A Advancements in information technology have encouraged banks to provide sms banking services as one of the electronic transaction facilities that offer convenience to customers. however, these advancements have also increased the risk of cybercrime, one of which is the hacking of sms banking provider systems, enabling perpetrators to distribute phishing links impersonating banks and causing financial losses to customers. the issues examined in this research are: (1) how the legal responsibility of banks for customer losses resulting from the hacking of sms banking provider systems is regulated, and (2) how pt bank central asia is legally responsible for customer losses resulting from such hacking. this study is a normative legal research with a descriptive nature, employing a statutory approach. the data were analyzed qualitatively using a deductive method. the results indicate that the legal responsibility of banks is regulated under the banking law, the consumer protection law, the electronic information and transactions law, and financial services authority regulations (pojk). pt bank central asia has implemented the prudential principle, provided security systems, handled customer complaints, and conducted customer education regarding phishing. pt bank central asia is not liable to compensate customers for losses because the losses occurred as a result of customers voluntarily disclosing their authentication data to the perpetrators; therefore, no fault or negligence can be attributed to the bank.