The issue of who pays when a customer’s on-line access to bank accounts is compromised has been simmering ever since on-line banking began. Banks have, understandably, been exceedingly reluctant to accept liability when a customer’s electronic banking identity and password are compromised and money disappears from their accounts. Financial institutions have spent heavily to prevent the establishment of any precedent that would result in banks being on the hook for cybercrime losses. Until now, no court in the U.S. has actually found any financial institution liable in such a case.

However, recent news reported in Computerworld Security (http://www.computerworld.com/s/article/9137451/Court_allows_suit_against_bank_for_lax_security) chronicles a decision by an Illinois District Court to allow such a lawsuit against Citizens Financial Bank to proceed to trial.  You can see another view of this case at darkreading.com (http://www.darkreading.com/database_security/security/attacks/showArticle.jhtml?articleID=220100950).

This incident is a good example of how angry cybercrime victims are and how nervous banks are. In this case, someone acquired the customer’s account name and password and used them to steal $26,000 from the customer’s home equity line of credit.  Unless a pre-trial settlement is reached, the bank will obviously spend many times that amount to defend itself in court and avoid setting a costly precedent.

The victims in this case are not alleging that the bank violated its cyber security policies, or even that the bank was the source of the name/password leak. They are alleging that the bank was negligent for not providing stronger protection against cybercrime. Specifically, the victims assert that the bank should have offered “two-factor authentication”, which relies not only on what the user knows (ID and password) but what the user has (a security token).

Unfortunately, even two-factor security is no longer any guarantee that on-line access to bank accounts is secure, as reported in this ZD-Net article (http://blogs.zdnet.com/security/?p=4402.)

InterComputer’s solution utilizes three-factor authentication (plus an “out of band” protocol) as just one part of one of the seven layers of protection built into every application.  Nevertheless, the true value of InterComputer’s profound technological superiority to current industry practices is that it is insurable. Underwritten Insurance against financial loss, lost business, and third party liability from cybercrime will allow bank information security officers (and their customers) to sleep well at night.

If you were the bank’s chief security officer, which solution would you choose: one that promised tough security only, or one that delivered cutting-edge, patent-pending security along with an insured guarantee?