the person whos identity was used by fraudsters.
At the end of the day, his problem is exactly that he had to pay a massive cost (in the form of reputational damage and tremendous wastes of his time) because a fraudster did a bunch of stuff using his name. While not technically monetary, it's definitely not impossible to financially quantify people's time and reputation.
It's bafflingly easy to get a new credit card from them with a couple key bits of info that everyone knows are widely compromised or otherwise readily available.
So it might take a day to open an account (while the bank does the verification they should have done anyway), instead of five minutes, but the financial world would continue on as normal.
And, this would shift the work onto the entity best suited to performing the work instead of forcing the work onto the victim.
> I mean, they ARE liable in the sense that they will have to eat the loss (the money they loaned out won't be repaid). The problem is that for them, this is just a cost of doing business, and that cost is already priced into interest rates... the cost to the person who has to prove it wasn't them has no return and is only negative
What would "the status quo [changing] so that the banks are liable" look like?
This is more or less a digital question in an analog situation.
What I mean by that is they could very well be liable however the cost, trouble and barriers to pursue this make it impractical to enforce that liability. This is often the case in both business and life unfortunately.
And then it's your responsibility to prove that you're not "it".
But turn it around. How else would they identity people? I suppose that they could collect fingerprints, iris scans, DNA samples, etc. But for >99% of cases, that's overkill. And too expensive.
In a way, this just reflects the fact that anyone can sue anyone. And if sued, you must defend yourself. So basically they're just using Tax ID to decide who to sue.