People who fall victim to online fraud may find their banks won't compensate them in future.

The growing problem of phishing and the theft of account details meant British banks compensated more than 2,000 fraud victims a total of £4.5m in refunds in the first half of this year. Banking organisations said this could not continue.

The Association for Payment Clearing Services said banks were not insured for such losses and in future automatic refunds could not be guaranteed. It insisted that future claims would be dealt with on a case-by-case basis.

Leading security organisations say the necessary security technology is in place but British banks were failing their online customers by not using it. European security organisation the Liberty Alliance and online security technology developer RSA Security said unlike many European banks that implement additional security levels, most UK banks rely only on user names and passwords.

The ease with which these safeguards can be compromised was highlighted this month when the online security of two banks was brought into question. First it was discovered that people could access Cahoot accounts simply by entering the user name. Then it was found that entering the first digit of the account holder's credit card number would open Morgan Stanley online accounts.

"We don't see those security alerts in Europe because there is additional security. It is something the UK banks need to implement," said Bj”rn Wigforss, vice president of the Liberty Alliance.

Currently Barclays is the only high-street bank piloting additional security, with a trial of card readers for customers.

Tim Pickard, strategic marketing director for RSA Security, said this was a wake-up call. "Banks and other e-commerce sites must take more responsibility for providing their online customers with adequate security."