.svg)
Phase one of the Confirmation of Payee (CoP) implementation has had a positive impact, the UK's Payment Systems Regulator said, which is now considering the extension of the service to more payment service providers. However, CoP alone will not be enough to prevent fraud.
Last week, the PSR published a response paper to the CoP call for views, finding that CoP has had a positive impact. The tool has helped reduce accidentally misdirected payments and prevent an even larger increase in authorised push payment (APP) scams.
By mitigating payment risk, CoP strengthened consumer confidence in digital payments, the PSR said, concluding that “wider implementation of CoP is necessary to protect a greater number of users of payment systems”.
“Confirmation of Payee has proven to be an effective way to stop scams from happening, but it should be widely available — we want to see more banks, building societies and financial institutions use this service to protect their customers,” Chris Hemsley, managing director of the PSR, said.
Despite the PSR claims to a positive impact from phase one implementation of CoP, APP fraud has grown to record levels over recent years, with the PSR noting a 71 percent increase in this type of scam, causing consumers £355m in losses in the first half of 2021 and overtaking card fraud losses for the first time.
Although CoP is an important tool that can alert consumers in case the recipient's account name does not match the name of the intended beneficiary, there are concerns that the tool will not be enough to prevent fraud.
“CoP is an important tool in the fight against fraud, but will not prevent APP fraud on its own,” consumer association Which? told VIXIO.
It can particularly help prevent certain types of APP scams such as invoice scams, but it is important that firms do not just rely on consumers to act on CoP responses. Instead, it is more the principle that banks can also help identify payments that are at higher risk of fraud using CoP, Which? explained.
"It is one solution to help protect people and prevent fraud from happening," the PSR told VIXIO, adding that "the latest development of the service means that it will become available to many more financial institutions who can provide that level of security to their customers".
“While Confirmation of Payee is not a silver bullet to eradicate APP fraud, it is one of a range of measures being implemented by the industry to combat fraud,” Pay.UK, who is responsible for managing the service, agreed.
Another challenge of CoP is the account name used by a business and trading name may not necessarily correlate. For example, many small businesses may use the personal current account of the owner, or the registered name of the business may differ from the one they operate under.
To help overcome these concerns, Pay.UK said it has worked with the industry to agree on a minimum standard of matching rules for personal and business accounts. However, it pointed out that CoP participants have some discretion to interpret these rules in line with their account profile.
To reduce losses, in 2019, the PSR directed the six largest banking groups to introduce CoP over Faster Payments and CHAPS transactions. In addition to these banks, which represent 90 percent of transactions over Faster Payments and CHAPS, several PSPs have joined the initiative, and now there are more than 1m CoP requests registered every day. To put it in perspective, this is equivalent to roughly 14 percent of the Faster Payments transactions that these banks process each day.
With still relatively low usage of CoP across Faster Payments and record levels of APP fraud, the PSR now confirms its plan to direct the necessary system developments to enable the transition of current CoP participants from phase one to phase two.
Further Assessment
The regulator will continue to assess whether it needs to direct PSPs to join the service and may launch a further consultation on that before next March. These include both PSPs with unique sort codes, as well as PSPs that rely on secondary reference data (SRD), such as a roll number that building societies sometimes use instead of sort code and account number, to identify their customer.
The PSR is also considering ending the dual running period between phase one and phase two in March 2022 and may issue a direction in that regard early next year.
While welcoming the big banks’ commitment to being present in phase two by the end of 2021, the PSR said it “will continue to engage with industry and Pay.UK to monitor delivery. If appropriate we will act — for example, should progress falter.”
Even with rollout, it will not completely solve the problem. The report noted that fraudsters continued to move towards institutions that do not yet use CoP and they have increased “social engineering of victims” to convince customers to ignore "no match" warnings.
