Criminal attacks on internet banking

The large banks conduct 20 million Internet transactions every month. During 2005, ten online attacks successfully gained access to customers' accounts in Sweden. In 2006 the number of successful attacks increased to just under 300 and the perpetrators gained access to over SEK 8 million.

The banks deem the risk for attacks to be increasing and that criminal activity is becoming more advanced. Continued attacks could affect confidence in the banks' services, which in turn could affect the efficiency of the financial system if consumers choose to return to manual services. Such a development would not be beneficial for any of the parties involved.

It is FI's assessment that the attacks on online accounts currently do not represent a threat to the stability of the financial system. The larger actors have the financial resources needed to handle the risks associated with online banking. An increase in the number of attacks can, however, weaken confidence in the market as a whole. It is therefore in the best interest of both the general public and companies to limit the attacks. FI does not intend to regulate which security solutions companies should have, but will carefully monitor developments
on the market and analyse the risks.

Companies that offer online financial services should clearly inform customers
about:

• The risks associated with the internet
• Which security solutions have been chosen and why
• The customer's need for protection
• Who is responsible when damages occur

Even if banks have to a large extent reimbursed customers victimized by fraud, it is questionable how much longer this type of customer-friendly attitude will responsibility for online attacks and there currently are extensive disclaimers in agreements between companies and customers. FI believes that the banks should carry primary responsibility and will actively pursue this line in the future.

Read more