W3C home > Mailing lists > Public > public-usable-authentication@w3.org > September 2006

RE: Status Update on W3C Security Work

From: Dan Schutzer <dan.schutzer@fstc.org>
Date: Mon, 11 Sep 2006 10:12:28 -0400
To: "'Mary Ellen Zurko'" <Mary_Ellen_Zurko@notesdev.ibm.com>, "'Thomas Roessler'" <tlr@w3.org>
Cc: <public-usable-authentication@w3.org>
Message-ID: <E1GMmWf-0000L3-K7@aji.w3.org>
agreed

 

  _____  

From: public-usable-authentication-request@w3.org [mailto:public-usable-authentication-request@w3.org] On Behalf Of Mary Ellen Zurko
Sent: Monday, September 11, 2006 9:59 AM
To: Thomas Roessler
Cc: public-usable-authentication@w3.org
Subject: Re: Status Update on W3C Security Work

 


This story seems timely.  If consumers are going to hold institutions accountable for phishing losses, institutions are going to demand an infrastructure that they reasonable use to thwart phishing attacks. 

          Mez

Mary Ellen Zurko, STSM, IBM Lotus CTO Office       (t/l 333-6389)
Lotus/WPLC Security Strategy and Patent Innovation Architect

http://www.theregister.co.uk/2006/09/06/boi_refunds_phishing_victims/print.html 

BoI to refund phishing victims 
By Ciara O'Brien, ElectricNews.net 
Published Wednesday 6th September 2006 08:02 GMT 

Bank of Ireland has agreed to compensate victims of a recent phishing scam, backtracking from its earlier position. 

The bank had initially refused to refund victims, who lost about €160,000 to scammers after receiving the fake emails. However, reports in the Irish Independent on Tuesday indicate that the bank has since had a change of heart. 

For its part Bank of Ireland has refused to comment on the cases, releasing a general statement on phishing instead. 

"Bank of Ireland is aware that there are fraudulent emails being circulated purporting to be from Bank of Ireland 365 online," it said. "Bank of Ireland can not discuss individual cases where a customer has received and responded to such an email." 

It seems the banks just can't win. The nine customers who were conned out of the cash had threatened to sue the bank for compensation if their money wasn't returned. But now experts fear that there could be a surge in phishing cases, encouraged by the compensation paid out by Bank of Ireland. 

Conor Flynn, technical director of Rits, said the move was essentially a goodwill gesture by the bank. However, he warned that people may feel less threatened by the scams in future as a result. 

"It certainly will not help things," he said, speaking with ENN. "People will feel they have a buffer of security." 

However, he also pointed out that banks may implement more technologies that will push the responsibility back on to the customers to safeguard their details and prove that they didn't reveal their confidential details to a third party. 

"It's not a victimless crime," Flynn pointed out. "Banks still have to record record-profits. If they lose cash through compensating phishing victims, bank customers will pay." 

However, despite the high profile coverage, phishing is not a unique problem to Bank of Ireland, something the bank is keen to point out. 

"This problem is not unique to Bank of Ireland and similar fraudulent emails purporting to come from other banks, credit card companies, e-retailers etc are also in circulation," Bank of Ireland said in its statement. 

Other financial institutions have warned customers of other phishing scams, including AIB and internet bank RaboDirect. eBay is also a popular target for scammers. 

Copyright © 2006, ElectricNews.Net (http://www.electricnews.net/)
Received on Monday, 11 September 2006 14:12:52 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 2 June 2009 18:34:14 GMT