04 Sept 2024

New fraud protections to be watered down after industry lobbying

A new mandatory scheme to protect fraud victims will launch next month, yet bank customers are in the dark and the rules are still being finalised – here's what you need to know

Chiara CavaglieriSenior researcher & writer

Authorised push payment (APP) fraud victims should be reimbursed in all but exceptional cases from 7 October due to a new mandatory reimbursement scheme. Yet 60% of adults have no idea it’s coming into force and the regulator is still changing the rules at the final hour.

Under the new Payment Systems Regulator (PSR) rules, all payment service providers must reimburse consumers who lose money to APP fraud when using Faster Payments, split 50:50 between sending and receiving firms.

But the PSR has now said that it's planning to reduce the maximum reimbursement level on claims from £415,000 to £85,000 – in the same week that the Financial Ombudsman Service (FOS) revealed that fraud and scam complaints have hit record highs.

The new fraud protections you've never heard of

The PSR's new mandatory scheme will replace the current voluntary code (known as the Contingent Reimbursement Model Code or CRM Code).

Which? has repeatedly warned regulators that the voluntary approach doesn't go far enough, as victims face inconsistencies and unfair rulings. So it's a big leap forward to bring all payment firms into scope.

However, we're concerned that many customers remain in the dark about these important new protections.

A Which? survey of 2,000 adults from 23 to 26 August 2024 suggests that most payment firms have failed to inform customers of this mammoth shift.

Only 32% of adults said they had heard about the new scheme from their bank or building society (another 3% heard about this in other ways, such as from friends and family or the news).

Find out more: what to do if you fall victim to a bank transfer scam.

Why is the cap set to be lowered from £415,000 to £85,000?

We're hugely disappointed that the regulator has caved to pressure from payment firms to reduce the reimbursement cap on claims.

The PSR originally set the cap at £415,000, which matched the FOS compensation limit at the time.

However, the regulator came under pressure from banks and other payment firms to lower the cap to £85,000, which matches the current Financial Services Compensation Scheme (FSCS) limit paid out to customers if a bank goes bust.

In August 2023, the PSR had said it did 'not consider the FSCS limit to be directly comparable to a maximum reimbursement limit'. But with just over four weeks to go until the new rules come into force, the PSR now says it will open a two-week consultation on amending the cap to £85,000.

The PSR says it is proposing this last-minute change because it has considered additional data from the 15 UK largest payment firms and the FCA about the impact of high-value scams on firms, consumers and on competition.

Who could lose out under a lower cap?

The PSR says that the proposed £85,000 cap will see around 90% of total APP scams by value reimbursed. But under the higher £415,000 limit, 98% of the value of APP scams would have been covered.

The PSR found that – out of more than 250,000 cases – there were 18 instances in 2023 of people being scammed for more than £415,000 and 411 instances of more than £85,000.

The PSR says that this data covers a wider set of firms than data it used for its August 2023 consultation, which included eight payment service providers and found around 25% of APP fraud involved losses of more than £85,000 in the second half of 2022.

But Which? has seen numerous cases involving losses of more than £85,000 and believes this last-minute change will mean that victims of high-value frauds (such as conveyancing, investment, invoice and impersonation scams) will lose out.

‘The PSR must stick to its original plan’

Rocio Concha, Which? director of policy and advocacy, said: ‘The PSR's report is clear – victims of high-value fraud, such as investment scams and house purchases, stand to have their lives destroyed by this screeching U-turn. Yet somehow the regulator's conclusion is that these people should be abandoned to provide a small benefit for parts of the finance industry that have been warned over their role in facilitating financial crime.

'Having previously ruled out a lower threshold because there would be "significant harm to victims", the PSR has caved in to pressure from payment firms and ministers, and dropped the crucial principle that a higher reimbursement limit gives the finance industry strong incentives to invest in improved fraud security measures, which could have disastrous consequences for victims.

'The regulator must stick to its original plan for a £415,000 limit to protect victims of high-value scams. If this government is serious about fighting fraud, it must support the implementation of the new reimbursement scheme in full and on 7 October.'

Whatever the outcome of the consultation, Which? would urge all fraud victims to escalate their complaints to the FOS if they don't get fully reimbursed. It's a free service and investigators assess whether providers could have done more to prevent the fraud.

Find out more: how to take a complaint to the Financial Ombudsman Service.

FOS gets 500 fraud complaints a week

The PSR's announcement comes as new figures from FOS show that fraud and scams show no signs of slowing down.

The public lodged 8,734 complaints to the FOS about fraud and scams in the first quarter of this financial year (1 April to 30 June 2024), of which more than half were concerning APP fraud. In the same period in 2023-24, there were 6,094 fraud and scam complaints.

The FOS has said it's currently receiving – and resolving – around 500 fraud and scam complaints a week.

Worryingly, it has seen a significant rise in complaints where people spot investment opportunities on social media and then inadvertently pay fraudsters using their debit or credit cards. These victims have very limited protections as they aren't covered by the CRM Code or the new PSR rules.

Find out more: fraud and other banking complaints reach 10-year high.

New reimbursement rules explained

Despite the last-minute proposed changes to the reimbursement cap, the deadline for the scheme to launch is still next month.

If you unintentionally transfer money to a scammer after 7 October, you should get your money back within five business days of reporting it under the new scheme.

The rules apply to all 1,500-plus firms using Faster Payments (near-immediate electronic transfers sent directly from one bank account to another). Payments across other systems, such as card payments and cryptocurrency, as well as international payments, are excluded.

You should claim through your own bank or payment provider (the sending firm), although it will split the cost of reimbursement with the receiving firm. It’s hoped that this will incentivise providers to improve their systems to prevent fraud. You may be asked to pay £100 towards it (the claims excess), although firms can choose to waive this.

Your claim can only be refused if you don’t meet four requirements known as the 'consumer standard of caution' exception:

You should heed fraud warnings and specific, directed interventions by your provider or relevant authorities, such as the police.
If fraud occurs, you must report it promptly and no more than 13 months after the final payment to the fraudster.
When the provider assesses your claim, you’ll be required to respond to any reasonable and proportionate requests for information.
Your provider can also request that you report the details of an APP scam to the police or other authority, or will ask for your consent to report to the police on your behalf.

Your provider must be able to demonstrate that your failure to meet one or more of these four requirements was a result of gross negligence – defined as a very significant degree of carelessness – so stand firm if you don’t think its decision was fair.

The PSR says it expects only a small minority of claims to be refused.

Importantly, anyone deemed vulnerable to the specific APP scam they experienced is not subject to the consumer standard of caution or the £100 claims excess. This means if your personal circumstances made you especially susceptible to harm, you should be refunded in full.