Estimated reading time: 6 minutes

The founder of a small business, built from the ground up, receives a call from someone representing the financial technology company they bank with. The caller says that some transactions on her company account have been blocked and that they need her security information.

Immediately, red flags are raised and alarm bells are sounded for her: until they tell her the exact details of some of her recent transactions, including the amounts, payment dates, and recipients. Reluctantly, she provides the account information they are asking for. 

The next day, she wakes up to find over £100,000 taken from the company account to purchase luxury cars in Dubai.

It’s every small- and medium-sized enterprise (SME) owner’s worst nightmare, but it’s an unfortunate reality that looser security at smaller financial institutions, coupled with highly sophisticated scamming techniques, has led to a massive surge in online social engineering fraud. 

As of May 2023, fraud accounted for over 40% of all offences in England and Wales, but it’s a problem far wider than net losses (an estimated £2.35 billion in the year ending March 2021). It boils down to a question of trust. How can SMEs be emboldened in an environment where they could go from profitable to insolvent in mere minutes?

In the UK, ‘trust’ and ‘government’ are two words you rarely hear in the same breath. This makes Conservative Party ex-Home Secretary Suella Braverman’s 2023 strategy, outlined in the publication ‘Tackling Fraud and Rebuilding Trust’, somewhat ironically titled. 

But for all their faults, the former Conservative government highlighted the need for a wider, national fraud strategy. The 2023 Online Fraud Charter, a collaboration between the UK government and some of the world’s biggest tech companies (including Amazon, Google, and YouTube), was a global first. Actions included verifying new advertisers, removing fraudulent content promptly, and increasing levels of verification on peer-to-peer marketplaces.

Such initiatives targetted criminals themselves and ensured big tech firms step up to the plate. The current government has carried forward this initiative through protecting victims. 

Coming into force on 7 October 2024, the Payment Systems Regulator (PSR) and the Bank of England are introducing a mandatory reimbursement scheme for victims of authorised push payment (APP) fraud.

Issuing a yellow card

APP fraud involves a fraudster tricking their victims into willingly making large bank transfers to them. Often there is a demand to act quickly.

An estimated £145 million was lost in the first half of this year through APP fraud, of which financial providers could only return £30.9 million of those losses: just 21%. Differing interpretations of the UK’s voluntary code of reimbursement meant that while some banks reinstated the losses in 96% of cases, for others this figure was just 3%.

Now, in a bid to restore faith in the financial system, the Payment Systems Regulator (PSR) and the Bank of England are making some significant changes.

Under the new regime, APP fraud victims— consumers, SMEs, or charities—will be reimbursed within five working days, with a proposed cap of £85,000 per claim. This cost will be split evenly between the sending and receiving payment service providers (PSPs) to encourage vigilance on both sides of the transaction.

Customers must be reimbursed within five business days, although this may be paused (“stop the clock”) if the sending PSP requires additional information. “Multi-step” fraud cases involving multiple payments will be covered too: that is, if the customer was deceived into authorising another person to control the account as part of the APP fraud.

The scheme is being implemented through instructions to Pay.UK, the recognised operator and standards body for the UK’s interbank payment systems. They will be responsible for monitoring all directed PSPs’ compliance with the Faster Payments Service (FPS) reimbursement rules. The FPS is a banking initiative to reduce payment times between different banks’ customer accounts.

Having published its final compliance monitoring regime in July, Pay.UK has made several changes to its rules which will place obligations on PSPs to provide data in the manner and form it requires. 

The reimbursement requirement is being implemented via legal instruments, including:

• Specific Requirement 1: Pay.UK must embed reimbursement policies into the FPS rules, defining aspects like maximum reimbursement value and excess limits and establishing a Consumer Standard of Caution.
• Specific Directions 19, 20, and 21: Pay.UK will enforce compliance monitoring, ensure PSPs reimburse APP scam victims in line with FPS and CHAPS rules, and report adherence to the PSR.
• Amended Scheme Rules: Both the FPS and Clearing House Automated Payments Scheme (CHAPS) rules now integrate mandatory reimbursement provisions for APP scams. CHAPS is similar to FPS but with a focus on high-value transactions.

Reimbursements will not be all-encompassing: exceptions will be made for those who have acted fraudulently themselves or displayed “gross negligence”, removing carte blanche temptations.

Hurdles, not a sprint

The scheme is not without its challenges. PSPs are scrambling to upgrade their fraud detection systems, improve customer onboarding processes, and implement more effective transaction monitoring. They must also adapt to a new centralised claims management system, adding a layer of bureaucracy to an already complex process.

The implications of this scheme extend far beyond the immediate financial relief for victims. By shifting the economic burden to PSPs, the regulators are betting on a trickle-down effect of enhanced security measures. The hope is that banks, faced with the prospect of substantial reimbursements, will invest heavily in fraud prevention technologies and customer education.

The new scheme comes with its own set of responsibilities for consumers. They must heed specific warnings from their banks, report fraudulent transactions promptly (claims must be made within 13 months from the last associated payment), and share relevant information with authorities. It’s a quid pro quo that acknowledges the role of personal vigilance in the fight against fraud.

And before it’s kicked off, there already are some problems which the Bank of England need to monitor, and address during the scheme’s promised twelve-month review.

Critics argue that the scheme may inadvertently create a moral hazard, potentially making consumers less cautious with their financial dealings. Proponents counter that the stringent “gross negligence” standard and the voluntary excess should mitigate such risks.

Another point of scrutiny is the £100 excess charge, which some banks intend to deduct from payouts, though around a third of APP fraud is for less than this amount.

Additionally, the level of automatic reimbursement was initially proposed as £415,000, a figure cut by around four-fifths. The PSR justified this cut by arguing that only 411 APP scams recorded by the UK’s biggest banks last year were above the current rate of £85,000; on the other hand, it appears to be the result of lobbying from Britain’s biggest banks who worry about what a payout will mean for them.

—

The mandatory reimbursement scheme not only gives business owners the confidence to operate efficiently and effectively. It also holds them more accountable. Previously, the lines between ‘irresponsible’ and ‘deceived’ were blurred, but the terms in the scheme render these boundaries sharply. 

Between now and 2026, when the PSR conducts its post-implementation review, fraudsters will inevitably find new loopholes. But by introducing new rules to the cat-and-mouse game of tackling financial fraud, policymakers today have the upper hand.