Britain’s most senior police officer has been accused of attempting to shift blame on to victims of online fraud after he suggested consumers should not be refunded by banks if they fail to protect themselves from cybercrime.



Sir Bernard Hogan-Howe, the Metropolitan police commissioner, said customers who had fallen foul of online fraudsters were being “rewarded for bad behaviour” instead of incentivised to update anti-virus software and improve passwords.



His comments in the Times come as police brace themselves for an expected surge in overall crime figures when cybercrime estimates are included in official statistics for the first time in July.

But the commissioner’s comments were met with an immediate backlash from consumer groups, victims’ rights groups and digital security experts.

“With online fraud increasing, this is an astonishingly misjudged proposal from the Met police commissioner,” the executive director of Which?, Richard Lloyd, said.

“When Which? investigated last year, we found too often that banks were dragging their feet when dealing with fraud. The priority should be for banks to better protect their customers, rather than trying to shift blame on to the victims of fraud.”

Two in five (44%) UK consumers have been subject to cybercrime in their lifetime, according to a survey released in 2015. However, 42% do not take the time to change their account passwords after a security compromise or break, the Norton Cybersecurity Insights report found.

Discussing how banks could make people more security-conscious, Hogan-Howe said: “That’s one thing to consider. If you are continually rewarded for bad behaviour you will probably continue to do it but if the obverse is true you might consider changing behaviour.



“The system is not incentivising you to protect yourself. If someone said to you: ‘If you’ve not updated your software I will give you half back,’ you would do it.”

Sir Bernard Hogan-Howe. Photograph: Jonathan Brady/PA

The Met later attempted to clarify the commissioner’s position, arguing it was wrong to interpret his comments as a proposal that fraud victims should not be compensated.

The force said his remarks focused on consumers who did not take basic precautions such as adequate password precaution and security measures, not a blanket proposal for all online fraud victims.

Nicola Davies, a company director from Uley, Gloucestershire, was defrauded of more than £1,000, all of which was refunded by her bank, Santander. She said the bank was “brilliant” at spotting the fraud before she knew herself and thinks the current system works. She said consumers could end up having to try to prove they were not to blame and that it was a company or organisation’s fault that their details were stolen.

“The banks are brilliantly set up for this, they monitor your spending behaviour and their computers know immediately if something isn’t right, or are alerted if the additional security questions aren’t answered correctly,” she said.

“They are much better placed to spot it quickly, mine was a credit card account and I wouldn’t have checked it till the month after.

“They saw it within hours. It’s not me shirking my responsibilities, I take internet security seriously, but I can’t always protect myself against an army of online fraud experts. I’m reassured that my bank can.”

James Daley, of Fairer Finance, a consumer group focused on banks and insurers, told the Times that removing the burden of responsibility to compensate customers would discourage banks from investing in security.

“The stakes are too high for most people – anyone who forgot to update their security could lose their life savings. But for the banks each fraud is only a minute proportion of their profits.”

The home secretary, Theresa May, warned an international policing conference on Wednesday that faceless crime was being conducted over the internet on an “industrial scale”.

Last year it was revealed that police follow up fewer than one in 100 frauds and there were fewer than 9,000 convictions out of more than 3m frauds in 12 months.

GCHQ estimates that 80% of cybercrime, which is thought to cost £1bn a year, could be prevented by better passwords and regularly updated security software.

The National Fraud Intelligence Bureau (NFIB) provides intelligence to law enforcement officials in an effort to catch criminals. It sits alongside Action Fraud, which is the UK’s national reporting centre for fraud and cybercrime.

Polly Sprenger, counsel at Eversheds who specialises in corporate and economic crime, said: “The commissioner seems to be saying that responsibility for this criminality lies not with the criminals or the police forces properly resourced to combat them, but on consumers and banks.

“This is a tacit admission that Action Fraud and the National Fraud Intelligence Bureau now see their primary role as educating consumers and businesses about the fraud threat, rather than what we expect them to do, which is take action against criminals.

“The real reason cybercriminals are so active is that police forces, hamstrung by the inefficiencies introduced by Action Fraud and the NFIB, are not a credible deterrent.”

Lucy Hastings, director at the independent charity Victim Support, said: “We know from our experience of reaching out to thousands of fraud victims every year that many never come forward because they feel ashamed or embarrassed that they have fallen victim to fraud. Unfortunately, these comments only serve to reinforce these perceptions and may further discourage people from seeking help.

“Victims of fraud are not to blame for the crime and the losses they have suffered. Fraud can have devastating emotional as well as financial effects, leading to victims feeling vulnerable, violated, and isolated. Victims should never feel ashamed to come forward and they deserve to be treated with respect and to receive the support they need.”



David Rogers, who owns the mobile security company Copper Horse Solutions, said: “I think the Met chief’s comments are shortsighted. There are many reasons consumers are defrauded and a lot of those are not really things that they can control.”

He added: “The banks are doing a good job in a difficult environment but they are ultimately responsible for identifying and preventing fraud issues when they occur.”