Journal of Cybersecurity, 3(2), 2017, 109–125 doi: 10.1093/cybsec/tyx011 Research paper Research paper International comparison of bank fraud reimbursement: customer perceptions and contractual terms Ingolf Becker,1,* Alice Hutchings,2 Ruba Abu-Salma,1 Ross Anderson,2 Nicholas Bohm,3 Steven J. Murdoch,1 M. Angela Sasse,1 and Gianluca Stringhini1 1Computer Science Department, University College London, Gower Street, London WC1E 6BT; 2 University of Cambridge Computer Laboratory, 15 JJ Thomson Avenue, CB3 0FD; 3Foundation for Information Policy Research *Corresponding author: E-mail:
[email protected] Received 7 May 2017; accepted 17 November 2017 Abstract The study presented in this article investigated to what extent bank customers understand the terms and conditions (T&Cs) they have signed up to. If many customers are not able to understand T&Cs and the behaviours they are expected to comply with, they risk not being compensated when their accounts are breached. An expert analysis of 30 bank contracts across 25 countries found that most contract terms were too vague for customers to infer required behaviour. In some cases the rules vary for different products, meaning the advice can be contradictory at worst. While many banks allow customers to write Personal identification numbers (PINs) down (as long as they are disguised and not kept with the card), 20% of banks categorically forbid writing PINs down, and a handful stipulate that the customer have a unique PIN for each account. We tested our findings in a survey with 151 participants in Germany, the USA and UK. They mostly agree: only 35% fully understand the T&Cs, and 28% find important sections are unclear.