Romance fraud, online scams and cyber fraud: How banks are now protecting your money

The Payment Services Regulations 2017 (PSRs) finally came into force on 7 October 2024.

The UK has now introduced measures to combat Authorised Push Payment (APP) fraud, which occurs when individuals are unwittingly tricked into sending money to fraudsters. Any payments made before that date are caught by the old Voluntary Code of Practice introduced in May 2019 (also known as the Contingent Reimbursement Model) (‘the Code’).

The cost of APP fraud to individuals and businesses, according to UK Finance amounted to £459.7 million in 2023. If you have been a victim, you will realise how difficult it is to get the money returned, with the inconvenience and time consuming discussions and embarrassingly, having to prove your lack of culpability in the fraud. The new rules should make this process easier and more likely to prevent fraud and return the funds to your account. 

Which payments are covered?

The scheme will cover payments by CHAPS and Faster Payments up to the sum of £85,000 within the UK, however this sum is likely to come under review in the coming year. If more is lost there is the option of raising this issue with the Financial Ombudsman Service – whose limit is £430,000. There is an excess of up to £100 which may be payable depending on the Payment Service Provider (PSP) with some waiving or reducing this below £100 this as a matter of policy. So, it is worth noting that international transactions for those overseas internet purchases are not covered.

Payments made by card, cash or cheques are already subject to their own protections and guarantees, and these may also form the part of a broader consumer complaints covered by consumer protection law. 

Who is eligible?

The rules are fairly narrow in scope. Consumers, microenterprises and charities which were covered under the Code are now eligible under the new scheme. 

This means ordinary individual bank customers, whether as a consumer or in the course of a small trade, business or profession; enterprises with less than 10 employees and an annual turnover/balance sheet of less than £2m; and charities with an income of less than £1m are all covered.

How will it work?

Once you have notified your bank or PSP, reimbursement (potentially subject to the excess) will be paid within a 5 day time limit. 

In a novel move, the payment will be shared between the sending and receiving PSPs on a 50:50 basis – but the practicalities of this should be dealt with behind the scenes. If the case is more complex and requires further investigation this process can take up to a maximum long stop of 35 days.

Warnings of fraud issued by the PSPs in literature and on their online platforms and apps will start to become the norm before payments are processed. Not only will they allow customers to sense check the transaction but there will be Confirmation of Payee service which checks the account name against the account details provided by the payer, helping to ensure that payments are sent to the correct recipient. 

What are the downsides?

The obvious negative is where consumers are deemed have acted fraudulently or with gross negligence in relation to the payment. They will not be recompensed under the scheme. The Payment Services Regulator has issued specific Guidance on what is expected to be the standard of care for the assessment of claims which covers 4 main areas: paying attention to the interventions or warnings, reporting promptly, providing information and allowing matters to be referred to the Police. However, “vulnerable” customers will not be subject to these rules.

There is an expectation that a report of APP fraud losses is made promptly to the PSP to allow for swift intervention including repatriation of money “in the system”. Delays in notification can amount to gross negligence, unless there are mitigating circumstances or proof of reporting to the Police for example. But there is a warning that some delays might invalidate a potential claim. That said whilst there is a requirement for “prompt” reporting the deadline for claims is 13 months after the last authorised payment.

Some delays in repayments up to 35 days (known as “stop the clock” assessments) might occur where claims are complex and require additional layers of investigation – so victims will need to be prepared to provide proportionate responses for information and assistance to allow the PSP to assess their claim.

There is also an expectation that the customer on making a claim will consent to the PSP reporting the matter to the Police, unless this has already taken place through Action Fraud or similar competent authority. 

The most notable issue is pressing on with a payment despite the warnings. If these are not adhered to, there is a risk that the account holder will fall below the expected consumer’s “standard of caution” which means the reimbursement may be subject to challenge and rejection. However, such actions will not automatically be deemed to be detrimental to customers prospects of recovery. Much depends on the nature of the PSPs warnings and interventions to prevent the fraud and the complexity of the scam. The Bank will be required to conduct an assessment of the issue to the customers negligence before reaching its decision.

Delay in payments

In a last minute amendment to the rules, PSPs are now permitted to delay transactions where:

• There are reasonable grounds to suspect the payment request was as a result of fraud or dishonesty perpetrated by a person other than the payer; and
• These grounds were established before the day after the payment request was made (which is the day by which payments are required to be made).

The fact of and reasons for the delay must be explained to the paying customer within 24 hrs and the investigation concluded within 4 days from the date of the receipt of the payment order. The concerns are that such payments might interfere with time critical purchases, such as in conveyancing transactions. If the delays cause hardship the PSPs are potentially liable for charges and interest incurred as a result. 

Civil disputes and other complaint routes

Whilst these measures collectively aim to reduce the incidence of APP fraud and ensure that victims are adequately protected and reimbursed it also recognises it could be (mis)used in circumstances which are genuinely described as a “civil disputes” where fraud might not be intended or there is a dispute with a legitimate supplier due to defective or undelivered goods. PSPs will need to be careful to assess such transactions and evaluate the merits of any claim through the initial reports.

Finally, those other businesses who are out of scope due to their size will need to decide how to proceed if they do not qualify for mandatory reimbursement. Banks or PSPs might still be negligent in handling and processing suspect payments under their Quincecare duties, or there may be grounds to pursue a complaint via the Financial Ombudsman Service. Insurance for such losses should always be a consideration for such businesses.

In summary in a world of high profile financial scams, which inevitably disrupt lives, there now appears to be a balanced approach to stay informed about scams with responsibility shared between the PSPs, Banks and the victim. There remains the question however if the reimbursements are guaranteed (to a degree) will people become less discriminating, and they be targetted more by fraudsters. It is hoped that these changes and the data sharing requirement will keep the PSPs and law enforcement one step ahead and the money safely in the right hands.