Re: Status Update on W3C Security Work

This story seems timely.  If consumers are going to hold institutions 
accountable for phishing losses, institutions are going to demand an 
infrastructure that they reasonable use to thwart phishing attacks. 

          Mez

Mary Ellen Zurko, STSM, IBM Lotus CTO Office       (t/l 333-6389)
Lotus/WPLC Security Strategy and Patent Innovation Architect

http://www.theregister.co.uk/2006/09/06/boi_refunds_phishing_victims/print.html

BoI to refund phishing victims
By Ciara O'Brien, ElectricNews.net
Published Wednesday 6th September 2006 08:02 GMT

Bank of Ireland has agreed to compensate victims of a recent phishing 
scam, backtracking from its earlier position.

The bank had initially refused to refund victims, who lost about ?160,000 
to scammers after receiving the fake emails. However, reports in the Irish 
Independent on Tuesday indicate that the bank has since had a change of 
heart.

For its part Bank of Ireland has refused to comment on the cases, 
releasing a general statement on phishing instead.

"Bank of Ireland is aware that there are fraudulent emails being 
circulated purporting to be from Bank of Ireland 365 online," it said. 
"Bank of Ireland can not discuss individual cases where a customer has 
received and responded to such an email."

It seems the banks just can't win. The nine customers who were conned out 
of the cash had threatened to sue the bank for compensation if their money 
wasn't returned. But now experts fear that there could be a surge in 
phishing cases, encouraged by the compensation paid out by Bank of 
Ireland.

Conor Flynn, technical director of Rits, said the move was essentially a 
goodwill gesture by the bank. However, he warned that people may feel less 
threatened by the scams in future as a result.

"It certainly will not help things," he said, speaking with ENN. "People 
will feel they have a buffer of security."

However, he also pointed out that banks may implement more technologies 
that will push the responsibility back on to the customers to safeguard 
their details and prove that they didn't reveal their confidential details 
to a third party.

"It's not a victimless crime," Flynn pointed out. "Banks still have to 
record record-profits. If they lose cash through compensating phishing 
victims, bank customers will pay."

However, despite the high profile coverage, phishing is not a unique 
problem to Bank of Ireland, something the bank is keen to point out.

"This problem is not unique to Bank of Ireland and similar fraudulent 
emails purporting to come from other banks, credit card companies, 
e-retailers etc are also in circulation," Bank of Ireland said in its 
statement.

Other financial institutions have warned customers of other phishing 
scams, including AIB and internet bank RaboDirect. eBay is also a popular 
target for scammers.

Copyright © 2006, ElectricNews.Net (http://www.electricnews.net/)