Payment redirection fraud – who does (and who should) bear the loss in fraudulent banking transactions, and is Australia’s electronic banking system fit for purpose?

This article has been accepted for Publication in IEEE Xplore and is © IEEE.

The banking system is part of Australia’s critical infrastructure, and integrity and trust in transactions is essential to our financial system. This paper describes the losses incurred by victims of payment redirection fraud due to cyber events and email scams, and the difficulties they face in recovering what are often very substantial losses. It argues that present levels of cybercrime in conjunction with the adoption of electronic banking in its present form has effectively transferred the risk of fraud in banking transactions from banks to the community. The article explores whether it is realistic to expect that Australian individuals and businesses have sufficient cybersecurity resources or knowledge to protect themselves from cyber risk and email fraud at a time when cybercrime is prevalent and perpetrated by organised crime, but education is neither widespread nor comprehensive.

The article analyses victims’ legal rights in cases involving business email compromise and other scams, and concludes that customers and others caught up in fraudulent transactions have little practical legal recourse against the criminals responsible or banks who could do significantly more to prevent scams from succeeding. While Australian banks are best placed to introduce greater protections for customers, they have not implemented measures used by banks elsewhere, and they also resist legal responsibility for their customers’ losses of this nature.  The paper argues that it is not realistic to expect that individual customers bear the burden of either knowledge of or investment in this area and that present electronic banking arrangements leave the community, and particularly vulnerable consumers of banking services, exposed to serious financial loss.