When Bristol resident Sarah Neville got an email from her carpentersaying that he’d had a cancellation and he could start her long-discussed home renovations, it didn’t arouse the slightest suspicion. Emails had gone back and forth, and when he asked her to pay a £1,500 deposit she quickly went online and made the payment direct into his bank account. It was only when he failed to turn up that the truth emerged – his email had been hacked and the bank account into which she had paid the money wasn’t his.
Neville is one of the hundreds of thousands of people who have lost money to fraudsters in recent years, a victim who quickly found out that the reassurances given when you sign up to online banking are worth nothing. On Monday RBS’s Ross McEwan caused a storm when he claimed that it is not banks’ responsibilityif customers are defrauded in such circumstances. The bank boss – who as part of his role also runs the NatWest brand, which has 24 million retail customers – said he didn’t think the bank had “a duty of care” to victims. They should accept the blame and not expect automatic refunds, he argued.
It’s hard not to conclude that the 5,000 of his customers who were conned out of £25m during nine months in 2015 – and anyone else who has similarly been defrauded – should be furious. Most bank customers are unaware of a major flaw in online bank transfers that has allowed the fraudsters to get away with these scams – unchecked by McEwan and his colleagues.
Log on to make an online bank transfer and you are asked for the account number, the sort code, and the account holder’s name. What you won’t know is that the name is irrelevant. You can put any name on the transfer – try Mickey Mouse – and the payment will still go through. This, and the advent of the faster payments system, which allows stolen money to be moved through various accounts unchecked in minutes, has enabled fraudsters to get away with it. The banks have long known this is going on but have done nothing to stop it.
The banks are only required to refund victims for any payments that are “unauthorised”. Victims question how a payment can be considered authorised if it goes to a different person. But the banks’ default position is to assume the victim has acted in a grossly negligent manner – a stance that has been backed by the regulator, the Financial Conduct Authority.
In 2016 the then home secretary Theresa May announced a taskforce to crack down on bank fraud, noting that it “shames our financial system”. While reforms are in train, meaningful change is probably still years away.
The other big failure is the banks’ inability to spot these frauds, which are perpetrated through accounts they manage. Staff who can spot a fake credit card transaction in seconds do nothing if £20,000 is paid into an account that may have been dormant for years. If you as a consumer try to report an account you believe is being used by fraudsters, you’ll be met with disdain, or the Data Protection Act.
Why does this failure happen? The bank is on the hook for credit card losses, but not most bank frauds. Financial fraud cost £2m a day in 2016, with older people disproportionately hit, but until more people follow Ross Anderson’s lead, McEwan and the wider banks sector will continue to pass the buck.
Anderson, a professor of security engineering at the University of Cambridge, and one of Britain’s foremost experts on cybersecurity, says he has never banked online – and has no plans to do so. He believes that system has become so weighted in favour of the banks that it is now the customers that carry all the risk. If a man who has chronicled the rise of online banking won’t use it, what hope is there for the rest of us?
• Miles Brignall covers consumer issues for the Guardian
source:-theguardian
