A long standing rule in law and economics says liability should sit with the party who can best manage the risk. When it does, that party has a reason to invest in prevention. When it does not, the party who pays is not the party who can fix the problem, and security tends to be neglected.
The card fraud contrast
Anderson and Moore describe a pair of banking regimes. In the USA, banks were generally liable for card fraud: when a customer disputed a transaction, the bank had to show the customer was trying to cheat or refund the money. In the UK, banks more often claimed their systems were secure and told complaining customers they must be mistaken or lying.
You might think the UK banks had it easy. The authors point out they spent more on security and suffered more fraud, and suggest a moral hazard effect: staff knew complaints would not be taken seriously, so they became careless.
Treat this as an interpretation from a survey paper, not a controlled experiment. Its value is the question it raises: who pays when things go wrong, and can that party do anything about it?
Misplaced risk in other settings
The same paper lists more cases. Medical record systems are bought by hospital directors and insurers whose interests in cost control differ from the patient's interest in privacy. The authors say this mismatch led in the USA to HIPAA. They also cite work showing that some banks used online banking to push transaction risks onto customers that banks had carried in the days of cheques.
Applying the rule inside a company
You can test any arrangement with three questions.
- Who can prevent the loss? Name the team or vendor that could change the outcome.
- Who pays when it happens? Name the budget or customer that absorbs the cost.
- Are they the same? If not, look for a mechanism that connects them.
Examples of mechanisms:
- A product team owns the security debt its code creates, with a visible backlog.
- A vendor contract ties service credits or termination rights to security incidents the vendor controls.
- Incident costs are charged back to the business unit that accepted the risk. See who should own and accept a security risk.
When the best manager is not obvious
Sometimes two parties share control. A cloud customer and a cloud provider split duties, and gaps appear in between. The shared responsibility model helps map who handles what. Write the split down and test it in tabletop exercises.
The limits
The best-manager rule is a guide, not a law of physics. Some risks cannot be managed by anyone in particular, such as a flaw in a widely used library. Others are hard to measure, so a liability rule is hard to enforce. And liability that is too heavy can push parties away from a market altogether.
Quick check
What does the best-manager rule say?
Liability should fall on the party best able to manage the risk, so that they have an incentive to prevent loss.
Did the card fraud example prove liability changes fraud rates?
No. The authors offer it as an illustration and suggest moral hazard as one explanation.
Sources
Last reviewed: 19 October 2026.
