Some lawsuits are frivolous, but most are not. If industry practices, the government, or any other combination of factors makes it impossible for you to avoid some kind of loss, your only recourse may be to file a lawsuit.
I was reminded of this principal recently when I learned a couple in Illinois recently sued their bank for failing to secure their account from identity thieves. The bank tried to quash the lawsuit, but an Illinois district court judge recently issued a ruling allowing it to proceed. And for once, I agree. The lawsuit is definitely not frivolous.
Here's what happened, according to the allegations in the lawsuit:
In February 2007, an intruder obtained online access to the wife's Citizens Financial banking account using her user name and password. The intruder authorized an electronic transfer of US$26,500 from the couple's line of credit to the wife's business account. Next, the intruder initiated a transfer of the funds to an Austrian bank.
When the couple realized what had happened, they contacted Citizens Financial and requested the money be returned. The bank refused and suggested that they contact the bank in Austria. But, the Austrian bank also refused to return the money.
Shortly thereafter, Citizens Financial began billing the couple pay off the line of credit. When they failed to pay, the bank reported them as delinquent to national credit reporting agencies. The bank also threatened foreclosure proceedings against their home. These threats stopped once the couple began making monthly payments to the bank for the stolen funds.
Under the circumstances, the couple felt they had no option except to file a lawsuit against the bank. Among other claims, the lawsuit alleges negligence under Illinois law. According to the lawsuit, the bank didn't use the best available technology to protect its depositors, leaving the account vulnerable to identity fraud.
This is a situation in which a legitimate account holder really can't control. It's remarkably easy for an identity thief to plant a "backdoor" program on your computer. From that point, the program records every keystroke on your PC. Periodically, it sends a report to the thief. In the couple's case, the program apparently recorded the log on information to their bank account. Once the thief had this information, initiating the US$26,500 theft was easy.
The only solution to the problem is for banks that offer online access to make it impractical for identity thieves to impersonate legitimate account holders. There are numerous technologies available to make this possible. However, unless banks are held legally accountable for these types of losses, they have little incentive to introduce this technology.
This is the model the credit card industry uses, and it works. If someone steals your credit card number, you're only responsible for paying the first $50 of any fraudulent purchases made on it. Credit card fraud is a problem, but the cost is borne by credit card companies—and even more, by merchants.
This illustrates an important security principle. The person or entity most able to reduce a security risk should be responsible for dealing with it. In this case, the couple had no way to mitigate the security of their account. Only the bank had the ability to do so, and it allegedly failed in this obligation.
However, the banking industry has a long way to go before it accepts this business model. But they must do so, if only because they are the only possible solution to this type of identity theft.
Fortunately, there are steps you can take to deter hackers from emptying your online account:
- Disable online access to your account if you don't require it.
- Avoid using unsecured wireless Internet networks. Ideally, you should only log onto a network using a virtual private network (VPN) such as Cryptohippie (http://www.cryptohippie.com)
- Avoid responding to "security alerts" or similar messages from your bank that require you to disclose account information.
- Use an anti-virus program that's continuously updated to new malware threats.
- Don't allow your browser to save your password or personal information, or create an online profile that includes your credit card or banking information
- Don't save passwords on your computer in an unencrypted file.
Update: Most lawsuits filed by customers who lose money in their online accounts to hackers are adjudicated according to state law. These laws vary greatly in determining the level of security an online bank or credit union must provide its customers. For instance, in June 2011, a Michigan court held Comerica Bank liable for losses exceeding $500,000 in a 2009 hacker theft. But in August, 2011, a Maine district court judge ruled that compliance with federal bank security guidance requires banks to protect accounts with little more than passwords and secret questions.
Copyright © 2009 by Mark Nestmann
(An earlier version of this post was published by The Sovereign Society, https://banyanhill.com/)
