Cutting bank transfer fraud refund limit not enough, industry warns regulator

The UK’s payments regulator is under pressure to overhaul a controversial fraud reimbursement scheme despite confirming it would look at scaling back the plans.

In their current form, new rules from the Payment Systems Regulator (PSR) are due to force banks and fintechs to reimburse victims of authorised push payment (APP) fraud up to a limit of £415,000 per claim from 7 October.

The cost would be split between the firm used to make and receive the payment. To refuse a claim, firms would have to prove the customer acted with “gross negligence”.

On Wednesday, the PSR announced it would consult on reducing its limit to £85,000 after strong pressure from the industry and government.

Multiple people familiar with the matter told City A.M. that a lowering of the threshold is expected as a result. The PSR declined to comment on its plans.

The eleventh-hour announcement has angered consumer groups but been welcomed by financial trade bodies that have been lobbying for an £85,000 threshold since a consultation published last August. They argue this limit would cover 99.7 per cent of claims.

Payment firms, particularly smaller fintechs, have privately warned that a £415,000 threshold could put some out of business and deter early-stage investors.

“If you take a couple of those hits, that’s very significant for working capital and investment,” said a senior fintech official.

“Given a choice between a healthtech, an insurtech or a paytech, who’s going to choose to put their money into a paytech company that could lose it through APP fraud claims in a matter of weeks?” another added.

A person familiar with the discussions said the Treasury had backed an £85,000 limit and then City minister Bim Afolami tried to intervene before the PSR set its £415,000 threshold in December. The Treasury declined to comment.

A cap of £85,000 would fall in line with the deposit protection limit of the Financial Services Compensation Scheme if a UK bank fails, which one fintech official said should align consumer protection with the solvency of firms.

Britons lost £460m to APP fraud last year. The scam involves tricking victims into transferring money from their bank account to a fraudster posing as a genuine payee.

‘This is not the panacea’

Although lowering the cap is most lobbyists’ main goal – other ideas floated include delaying the measures by a year – concerns remain over different areas of the scheme and the logistics of its implementation.

“This is not the panacea that’s going to solve all the industry’s woes. There are still significant problems,” said one senior fintech official.

Riccardo Tordera, director of policy and government relations at The Payments Association, said the trade body would keep pushing for a £30,000 limit, which he claimed would cover more than 95 per cent of cases.

He added that for the five per cent of higher-value claims, “a police report should be mandatory before it moves any further”.

Bosses warn the rules continue to put firms at risk of heavy losses from multiple claims submitted by sophisticated criminal gangs. The PSR acknowledged on Wednesday that, according to its analysis, nearly all high-value scams are made up of a number of smaller transactions.

One banking lobbyist said they were still concerned over a potential rise in “complicit fraud”, when organised criminals pose as victims to claim compensation.

Another argued that “incredibly vague” guidelines from the PSR on how firms could prove “gross negligence” put them at risk of having to refund almost all claims, even if dubious.

Some have taken issue with the PSR’s interpretation of the term as being a “higher standard than the standard of negligence under common law” and argue it virtually guarantees reimbursement in most cases.

“That’s saying pretty much any fraud will be reimbursed without the consumer having to prove anything, from day one,” one source said.

Smaller fintechs are worried that firms with deeper pockets on the other side of the case are likely to approve the majority of small-ticket, first-time refund claims given the difficulty of challenging them.

The PSR has said its criteria for refusing a refund aims “to strike the right balance between encouraging people to be careful and genuine, while making sure there are high levels of protection”.

‘It needs to be phased’

Elsewhere, industry bosses are worried that a number of firms will not be ready to use a communication platform built by Pay.UK for sending and receiving firms to settle reimbursement claims.

It is understood that Pay.UK will likely not have onboarded all of the 1,500 payment firms before 7 October, leaving many at risk of having to report claims manually, including via email.

This could make it harder for companies to communicate with the firm on the other side of the claim and meet the requirement of reimbursing within five working days.

“Our fraud team is focused on fighting fraud, not chasing people to pay us money,” said an official at one of Britain’s largest fintechs. “It’s going to be an administrative nightmare.”

They warned of more friction for customers as “bigger firms might just end up blocking payments to smaller payment system providers” that are not onboarded.

Pay.UK declined to comment on how many firms it had onboarded. “We’ve got the banks that cover the vast majority of fraud in the country registered,” a spokesperson said.

Adding more complexity, a person familiar with the process said big banks that are already signed up to a voluntary fraud reimbursement code were opting to initially remain on an existing system managed by trade body UK Finance, before migrating to Pay.UK’s platform.

Some within the industry are still urging the PSR to delay the regime’s implementation or gradually “phase in” the measures. “Now is not the time to go for the big bang – it needs to be phased,” one source said.

Another said that while the PSR may wish to make further amendments to its plan, it would face heavy scrutiny from the Treasury and Financial Conduct Authority – both of which have raised concerns over the scheme.

David Geale, the PSR’s managing director, said on Wednesday: “Under our proposals, consumers in the UK will still receive world-leading protection, payment providers will still be heavily incentivised to improve anti-fraud protections and we maintain effective market competition and innovation.”