Bank customers using the internet are increasingly at risk from an array of sophisticated scams, experts warned last week, after a security flaw was discovered in HSBC’s online banking system.

Researchers at Cardiff University said they had found a loophole that could have allowed fraudsters access to 3.1m online accounts at the high-street bank.

Luckily, in this case, it appears the academics were smarter than the criminals. HSBC rapidly reassured its internet customers that no money had been lost.

But it has prompted independent security advisers to urge customers who bank online to tighten their security measures because it is much easier for criminals to target customers’ accounts rather than banks’ systems.

Michael Penhallurick at the Risk Advisory Group, an adviser, said: “It’s essential that customers take security seriously. Banking online without the latest firewalls and virus- detection programs is like going on holiday and leaving your front door wide open — it’s an invitation to be robbed.”

Online fraud is increasing rapidly. It cost £23m in 2005, according to figures from the Association for Payment Clearing Services, a 90% increase on the year before. There is expected to be a similar jump in the money stolen this year.

Credit-card fraud remains a much bigger problem, with losses hitting £440m last year, but since the introduction of chip-and-Pin, fraudulent card transactions have fallen. They were down 13% on 2004, before the technology was widely used.

This means criminals are increasingly turning to Britain’s 15m online banking customers, and new scams are emerging all the time.

The problem at HSBC centred on “keyloggers” — gadgets or software that capture keystrokes made on a particular computer. These can be used by fraudsters to work out security codes and passwords and log into customers’ accounts. Although HSBC firmly denies it, the researchers claim the design of the bank’s security system made its savers particularly vulnerable.

But that does not mean that those who are with other banks can afford to be complacent: criminals can easily target your account rather than the bank itself.

The majority of online fraud is blamed on “phishing”. Criminals send bogus e-mails purporting to be official requests and ask customers to confirm their online banking details by e-mail or by directing them to a website that looks just like the bank’s own site.

Trojan programs, which monitor surfing habits and keystrokes, potentially capturing security details such as user names and passwords, are another favourite scam. Usually the criminals send out e-mails at random to get people to click on a link and visit a website that installs the trojan.

Fraudsters also use crafty techniques to obtain credit-card details. The latest scam is “vishing”, a version of “phishing” that exploits the trend for internet-based phone services.

Victims receive an automated telephone call informing them their credit card has been used illegally, and that they should dial a bogus number to verify their card details. When the victim phones the number, the call is answered by a computer- generated voice that tells the caller to tap in card details and security information — all a criminal needs.

There are steps you can take to protect yourself. The latest virus-detection software, anti-spyware programs and firewalls are available over the internet and some can be downloaded for free.

Barclays offers free anti- virus software to its online customers and the popular Windows XP operating system includes a firewall.

Some banks have been introducing innovative measures to help in the fight. Lloyds TSB is trying out a key-ring sized gadget that generates a six-digit code that customers enter when they log on to the online banking site. Barclays is also planning a handheld card reader that will generate a one-off password to access your online accounts.

Most banks will still reimburse defrauded customers as long as they have not been negligent with their security details, but advisers warn that it can only be a matter of time before they refuse to pay out if you don’t protect your computer.

Ross Methven at Mapa, a research firm, said: “I wouldn’t be surprised if banks started to shift the liability for online fraud on to the customer.”

But the best protection is to remain vigilant. Treat all unsolicited e-mails with extreme caution. No bank will ever ask for your security details by e-mail. Rather than clicking on a link, always type your bank’s e-mail address into your browser.

More detailed advice on how to protect your computer is available from getsafeonline.org, which is backed by the government.

WAYS TO PROTECT AGAINST FRAUD