Customer did not take reasonable care by leaving his computer unattended while logged into internet banking

Categories:

Fraud & scams, Bank accounts,

Summary:

In August 2023, Allan learned that one of his employees had transferred $600,000 out of his business and personal accounts over a six-year period. The employee was not an account holder to any of the accounts. Allan said the bank should reimburse him because he believed each payment had required its own two-factor authentication code. He said it considered it safe to leave the employee in an active internet banking session because the bank would send two-factor authentication text codes to his mobile phone for each payment she tried to make that exceeded $1,000. He also said the bank’s publicly available information about authentication codes was misleading.

Published:

November 2026

Our investigation

We learned that Allan would log in to internet banking, and his employee would submit payment instructions to the bank. He would then enter the two-factor authentication code on his mobile phone to authorise the first payment within an internet banking session. After that, he left the employee alone with access to the same active internet banking session, and she would then transfer money to herself without any further requirement for authentication codes. The bank’s terms and conditions required customers not to leave their computer unattended while logged in to internet banking. By allowing his employee to remain in an active session unsupervised, Allan did not take reasonable steps to keep his banking secure, and thus did not meet his responsibility to protect his banking. As a result, the bank did not have to reimburse the unauthorised transfers.

Allan said the bank’s website was misleading about when authentication codes were needed, and that the website said every payment exceeding $1,000 required a code. We found the bank had a separate webpage that said further codes would not be needed once a code was entered during a current internet banking session. We did not find the information on the bank’s website, or the codes themselves, to be misleading.