RE: Status Update on W3C Security Work

I think that the question to ask here is 'who is in the best position to control this risk'.
 
Today the customer has very little ability to control their risk. That may change in the future.
 
I spent part of this morning dealing with the payment for the wire wheels for my MG that I bought on EBay a week ago. The seller received a phishing email minutes after the close of the auction. It occurred to me that if the seller had given their account info to the phishing gang they would probably think it was my problem even though they were the one who screwed up.


________________________________

	From: public-usable-authentication-request@w3.org [mailto:public-usable-authentication-request@w3.org] On Behalf Of Mary Ellen Zurko
	Sent: Monday, September 11, 2006 9:59 AM
	To: Thomas Roessler
	Cc: public-usable-authentication@w3.org
	Subject: Re: Status Update on W3C Security Work
	
	

	This story seems timely.  If consumers are going to hold institutions accountable for phishing losses, institutions are going to demand an infrastructure that they reasonable use to thwart phishing attacks. 
	
	          Mez
	
	Mary Ellen Zurko, STSM, IBM Lotus CTO Office       (t/l 333-6389)
	Lotus/WPLC Security Strategy and Patent Innovation Architect
	
	http://www.theregister.co.uk/2006/09/06/boi_refunds_phishing_victims/print.html 
	
	BoI to refund phishing victims 
	By Ciara O'Brien, ElectricNews.net 
	Published Wednesday 6th September 2006 08:02 GMT 
	
	Bank of Ireland has agreed to compensate victims of a recent phishing scam, backtracking from its earlier position. 
	
	The bank had initially refused to refund victims, who lost about EUR160,000 to scammers after receiving the fake emails. However, reports in the Irish Independent on Tuesday indicate that the bank has since had a change of heart. 
	
	For its part Bank of Ireland has refused to comment on the cases, releasing a general statement on phishing instead. 
	
	"Bank of Ireland is aware that there are fraudulent emails being circulated purporting to be from Bank of Ireland 365 online," it said. "Bank of Ireland can not discuss individual cases where a customer has received and responded to such an email." 
	
	It seems the banks just can't win. The nine customers who were conned out of the cash had threatened to sue the bank for compensation if their money wasn't returned. But now experts fear that there could be a surge in phishing cases, encouraged by the compensation paid out by Bank of Ireland. 
	
	Conor Flynn, technical director of Rits, said the move was essentially a goodwill gesture by the bank. However, he warned that people may feel less threatened by the scams in future as a result. 
	
	"It certainly will not help things," he said, speaking with ENN. "People will feel they have a buffer of security." 
	
	However, he also pointed out that banks may implement more technologies that will push the responsibility back on to the customers to safeguard their details and prove that they didn't reveal their confidential details to a third party. 
	
	"It's not a victimless crime," Flynn pointed out. "Banks still have to record record-profits. If they lose cash through compensating phishing victims, bank customers will pay." 
	
	However, despite the high profile coverage, phishing is not a unique problem to Bank of Ireland, something the bank is keen to point out. 
	
	"This problem is not unique to Bank of Ireland and similar fraudulent emails purporting to come from other banks, credit card companies, e-retailers etc are also in circulation," Bank of Ireland said in its statement. 
	
	Other financial institutions have warned customers of other phishing scams, including AIB and internet bank RaboDirect. eBay is also a popular target for scammers. 
	
	Copyright © 2006, ElectricNews.Net (http://www.electricnews.net/)