[danielweber]

Banks are required to make users whole, even if the user's password is compromised. At least for individual accounts. (For businesses the situation is different.)

http://research.microsoft.com/apps/pubs/default.aspx?id=1618...

[lucian1900]

It depends very much on local laws in your country, from what I've seen.