A police chief's suggestion that banks should consider no longer refunding some online fraud victims has been branded as "astonishingly misjudged" by a consumer group.
Metropolitan Police chief Sir Bernard Hogan-Howe told The Times newspaper that the system "rewards" the public for being lax about internet security.
He said a rethink might alter behaviour over passwords and security software.
Consumer group Which? said the burden of protection should lie with banks.
"With online fraud increasing, this is an astonishingly misjudged proposal from the Met Police Commissioner," said Which? executive director Richard Lloyd.
"When we investigated last year, we found too often that banks were dragging their feet when dealing with fraud. The priority should be for banks to better protect their customers, rather than trying to shift blame on to the victims of fraud."
Customers who become the victims of online fraud can expect to receive a full refund on any losses from their bank or card supplier, unless they have been "grossly negligent".
In relation to these refunds, Sir Bernard told the Times: "If you are continually rewarded for bad behaviour you will probably continue to do it but if the obverse is true you might consider changing behaviour.
"The system is not incentivising you to protect yourself. If someone said to you, 'If you've not updated your software I will give you half back', you would do it."
The comments were also criticised by the charity for older people, Saga.
"Blaming the victims of crime is no way for anyone to behave let alone the Metropolitan Police Commissioner. Keeping up with scams is almost a full-time job," the group said.
"Society expects the banks and the police to be able to keep us safe from this type of crime - if they're unable to keep up with the ever sophisticated nature of this fraud, what chance do the rest of us have.
"This is a particular problem for older people that could result in them feeling digitally isolated for fear of becoming a victim and then being blamed by those who they expect to protect them."
There are various types of personal financial fraud, ranging from cloning of debit and credit cards to scams which trick people into believing their bank account has been compromised and encouraging them to move funds into a fraudster's account.
In October, banking giant RBS revealed that 70% of its customers who fell victim to a scam did not get a single penny back. Almost 5,000 of the bank's customers fell victim to various scams in the first nine months of last year - at a total cost of more than £25m.
The average cost of falling for a scam had risen by 40% since 2014, to more than £13,000, the bank said. Many victims had agreed to transfer money to a fraudster so did not seek, or were not given, a refund.
Police will include cybercrime estimates in official crime statistics for the first time in July.