Using this method three separate attacks occur:
- They get the company to repay the loan to the attackers account, getting $1000
- They get the company to give the attackers access to the safety deposit box, getting £1000
- They get the company to honour a debt card payment, getting £1000 of goods
My understanding of what has happened in the first two cases is:
- The attackers have committed fraud against the bank, and have not affect me at all. The debt obligation that the bank had to me remains.
According to this question a bank account is not like this, as such an
attack is theft from me
The attackers have commited theft against me. They may also have defrauded the bank, and it is possible I could have a civil case
against the bank if they were incompetent, but the attackers took the
money from me not the bank.
According to this question a bank account is not like this, as it would not be theft for me to take the money out of the deposit box
What is the situation of money in a bank account, with respect to
ownership and theft. Is it actually like either a debt obligation or a
deposit box, or is it something different?
@Lag correctly characterized the nature of a bank deposit.
A bank deposit is a contractual relationship between you and the bank in which you loan the bank money in return for a right to get the same amount of money, plus interest and minus fees, back from the bank on demand. In the case of a checking account, you also have the right to give someone else the right to demand that the bank give them money out of your account if you write a valid check.
A deposit account at a bank, like commercial paper, is a short term loan between you and the bank.
In case one and case three, the bank is defrauded in a manner that causes they to pay money to a wrongdoer under the wrongdoer's pretense that they are paying money to you to which you, to which you are entitled.
In the context of civil liability, usually, the bank has a duty to resort your right to receive money from them and bear the loss. But there is an exception to the general rule when the wrongful payment of funds to the wrongdoer is made possible because your actions make it possible for the wrongdoer to do so.
For example, if you high a personal assistant and give your personal assistant you debit card and the PIN for the debit card and your personal assistant wrongfully withdraws funds from your deposit account, the bank doesn't have to restore the funds to your account from the wrongful withdrawal. The dispute is between you and the personal assistant who wrongfully withdrew your money.
In some jurisdictions, what the personal assistant did is a specialized offense called embezzlement, and what happened in case #1 or in a variation on case #3 involving a third-party hacker you never put in a position to take money from you is called bank fraud (and also arguably fraud directed at you since it impaired, at least temporarily, your access to your bank deposits). In other jurisdictions which have adopted a broad definition of the crime of theft, rather than following the historical common law model of describing the various ways that economic rights can be intentionally and wrongfully taken from you in terms of specific ways of doing so, this is simply "theft" from you and from the bank, in all versions of case #1 and case #3.
More generally, in the contexts of bank accounts and negotiable instruments like checks, which in the U.S. are primarily governed by Articles 3 and 4 and 4A of the Uniform Commercial Code, the general rule which also applies in more complicated situations (such as check kiting frauds or more elaborate forgery schemes), is that the risk of loss from theft and fraud falls on the person who dealt with the thief and was in the best position to prevent that person from carrying out the wrongdoing.
The statutes that govern this in the U.K. are different, but because U.S. banking law is closely based upon U.K. banking law, the bottom line results that the U.K. statutes produce are substantially similar to those of the Uniform Commercial Code in the U.S. There are differences in result only in the most arcane fact patterns devised specifically to exploit the very subtle differences between the two sets of laws.
Property in a safe deposit box, in contrast, is still your property. The actual currency you give to a bank to deposit in your account becomes property of the bank, in you get a contractual right to get cash later from the bank in exchange. But the property you put in your safe deposit box (even it is currency) continues to be your property and the bank can't use it in the meantime.
In case #2, you are a victim of theft of your property when a wrongdoer takes it from your safe deposit box without authorization. The bank may have liability to you for negligently giving the wrongdoer access to your safe deposit box, but the bank is not a victim of the crime directly.
In case #2, however, as in case #3, the bank does not have liability to you for providing a wrongdoer with access to your safe deposit box that allows the wrongdoer to steal your property from it, if your actions made it not negligent for the bank to give the wrongdoer access to your safe deposit box.
For example, suppose the wrongdoer was your personal assistant and you gave your personal assistant the key to your safe deposit box and told that bank that your personal assistant was authorized to access your safe deposit box on your behalf. Then the personal assistant removes your property from the safe deposit box without your permission for the personal assistant's personal benefit. The personal assistant has stolen the contents of the safe deposit box from you and has liability to you for conversion and breach of fiduciary duty (and in jurisdictions that have it, civil theft). But, the bank has not liability to you and is not the victim of a crime.
On the other hand, if a thief pickpockets your safe deposit key and ID from you, and uses them to gain access to your safe deposit box and remove the property, because the bank gives them access to the safe deposit box - even though thief looks nothing like the picture on the ID - the bank was negligent has has liability from the property that the thief stole from you. The bank is still not a crime victim of the thief but would have a right to indemnification of the damages it suffered including the amount that it owed to you for its negligence, from the thief, possibly with punitive damages as well.
Footnote
The relationship between a bank and the customer concerning a deposit account is a contractual one, and not a "bailment" which is the formal legal term for a safety deposit box-like transaction when a third-party is in possession of your property that continues to be your property with your permission.
In some context involving a bank deposit account customer vis-a-vis the rest of the world other than the bank, the customer's contractual rights vis-a-vis the bank is also treated like a contactual right.
For example, when a judgment creditor wants to collect amounts a court has determined that a bank customer owed to the judgment creditor, the creditor delivers to the bank a writ of garnishment, which is a legal order directing a non-party to a lawsuit who owes a debt to the judgment debtor to pay the amount owed on that debt to the judgment creditor instead of the person to whom they owe the debt.
In contrast, if a judgment creditor of a bank safe deposit box customer wanted to collect property owned by the bank customer from a safe deposit at the bank, the judgment creditor would get a writ of execution together with a writ of assistance to give it permission to take the property out of the safe deposit box to satisfy the debt owed to the judgment creditor. A writ of execution is an order directed at a law enforcement officer directing the law enforcement officer to seize property belonging to a judgment debtor in order to pay a judgment creditor's debt. A writ of assistance is an order directed at a non-party to a lawsuit giving a law enforcement officer enforcing a writ of execution permission to enter on to private property of the non-party in order to carry out the writ of execution.
But, in other contexts involving a bank deposit account customer vis-a-vis the rest of the world other than the bank, the customer's contractual rights vis-a-vis the bank is also treated like property of the customer, rather than a contract right.
For example, for purposes of balance sheet financial accounting and for purposes of estate tax laws and fraudulent transfer laws and property divisions in divorces, bank account balances are treated as property of the bank account customer, even though strictly speaking the bank account balances are really contract rights of the debtor against the bank and not property.
Whether a bank account is considered a contract right or a property right under the law is determined from context based upon the parties involved in the issue to which the law is being applied.