The cyber risk
Whilst Libra is a technological development with potential to change the institutionalised means of making payments, there are concerns that it may well provide a platform for fraud and cybersecurity breaches. If Libra, or any digital payment system, seeks to become a leader in electronic payments, then customer protection against fraud and breaches of data privacy must be safeguarded and prioritised.
There is the potential for fraud to materialise on Libra much in the same way we have seen on other technological platforms, online networks and fraud which has occurred on platforms supporting cryptocurrencies.
Recent figures published reveal the scale of the risks posed by scammers and cyber criminals.
Latest FCA estimates suggest that people targeted in cryptoasset scams, such as where they have been conned into buying cryptoassets using fiat currency and have received nothing in return, lost on average £14,600 each in the last financial year.
Total losses attributed to crypto and forex scams in 2018/2019 was over £27 million, the FCA reported in May, although global figures could be significantly higher – BBC Moneybox Live recently cited statistics from a Ciphertrace report published in April 2019 that suggest approximately £950 million worth of cryptocurrency has been stolen or misappropriated from crypto exchanges in the first three months of this year.
There have been arrests over the theft of cryptocurrency in the UK in relation to spoof sites set up to mimic genuine platforms where users can log on and access their cryptocurrency. By entering their details into the fake sites, users inadvertently provide their credentials to fraudsters who subsequently use the details captured to access and deplete genuine crypto reserves. Libra's security measures will need to be sufficiently robust to counter that risk and the companies behind the initiative should seek to educate users on how to access funds held within it.
It is good practice for those thinking of investing in cryptocurrency or utilising a cryptocurrency exchange to consider the length of time it has been established, its reputation, physical location, the identity of the officers of the exchange, the applicable regulatory regime and potential options for enforcement before doing so. Consideration should also be given to storing cryptocurrency offline.
There are several factors behind rising fraud and misappropriation in the context of cryptocurrencies.
The potential to raise capital fast from the growth in interest in cryptocurrencies and from the emergence of 'initial coin offerings' in particular has naturally drawn interest from criminals. These criminals and fraudsters seeking to penetrate the market are increasingly sophisticated, and they are using a variety of means, including malicious code and ransomware, to target users and the platforms on which cryptocurrency is stored.
Exchanges holding cryptoassets are being targeted because of the potential for these new assets to grow in value faster than traditional fiat currencies, and because they are viewed as being softer targets than traditional institutional banks which have developed their security over a longer period.
Libra, in line with its aim of providing a widely accessible digital payment platform, will need to ensure the security risks that exist with the cryptocurrency market are prioritised and addressed. Users will need to be educated on how the system will be accessed and how payments will be processed so as to minimise users being tricked by sites seeking to mimic the Libra ecosystem.
Because of the complex and global nature of the way the Libra blockchain is designed to operate, a customer affected by a mistake or fraud may not have legal recourse against any of the companies which are involved in the Libra Association. The intended global nature of the project may make it difficult to determine where responsibility may lie and it is unclear where, or to whom, a user or customer should raise any issue.
It has been indicated that in the case of hacking, where a fraudster might attempt to hack into a Calibra wallet – the wallet specifically developed for Libra – lost coins will be refunded. However, it remains unclear how Libra will treat other forms of fraud, or indeed frauds successfully depleting funds from apps which are built to work with Libra. It might be possible, depending on how the ecosystem is developed, that fraudulent transactions could be unravelled, but it is unclear currently whether or how this functionality could be provided for.
Whilst an exciting, innovative proposal, users and those behind Libra need to be aware of the risks, which, in the context of fraud and cybercrime, will no doubt develop as the Libra ecosystem itself evolves.
Andrew Barber, Jennifer Craven and Cristina Carrascosa Cobos are experts in financial services regulation, civil fraud and asset recovery and blockchain technology respectively at Pinsent Masons, the law firm behind Out-Law.