| Banks should be liable, there is often insufficient ways to validate who you're transferring money to. Sometimes the bank interface will tell you name and address, after you type in numbers, but who validates this? My bank (in Denmark) sometimes sends me emails from an domain that isn't their primary domain. The bank uses a login system that is provided by the state. In theory it's a good idea, but you sign-in on domains that are not owned identity authority. Like I sign-in on the bank website, instead of sign-in by redirecting from the bank to a trusted domain owned by the identity authority (how like OIDC flows usually work). Sure the login flow still involves an app, but my point is: There is a lot of bad practices around. These should incur liability. Just start looking at what domains emails are sent from. And complain if they are not the primary domain of the entity contacting you, you'll get tired real soon. |
It's just old fashioned con man stuff but over email or phone. And of you're dumb enough to believe that the only way the IRS (US tax agency) is willing to accept payment is by Visa gift card (and yes this is actually a common scam here) it's just not your bank's problem.