Why the Mandatory Five-Day Approach to Reimbursing APP Fraud Victims Should Be Welcomed

GUEST BLOGGER

Tony McClements

When I joined the Merseyside Police fraud squad back in 1998, the banks had what amounted to a “Gentleman’s agreement” (now referred to as the voluntary “Contingent Reimbursement Model”) to reimburse most victims of fraud within a few days. Over time, this “agreement” was adhered to less and less frequently, as the fight for banking profitability took greater hold of the sector.

Instead, when victims of fraud tried to report their losses to a bank, they were often faced with hurdles designed to prevent them recovering their lost money. Eventually, these obstacles became almost insurmountable.

That is why I welcome news that the Payment Systems Regulator (PSR) in the U.K. has made it mandatory for victims of authorized push payment (APP) fraud to be reimbursed within five days. The new rules will see the payment service providers (PSPs) at both ends of the fraud share the cost of repaying the victims. The new rules will be applied to payments made using the Faster Payments system, which is where most APP fraud is committed.

The APP system is prone to abuse: It involves the fraudster tricking their victims into willingly making large bank transfers to the fraudster. Not only can the elderly and vulnerable be targeted, but company accounts departments are as well.  These scams can involve a seemingly legitimate message from a bank or financial institution that encourage the target to (typically) visit a fraudulent website where they are asked to authorize a payment (sometimes also involving what appears to be a legitimate phone call from the financial institution). Because this is an authorized payment, it bypasses banking security systems.

APP fraud accounted for GBP 485.2 million in losses in the U.K. in 2022 and is expected to rise to nearly triple by 2026, according to a report from payments software supplier ACI Worldwide and analytics firm GlobalData. The scale of the problem speaks for itself. Sadly, the U.K.’s ability to investigate and prosecute APP fraud offenders is almost non-existent. Specialist fraud investigators have been confined to history in most U.K. police forces, meaning that fraudsters are often acting with impunity.

The responsibility for policing these payments is being effectively shifted to the banks. New rules mean that both the issuing and receiving PSP must share the responsibility for overseeing these APP transactions and ultimately footing the cost of reimbursing the fraud victim. The only exceptions will be where the customer has acted fraudulently or where they have acted negligently.

I anticipate that the issue of “negligence” will form the basis for future skirmishes between the banks and their customers. The question of whether a customer has acted negligently is open to conjecture, and therefore debate. What concerns me is that the banks have been guilty of asserting negligence against elderly and vulnerable victims, digging their heels in and waiting for the victim to walk away. Often, only the intervention of the ombudsman sees the victim recompensed.

In examples quoted by “Which?” in late 2021, the consumer champion organization said, “NatWest and The Royal Bank of Scotland (RBS) — part of the same banking group — are getting it wrong in nearly nine in ten cases, with Santander, Bank of Scotland and Starling following closely behind.”

It is important to note that although these two banks do not fare well, they are only marginally worse than many of their high street rivals when it comes to getting it wrong, according to “Which?”.

Meanwhile, a Supreme Court decision earlier this year in mid-July, ruled in favor of Barclays against a customer, over the extent of banks’ duties to protect customers from fraudsters. It is a  decision that lawyers are suggesting could stem a flood of litigation. In a unanimous ruling, Supreme Court Judge George Leggatt said, “Where the customer has authorized and instructed the bank to make a payment, the bank must carry out the instruction promptly... It is not for the bank to concern itself with the wisdom or risks of its customer’s payment decisions.” In this instance, the Barclays customer had visited their local branch and  may have misled bank staff to ensure that a transaction took place. In such circumstances, I agree with the court’s decision.

So, are the banks completely to blame for the apparent poor treatment of fraud victims? The answer is a resounding “no.” These institutions, like the wider public, have been let down by successive governments who, in turn, have let down the police through over-zealous austerity cuts. The banks are proxy victims of these frauds, as they must reimburse the public and companies who have been cheated.

The situation is self-perpetuating. There is no deterrent. Therefore, fraud is now becoming the crime of choice. Why risk a stiff sentence for dealing drugs when you can get much less time in a low-security prison for committing a multi-million-pound fraud? These huge frauds can be masterminded from overseas, too, creating cross-jurisdictional issues that law enforcement (and banks) may struggle to navigate. This only adds to a crook’s prospects of escaping justice: The risk-versus-reward calculation is a no-brainer.

The government’s recent response to fraud has been woeful. Fraud accounts for 40% of all crime in the U.K., yet receives only one percent of police resources. The U.K. has emerged as the fraud capital of the world, costing the U.K. economy an estimated GBP 137 billion per year. The recent release of the much-trumpeted U.K. Fraud Strategy has been met with disdain by many, including myself. It is a veritable damp squib that will make little difference to dealing with the fraud problem.

The banks must exert pressure on the government to properly invest in the specialist police detectives needed to investigate fraud, including APP scams. It is unfair on the banks and the public to anticipate little more than a crime number when they report their crime to the police. U.K. policing chief constables must shoulder some of the blame, too, and apply deploy real focus and resources to investigate the biggest and fastest growing crime in the country.

Read more: A Positive Step for British Banks and Shared Information