What obligation do banks have to return money after fraud?
I'm interested in what happens when money is stolen from a UK bank account. I have read on the Citizens Advice Bureau website that  Your bank should refund any money stolen from you as a result of fraud and identity theft. They should do this as soon as possible - ideally by the end of the next working day after you report the problem. The bank can refuse to refund you if they find you acted fraudulently or were grossly negligent - for example, if you shared your pin or password with someone else. I'm looking for clarification of a couple of statements in this quote. I see that my "bank should refund any money stolen from [me] as a result of fraud and identity theft". I'm also interested in knowing what would classify as "grossly negligent" under these circumstances. I'm confident enough that I'm not going to share my pin number with anyone that I don't feel that I need to worry about the example they give. What if; I used same weak password on my internet banking as I did on another less secure website. Personally I consider writing my passwords down on a piece of paper to be reasonably secure, and using the same weak password on different websites including my bank account to be insecure. It would be interesting to see if either are classified as grossly negligent. Any links to further reading about this, maybe wording of some related laws, would be appreciated.