Phishing in the Banking Sector: Between Cybercrime and Consumer Protection

Abstract

The escalating utilization of electronic banking services corresponds with a heightened threat of cybercrime, particularly phishing, leading to significant financial losses for customers and eroding public trust in the digital banking system. This research aims to analyze the forms of legal protection available and the construction of banks’ civil liability, as well as to identify the legal remedies accessible to customers victimized by phishing under Law Number 8 of 1999. Employing a normative legal research methodology integrating statute and conceptual approaches, the study analyzed relevant legislation and legal doctrines. Findings indicate that banks bear specific legal obligations mandated by Financial Services Authority Regulations, Law Number 27 of 2022, and Law Number 8 of 1999, about the assurance of system and data security. Consequently, banks’ civil liability for phishing-induced losses can be established, primarily on the grounds of unlawful acts (tort), contingent upon proof of failure to discharge these specific duties involving fault or negligence. However, the practical determination of liability remains complex, invariably factoring in customer contributory negligence. Victims possess options including criminal reporting and general civil litigation, yet Law Number 8 of 1999 offers a more structured consumer dispute resolution pathway. This pathway encompasses mandatory internal complaints submitted to the bank, potentially followed by escalation to LAPS SJK as the principal forum for out-of-court settlement. The study concludes that while the legal framework establishes a basis for bank liability, the adequate protection of customers is heavily contingent upon evidentiary success in disputes and the optimized functioning of resolution mechanisms, particularly LAPS SJK.