.svg)
As the UK Payment Systems Regulator (PSR) publishes minimum requirements for reimbursing authorised push payment (APP) fraud victims, industry representatives warn of the potential unintended consequences.
On Wednesday (June 7), the PSR published its long-awaited policy statement setting out minimum standards to reimburse victims of APP fraud within the Faster Payments System.
The new reimbursement rule will require payment firms to reimburse all customers who fall victim to APP fraud, split the cost of reimbursing victims 50:50 between sending and receiving payment firms, and provide additional protections for vulnerable customers.
According to the policy statement, the new reimbursement requirement will apply to all payment service providers (PSPs), including banks, building societies, smaller payment firms, as well as payment initiation services providers (PISPs).
Sending PSPs will be responsible for assessing the claims and reimbursing their customers. The statement sets a deadline of five business days to do so but PSPs can "stop the clock" to gather additional information.
The PSR is planning to consult on further elements of the rule in August, such as a maximum cap on reimbursement and providing guidance on how to interpret "gross negligence" on the customer’s part.
The timeline for the reimbursement requirement will be also decided at a later date, although it is expected to come into force sometime in 2024.
According to Daniel Holmes, fraud prevention SME at Feedzai, several elements of the new rule are “world-firsts”, including the introduction of 100 percent APP scam liability for the banks, the 50:50 liability split between the sending and receiving bank, as well as the requirement for banks to make their reimbursement rates and scam losses public.
This means that “customers will for the first time see the impact of controls that their own bank has implemented”, Holmes told VIXIO, factoring in the level of the bank’s customer protection in their decision with whom to bank.
“Banks for the first time need to consider incoming payments in the same way they have always analysed outgoing payments”, which may accelerate innovation and delivery timelines, he added.
Neobanks are most likely “to feel this pain”, according to Holmes, as some of them have a low market share and a high percentage of fraudulent funds received due to a historical lack of strong onboarding, mule and know your customer (KYC) controls.
Although several industry experts agree the new requirements may lead to reduced fraud rates, they have also raised concerns about potential unintended consequences.
Tony Craddock, director general of The Payments Association, said the new rules is a “well thought through” approach but they could “exacerbate the problem of financial exclusion”.
According to Craddock, the minimum requirements may make it much less attractive for payment providers “to issue cards to those on the edge of society because there is a higher chance they will succumb to scams”.
“Also, by fundamentally changing the commercials behind the issuing of e-money, where the issuer now carries a significant 50 percent burden of reimbursing defrauded customers, this could well constrain the e-money sector for years to come.
“The vision of a level competitive playing field for account provision becomes more remote than ever,” he noted.
The new requirements will also likely add new friction to the payment process, said Gary Prince, founder of Astus Munia Consilium consultancy, which could “well be completely contradictory” to the Joint Regulatory Oversight Committee (JROC) announcement about progressing with open banking and A2A payments.
Prince said banks are likely to add additional steps into the new beneficiary set-up process to mitigate their liability, while there is also a risk of legitimate payments being routinely blocked.
This may have a particular impact on e-money institutions “who have played ‘fast and loose’ with KYC checks, concentrating on growth”, as well as PISPs “who are undertaking minimal if any KYC checks”, Prince pointed out.
Meanwhile, he noted that the splitting of the liability might make banks reconsider some of the current marketing practices of giving financial incentives to encourage friends to open accounts.
In many cases, these offers are used by fraudsters to target financially inexperienced users to open accounts, receive the "free money" and then pass on the user details for use in fraudulent activity.
“As always, the devil will be in the detail,” Prince emphasised, adding that “although well-intentioned, there could well be some unintended consequences”.
Meanwhile, others have pointed out that splitting fraud costs between the PSPs does not take into account the role of social media platforms and customers in APP fraud.
Recent UK Finance figures show that 78 percent of APP scams start online, which raises the question of what role social media platforms have in facilitating fraud.
David Postings, the chief executive of UK Finance, previously lamented that the banking sector “is the only sector reimbursing at the moment”.
“Our belief is that the burden should be spread … and [tech companies] should be putting their hands in their pockets, particularly as they profit from it,” he told the Guardian.
The issue will to some extent be addressed by the forthcoming Online Safety Bill, which requires technology and social media companies to remove scam adverts from their platforms. It, however, falls short of making those platforms financially liable for losses.
APP fraud can take many forms, including impersonation, investment, romance, purchase, invoice and mandate, CEO fraud and advance fee.
The latest figures show that UK customers lost £485.2m to APP scams in 2022.
