Legal Eye: Could you end up footing your e-crime bill?

The banks and building societies have just signed up to a new code. What the code has to say about online customers paying for fraudulent transactions on their accounts is worth reading carefully, says lawyer Duncan Pithouse.

The latest Banking Code issued by the British Bankers' Association took effect on 31 March. The code makes it possible for consumers to be held liable for their online losses if, for example, they have out of date antivirus software or fall for phishing scams.

Exclusive column: The Naked CIO

See what this CIO really thinks…

The Naked CIO: Crunch time for large projects

The Naked CIO: Boardroom stereotypes

The Naked CIO: IT staff disloyalty

The Naked CIO: Cut the bull

The Naked CIO: Animal farm

Now the internet is a primary tool for accessing services and buying goods, will the new Banking Code put consumers off the internet and dampen the growth of online trading?

Despite the widespread availability of security software and more sophisticated means of tracking and preventing internet fraud, e-crime is still rising.

The true cost of these attacks remains open to debate. Last December, analyst firm Gartner estimated losses from US phishing attacks at $3.2bn, whereas the Internet Crime Complaint Center put losses from internet crime reported to US authorities at $240m last year.

Either way, consumers and businesses continue to targeted by phishing, pharming and viruses. Phishing in particular, where members of the public are tricked into providing bank details or passwords by bogus emails, remains the method of choice for e-criminals.

Because most internet crime cases involve misuse of bank accounts and bank or credit cards, how banks treat losses to the customer's accounts is paramount to maintaining consumer confidence in online trading.

Essentially, the Banking Code will only make bank customers liable for losses on their account if they acted fraudulently or without reasonable care.

Failing to act with reasonable care can include anything from disclosing a PIN, not disposing of bank statements properly, accessing bank websites via unauthorised links in emails, or not keeping firewall or spyware protection up to date.

Banking Code:
Key issues

1. New UK Banking Code is now in force.

2. Customers are liable for losses on their accounts if they fail to act with reasonable care.

3. Failing to act with reasonable care includes not keeping antivirus software up to date, divulging PINs and failing to dispose of account documents securely.

4. The burden of proof to show failure to act with reasonable care lies with the banks.

Customers who prefer to use an account aggregation service - where multiple online accounts are accessed through a single portal or provider - could be most at risk. They will be responsible for losses on any of their accounts.

The Banking Code puts the burden of proof squarely on the banks' shoulders. The code, which all the major banks have signed up to, ensures the banks must prove the user has acted without reasonable care.

If the bank cannot show this, then the customer will have no liability for losses incurred via an online banking service.

Of course, how this new code will be applied remains to be seen. The approach taken by the Banking Code Standards Board to supervising the code will be of particular interest.

Defining reasonable care and allowing for genuine technical failures or inadvertent security breaches - particularly if the customer is banking on a work or public PC - will certainly test its application. But the principle of encouraging greater online vigilance by all parties is sensible.

In essence, the Banking Code does not represent a seismic shift in liability. It offers banks protection against the irresponsible behaviour of their customers and could end up giving customers greater confidence in using the internet.

DLA Piper is the world's largest global legal services organisation with more than 3,600 lawyers across 64 offices and 25 countries. Its award-winning technology, media and commercial practice employs 70 partners specialising in IT, telecomms, media, sport and IP law. Experts in convergence between the technology, communications and media sectors, it advises some of the world's leading multinational entertainment, media, sport and technology companies.