Banks may have to refund victims of cash transfer scams from next year

The Financial Conduct Authority (FCA) and the Payment Systems Regulator (PSR) today backed a range of measures to give consumers greater protection from 'authorised push payment' (APP) scams.

These are when unsuspecting customers transfer money from their own bank account to one belonging to a criminal. The lost money is then quickly transferred to numerous other accounts, often abroad, and then withdrawn by the crooks.

Some £101 million was unwittingly handed over to criminals this way between January and June this year, new figures show, but only a quarter of this was recovered by banks. Of the 19,370 cases in this period, 88% saw consumers lose an average of £3,000, and the remainder were businesses that lost on average £21,500.

City regulator the FCA acknowledged that not enough is being done to protect consumers from this type of scam, which can often bypass a bank's security and sees fraudsters deploy sophisticated trickery such as posing as police officers, bank staff or solicitors – and even involve sending fake invoices.

With the PSR the FCA is calling for a new system to reimburse scam victims, which must be in place by September 2018. At the moment, banks can decide whether or not to refund lost cash, which often depends on whether they consider the customer has been negligent or not and whether they can recoup the funds.

For more ways to protect yourself, see our 30+ Ways to Stop Scams guide.

What will change?

The new scheme would refund victims who could not have "reasonably" prevented the scam and where, at the same time, their bank (or the fraudster's bank) failed to follow industry guidelines to prevent the fraud taking place.

The regulators are also considering the possibility of a central fund to reimburse victims who acted reasonably but lost cash even though their banks followed the guidelines.

From next year, when transferring money, customers will also be shown the name of the person they are sending cash to (as well as the name of the bank) – this should ring alarm bells if it's not who the sender thought it was, and allow them to stop the payment.

The regulators have also today backed UK Finance, an industry body representing banks, which has announced 'best practice' scam transfer guidelines for its members. The measures are:

• Banks will have 24-hour, seven-day-a-week dedicated staff trained in scam management to deal with these complaints.

• A customer will only have to deal with their own bank or account provider – it'll be their sole point of contact. The victim's bank will act as the intermediary between the victim and the other bank.

• The victim's bank will collect a clear set of necessary information, agreed by the industry, following these scam complaints, to allow the bank used by the fraudster to investigate.

• The bank used by the fraudster will conduct an investigation, recover the scammed cash where possible and return it to the victim if it can.

• From 2020 banks will share more information to support investigations and protect victims.

UK Finance also said the law may need to be reviewed to equip banks with more powers to return funds to victims and potentially allow criminal funds – currently frozen in bank accounts – to be used to tackle scams and help victims.

Banks will also collect more data on this type of scam to establish the scale of the issue, and provide bi-annual updates.

The FCA and PSR have been investigating how banks deal with this type of scam since September 2016, after consumer group Which? submitted a super-complaint calling for banks to shoulder more responsibility for money lost to scams made by bank transfer. It wanted to see how customers are reimbursed with transfers compared with when they lose money due to scams via direct debits, credit and debit cards or fraudulent account activity.

Four tips to avoid being a victim of fraud

UK Finance has worked with the Government to produce help-sheets and a website to try to prevent consumers being scammed. They include:

• Remember that just because someone knows some personal details – such as your name and address or your mother's maiden name – does not mean they are genuine.

• Banks or trusted organisations such as the police will never contact you asking for your PIN or full password, or to transfer money to a safe account.

• Always question uninvited approaches asking for information – it could be a scam. Instead contact the company directly using a trusted email or phone number to check the request is genuine.

• Never automatically click on a link in an unexpected email or text.

If you think you've been a victim or fraud, or if you suspect a fraudster has targeted you, report it immediately to your bank and then contact Action Fraud, or call it on 0300 123 2040.

What do the regulators say?

The FCA said: "We have engaged with a number of banks to understand their policies and procedures for handling push payment scams. In general, the FCA found that the procedures for handling cases of push payment scams are often unclear and not consistently applied, and there are insufficient data to understand the scale of these scams.

"The nature of push payment scams is that they get around banks' existing systems and controls to detect fraud, and although banks are working to improve their ability to detect these kind of scams, some banks have made more progress than others."

It said it would monitor how banks adopt and implement UK Finance's best practice guidelines.

Victims tricked into transferring cash may be reimbursed from next year

Hannah Nixon, managing director of the PSR,  said: "There are now a broad range of initiatives that will make it harder for criminals to commit APP scams. Cumulatively all of these new measures will make a positive difference to those who fall victim to APP scams, will help to prevent APP scams from happening in the first place, and help ensure banks adhere to the best practice standards they've agreed to.

"However, there is no silver bullet for APP scams, and some people will still, unfortunately, lose out.  That's why we've continued to look for a solution that could reimburse those who are scammed, and today we begin consulting on an option that we think could work.

"To be successful, the model must be pragmatic: consumers will need to be vigilant and protect themselves, but equally we expect banks and payment service providers to uphold best practice – and when they don't, there should be reimbursement."

What do the banks say?

Stephen Jones, UK Finance chief executive, said: "Today marks an important step forward in the battle to fight the serious problem of criminals tricking customers into authorising payments and we are pleased the regulator has acknowledged everything the industry has achieved to date.

"We are under no illusion that more needs to be done and we support the PSR's desire to develop a mechanism to return more stolen funds to victims."

'If this stops the huge amounts of money lost to bank transfer scams, it'll be a significant win'

Peter Vicary-Smith, Which? chief executive, said: "A year on from our super-complaint, it's good to see the regulator coming down on the side of consumers. If this stops the huge amounts of money lost to bank transfer scams, it'll be a significant win.

"To make this a reality, the regulator must now ensure any reimbursement scheme properly compensates victims. Meanwhile, banks must move to quickly put in place better checks and protections to prevent these scams happening in the first place."