Hacker News Reader

Comment by tpmx | Hacker News Reader

Back in June 2022 there was a landmark decision in the Swedish supreme court (https://www.domstol.se/hogsta-domstolen/avgoranden/2022/1155...) that made the banks responsible in most of these kinds of cases. The same thing needs to happen in other countries.

I love the British comedian David Mitchell's long time campaign against this kind of bank behavior:

https://www.theguardian.com/commentisfree/2018/nov/25/identi... ('’Identity theft’? It’s daylight robbery by the banks' - 2018)

https://www.youtube.com/watch?v=CS9ptA3Ya9E (Mitchell & Webb - Identity Theft, 2007)

View on HN

The Payment Services Regulations (2009 & 2017) already encode this liability in UK law. It outlines a very clear set of standards that need to met for payments to be “authorised”, and make it clear that banks are 100% liable for any unauthorised payments.

Banks of course will do everything in their power to shirk their responsibilities. But reading the legislation, and writing a well worded letter, plus a follow up with the Financial Ombudsman (FOS) is pretty much sure fire way to get your money back.

The FCA set clear rules around how banks must deal with complaints, and the FOS makes it easy to escalate complaints when banks refuse to acknowledge they’re responsibilities, and are extremely consumer friendly (I say this as someone who’s dealt with the FOS from the banks perspective)

Since you seem to have a grasp on those regulations; which are those very clear standards that need be met for payments to be "authorised"? A brief overview would be much appreciated. Please include a link to the actual law text if you're able to.

Legislation is online and written in some pretty clear English, knock yourself out[0].

But broadly the bank is completely responsible for any transaction the account owner claims is “unauthorised” unless the bank can demonstrate the account owner was “grossly negligent” with their payment credentials, or can demonstrate the account owner is making a fraudulent claim. The standard of “grossly negligent” is something you need to look to case law to understand, but it’s generally very hard to prove gross negligence, and the account owners personal situation must be considered.

A relevant example of non-gross negligence, was an older individual who entrusted their debit card and PIN number to their carer so they could buy them groceries. The carer used the card and PIN to steal money from the account holder, and bank claimed that sharing their PIN with a carer was gross negligence, but the FOS and courts disagreed on the grounds the individual needed to provide their card and PIN because their personal situation made buying groceries themselves effectively impossible.

But the TL;DR is that law places the burden on banks to prove that any transaction a customer claims is “unauthorised” was actually “authorised” by the customer, that the customer isn’t acting fraudulently, and wasn’t grossly negligent. There is no assumption of fault on the customer part.

[0] https://www.legislation.gov.uk/uksi/2017/752/part/7/crosshea...

Thanks!

In the Swedish supreme court case I quoted above:

Background information:

- Sweden has a public personal identification number for every citizen (except for like 10k people with protected identities)

- The four main banks in Sweden have collaborated to create something called "Bank Id". It's often used as a secure authentication tool combined with the personal identification number (something you have - the cert in the mobile app, something you know - PIN or face id).

Someone convinced an elderly person over the phone to authorize the creation of a new Bank Id on the attacker's phone. This was fairly complicated and required the old person to use their physical RSA SecurID token. The court found that the elderly person had behaved reasonably well and that the attacker was very competent.

Still, the supreme court felt that the bank should have been more careful about letting strangers steal their money.

In the UK authorised push payment fraud, where customers are tricked into authorising payments to fraudster accounts has a similar smell to Swedish case you mention. Rulings by the regulators and courts have reached basically identical conclusions to the Swedish courts. Fs the customers acted in a reasonable manner, then it’s the banks failure, customers aren’t expected to become security and fraud experts just to access their bank accounts.

If you give your card and your PIN to somebody and that somebody steals from you, how can this be the bank's fault?

Presumably because the bank thinks that card and pin possession is sufficient to authorise all transactions regardless of personal circumstance.

As this case shows, this isn't always true.

Banks have an obligation to ensure that people can access and use their funds. This isn’t email, being unable to spend your own money has very serious consequences for people. It’s their duty to provide security measures that both ensure transactions are authorised correctly, and allow people reasonable access to their money.

If you’re house bound, entirely dependent on a trusted third party help for your day-to-day living, and your bank only provides a debit card and PIN facility to authorise your transactions, then what choice do you have but to share those credentials with a trusted third party so they can buy food for you?

The bank chooses the authentication mechanism, their customers don’t get a choice. If that mechanism doesn’t work as intended when faced with common and entirely reasonable living situations, that’s the banks failure, not the customers failure.

It's easy to pick on banks, but I really don't see what should the bank do here.

This is basically, it's bank's fault for having chosen their cheapest mechanism and not have changed anything. In the end, the bank could have provided a digital one off pin with a fixed amount fir the debit card. From a tech perspective this seems easy to implement and could have solved the casr, the bank just does not provide it.

It feels akin to giving someone a blank cheque you’ve signed. Crazy.

In most places a large number of aberrant transactions that don't match the historic spending patterns of an account would be enough to trip a security review, and a call to the account holder, temporary freeze, etc are low impact to false positives and highly effective at stopping fraud.

So yes, because we afford massive protections and rights to banks in exchange for the necessary but largely low-risk activity (holding cash then returning it in exchange for a fee) - laws holding them responsible for failing to prevent theft do exist.

I don't understand how the liability could lie elsewhere. I understand why the bank might want to tell a customer "someone else took your money. It sucks to be you", but it seems pretty clear cut that it's no different than the bank somehow misplacing funds for any other reason (at least as far as the customer is concerned. The bank's insurer presumably cares about the particulars of how they're misplacing money).

Not to mention they seem to have no problem treating it as "their" money while lending it out to other people, but as soon as someone tricks them into sending it to the wrong place, suddenly it was "your" money.

It reminds me of when I was a kid, my sister and I got two identical fish and couldn't disambiguate which was mine and which was hers. But when one of them died, she made sure to let me know that was my fish.

It is their money. You lent it to them when you made the deposit. All you now own is an admission from the bank that they owe you $x. The whole point of getting hacked is that the bank doesn't know it's not you, so of course they'll try to get out of refunding you.

There are some asterisks to this statement due to the large amount of regulation around bank accounts.

That would imply that if the bank loans me money, and then I deposit it into a fake/scam bank I can claim that I didn't know it's not them and get out of repaying the loan. But it doesn't work that way because I'm expected to do my due diligence. So should the bank.

Not knowing it's me just means they have to find a way to guarantee that knowledge. Because the failure to properly identify a client is the bank's not the client's.

>so of course they'll try to get out of refunding you.

Yes, in the same way that companies will often try to avoid honoring their warranties. That it's in their financial interest to do so doesn't mean they can just ignore their contract with you.

I always took the bank's sudden intense interest in my security as serving there concerns, not mine. Not only did it smell insincere and fishy, but it didn't make sense either. Why should I care so much for _their_ service? If they get scammed into giving all my money to someone else, that sounds very much like a _them_ problem, and not a me problem.

Even if it's caused by their incompetence, you'll have to sort it out if it happens, and they won't really care all that much.

At least here, their care isn't really optional. It's their responsibility, since it's their service. I think they have to prove it was through my own fault in order to brush it off, and that's difficult. Difficult enough that when I had to get my money back (lost due to fraud), they didn't ask more than a nominal set of questions.

Reply on news.ycombinator.com