[LINK] Liability for Internet Banking (was Re: Suncorp security (Alan L Tyree)

[Alan L Tyree]

On Mon, 19 Feb 2007 10:44:36 +1100
Antony Barry <tony at tony-barry.emu.id.au> wrote:

> > From: Stewart Carter <mail at ecommercereport.com.au>
> > Date: 19 February 2007 10:21:32 AM
> > To: link at anumail0.anu.edu.au
> > Subject: Liability for Internet Banking (was Re: Suncorp security  
> > (Alan L Tyree)
> >
> >
> > Dear Linkers,
> >
> > I've been absent from your discussions for a while on other duties.
> >
> > I'd be grateful if Alan ( or any other Linkers) could give me a  
> > clue which
> > way ASIC is going to jump in its current review of the EFT code,  
> > specifically
> > in connection with liability for Internet banking.
> >
> > I ask because Alan is a distinguished expert on these matters and  
> > currently,
> > Internet banking (as I understand it - IANAL)  terms and conditions
> > typically place the onus of liability on the consumer.
> >
> > That is, the onus is on us as users to have whatever security and/ 
> > or operating system software
> > and/or browser software the bank specifies.
> >
> > And even then, we're still liable for losses resulting from, for  
> > example, phishing attacks.
> >
> > Seems unfair.

There are several different scenarios:

Business account - Terms and conditions rule. Some of them are very
unfair and, indeed, might be challenged in various ways. Not easy and
not cheap.

Consumer accounts: If your financial institution does not subscribe to
the EFT Code of Practice, then the situation is the same. All banks,
building societies and credit unions (there may be one minor exception
- can't remember) subscribe to the Code. 

Consumer accounts subject to the EFT Code of Practice: the situation is
much different. Liability for unauthorised transactions depends upon
who is at "fault". You can be at fault by being "careless" in various
ways in the keeping of your access codes. If fault cannot be found
anywhere you are liable for the first $150, the bank for the remainder.

If you are at fault (as defined in the Code), you are liable for losses
within the daily limit until such time as you notify of loss of
card/pin/other access.

Phishing, disclosure under threat, and other similar problems are
interesting. The Code does not address them directly, but the Banking
Ombudsman has consistently held that these are not voluntary
disclosures and so the consumer is not at "fault".

ASIC is reviewing the Code and is calling for submissions on their
discussion paper at the present time. My own view is that ASIC is still
"consumer friendly" and it is unlikely that they will change the Code
to make consumers liable for phishing, for unsecure computers (at least
if the customer doesn't know), or for any of the other more outrageous
suggestions that have appeared.

The main problem for the immediate future is that many new players will
be offering electronic financial services. They are unlikely to
subscribe to the Code willingly. The banks didn't do it willingly
either, but it was subscribe or face legislation. I don't have any idea
how this problem will play out.

Thanks for the "distinguished": I can hardly wait to remind my wife :-)

Cheers,
Alan


> >
> > Stewart Carter
> > Stewart Carter
> > eCommerce Report
> > www.ecommercereport.com.au
> > Ph 0433 142 419 Fax 0433 142 420 mail at ecommercereport.com.au
> > Skype: hscarter
> >
> > Note: If you'd prefer not to receive further emails from us please  
> > send a return email with the words delete or remove
> > in the subject header or body of the email.
> 
> phone : 02 6241 7659 | mailto:me at Tony-Barry.emu.id.au
> mobile: 04 1242 0397 | mailto:tony.barry at alianet.alia.org.au
> http://tony-barry.emu.id.au
> 
> 
> _______________________________________________
> Link mailing list
> Link at mailman.anu.edu.au
> http://mailman.anu.edu.au/mailman/listinfo/link
> 


-- 
Alan L Tyree                    http://www2.austlii.edu.au/~alan
Tel: +61 2 4782 2670            Mobile: +61 427 486 206
Fax: +61 2 4782 7092            FWD: 615662