Hackers | General financial discussion | Discussion forum

Rick said
Good eye-opening story
https://www.cbc.ca/news/business/banks-deny-compensation-online-fraud-security-1.5322982?fbclid=IwAR0OB3Z79uDPTRx8_JIGGpa-dFvAAdSctOJ6l3Lp8_AaFZCmehXo2ev-s_U  

Sounds like he had inadequate malware protection on his computer ... no ?

2FA seems to be beyond banking capabilities. I've brought it up with my local credit union and all I get is a blank stare and "we'll look into it".

I forgot to add that to the Hubert survey. Darn.

Bill said
Article said "his claim was denied because the transaction was authorized from an internet address where he has 'extensive history'". I don't know much about this kind of stuff but isn't that kind of an important tidbit that CBC could have pursued?  

Maybe it's suspicious, but this is a case where more than just examining IP addresses is warranted. The bank should've sought a subpoena for surveillance camera imagery. The legal cost of such diligence, though, is likely prohibitive, so they should just award compensation, without prejudice or precedent, to the customer in keeping with good business practices. If this reoccurs, then potentially, higher due diligence would be warranted if the customer is trying to defraud the bank.

Cheers,
Doug

Doug said

Maybe it's suspicious, but this is a case where more than just examining IP addresses is warranted. The bank should've sought a subpoena for surveillance camera imagery. The legal cost of such diligence, though, is likely prohibitive, so they should just award compensation, without prejudice or precedent, to the customer in keeping with good business practices. If this reoccurs, then potentially, higher due diligence would be warranted if the customer is trying to defraud the bank.

Cheers,
Doug  

Doug , what camera footage are you referring to ?

If someone has been careless enough to get malware or a key logger on to their PC and the hacker can get in and use login credentials from that IP address (spoofed or otherwise), how is that the bank's problem?

People have to take responsibility for their own device's security.

Norman1 said
IP addresses cannot be spoofed for a two-way connection like that used by online banking. If the real originating IP address isn't set in the packet, the responding packets will end up being routed to the computer at the fake originating IP address specified.

Kind of like leaving a voicemail requesting credit card information and not leaving one's real phone number for the victim to call back.

To the bank, whoever did the transactions had the client's banking id and password. The perpetrator also had access to the client's internet connection, at work or home, the client had used many times before for transactions that were not disputed.   

Surprised that you didn't continue on to say (nor did the CBC article) that the unspoken inference here is that somebody else in his house did it using his computer, either with or without his knowledge (or maybe someone at work, they don't provide that level of detail)

Norman1, in your scenario the "friend" (!) still would have to know his logon id and password. Unlike CBC, I'm guessing this guy gave someone that info so they could rob a bank together but I could be wrong.

That was the point of my original post, i.e. that CBC puts its usual innocent little guy vs big bad corporation spin on it while at the same time hinting but not pursuing that there's more to the story. I've heard there are lots of cases (e.g. credit card fraud) where the fi (more to the point, its other customers who pay more fees, interest, etc to make up the losses) ends up taking the loss, so I'm guessing these cases where the customer is held liable are relatively rare and for where there's probably good reason. Of course all you have to do then is go to the media, as this person did, and the fi will pay you off to minimize bad publicity.

Why has Dean changed his name to Selkirk?
He must really like Hubert a lot.

Bill said
Norman1, in your scenario the "friend" (!) still would have to know his logon id and password. Unlike CBC, I'm guessing this guy gave someone that info so they could rob a bank together but I could be wrong.
…

The "friend" definitely had his banking ID and password. It is always in the bank's mind that the complaining customer could be complicit.

But, there's also the possibility that his ID and password were sniffed. The household may have a family computer used by everyone. Everyone, including his kids and the classmates of the kids when they came over, used the same account with full administrator privileges!

The "friend" slipped in a keylogging program on that computer that captured all the keyboard activity and quietly sent the captured activity periodically to a web server. Among the captured activity was the victim's logins to online banking.