Are you kidding? Generally it's the end-user. A doctor here had $30,000 transferred from his online banking accounts. Everyone screamed bloody murder at the banks for their "shockingly incompetent" security - until the bank pointed out that the doctor had Back Orifice installed on his PC...