Internet advocacy group InternetNZ and the NZ Consumers' Institute have both come out swinging over the New Zealand Bankers Association's (NZBA) decision to allow victims of Internet banking fraud to be potentially held liable for losses.
Representatives from both institutions have met with the NZBA to voice their concerns about the new Banking Code of Practice, which essentially makes Internet banking users liable for fraud-related losses.
"Given how the Code is worded currently, someone whose Internet banking details are stolen could find themselves liable for any money taken from their accounts before they notice the transactions," says Jordon Carter, deputy executive director for InternetNZ.
"Someone whose computer is running a non-current operating system (for example a home PC running Windows 2000) could also be deemed to have non-compliant software, and therefore held liable for any losses," he added.
The new Code, according to the Consumers' Institute's Marc Wendleborn, "places too much responsibility on customers, while banks avoid their own security responsibilities".
"Online banking customers should be nervous," he said. "Some will lose money."
The Code, passed without yielding to the Institute's repeated requests for more clarity on the liability issue, will be challenged on several fronts.
First, it raises issues around privacy -- as some clauses suggest that the banks retain the right to inspect a victim's computer. "And if you don't allow this then they could hold you liable for any losses," Carter said.
Wendleborn describes this approach as "heavy-handed".
"The legality of these regulations in regards to the (NZ) Consumer Guarantees Act and the (NZ) Fair Trading Act remains to be seen," he said.
The Code needs, Wendleborn said, to provide better definitions of what "up to date" security software means if it wishes to judge fraud victims based on their choice of software.
The vagaries of the Code as it stands are endless.
"What is up to date?" Wendleborn asked. "Are we talking a day, a week, a month? Will people have the right to sue Internet security software manufacturers to recoup their lost savings? What happens if you log on at work and lose savings because the company does not have the latest software? Can you sue your work? Will certain Internet security programs be approved by banks and others not?"
James Turner, security consultant at IBRS research said that end-users shouldn't have to be security professionals.
"We shouldn't expect home users to be auditing their home computers for every application, checking the latest data on known vulnerabilities for each application, and taking the appropriate remedial action," he said.
During their recent discussions, the NZBA told the Consumers' Institute that the Code aims to "educate" consumers about the risks of online banking and the steps they could take to reduce those risks.
"We don't think this is the best way to achieve that," Wendleborn said. "We see a significant difference between educating people about Internet security and making them liable for Internet fraud."
Both InternetNZ and the Consumers' Institute are seeking changes to the Code. Carter is currently preparing some concrete suggestions for ways of improving the Code to "give a fairer balance between the responsibilities of bank customers and those of the banks themselves".
The Consumers' Institute wants the NZBA to clearly spell out the liability issue.
"We say that customers should only be liable for the things they can reasonably control," Wendleborn said.
Carter is hoping a vocal New Zealand public might force change.
"The banks are naturally concerned with their public reputation and if the public don't accept the Code as it is, then they would be wise to change it," Carter said. "We hope the banks will accept the sorts of changes that will ease the public concerns that have been raised by the Code as it stands today."
But Wendleborn predicts that it will take a few innocent users being stripped of their money before any major "public backlash" will ensue.
"The banks need to take responsibility for the security of their products," he said. "Banks provide a service. If they are not prepared to back the quality of that service, they shouldn’t be offering it."
These regulations effectively say "we're not liable unless we decide to be", he said. They give banks a convenient, "all-encompassing" out.
"The NZBA says the banks will consider issues on a case by case basis and will do what is reasonable. But reasonable to whom? This puts all the power in the hands of the banks to determine what is fair," Wendleborn said.
"We say it's not acceptable for banks to effectively tell customers that their money might be there today but, through no fault of their own, it may not be tomorrow."
This is rediculous. I back the bank on this. It doesn't matter HOW secure the bank makes their product. They could increase it's security 100000 fold, however if some idiot manages to get their home computer infected with a trojan, that security implemented on the service providers end doesn't mean dick. People need to grow up and at least start to take some responsibility when they continue to live an un-eduacated life from a technical perspective.