“Banks are committed to keeping their customers’ money safe and will protect customers from Internet fraud as long as they have acted with reasonable care,” APACS says on its Bank Safe Online web site. “Customers must also take sensible precautions however so that they are not vulnerable to the criminal. Each case of Internet fraud is different and you can be sure that the bank will make a full investigation in the unlikely event that money is withdrawn from your account”

The American Banking Association, the industry group for the U.S. banking industry, is more definitive in its reassurance to customers on phishing losses. “Consumers are protected against losses,” the ABA says on its web site. “When a customer reports an unauthorized transaction, the bank will cover the loss and take measures to protect your account.”

But there have been exceptions. Last year Miami business owner Joe Lopez sued Bank of America after it refused to cover $90,000 in phishing losses. Lopez’ computer was infected by a keylogging trojan, which captured his login details. His funds were soon transferred to a bank in Latvia. When Bank of America refused to cover the loss, Lopez sued for negligence, saying the bank failed to warn him about the trojan.

Where will the line be drawn between the bank’s responsibility and the customer’s? The handful of existing cases leave the issue unsettled, but suggest that the quality of the banks’ phishing defenses will be a key point in the debate, and that in practice banks will not be able to pass on the financial risk of phishing to its customers simply through careful writing of the customer agreement, as the customer has no direct influence over the anti-phishing measures the bank takes.

Declaration of interest: Netcraft provides a suite of anti-phishing services, including antiphishing toolbar, security testing, alerting and countermeasures for financial institutions.