Victim of a money transfer scam? You now have new rights with most banks

The voluntary code of practice for authorised push payment (APP) scams states that victims should be reimbursed unless they ignored their bank's warnings about the scam or were "grossly negligent" in transferring the money. It applies to scams reported from today (Tuesday 28 May).

Until now, while banks have generally given refunds when payments are fraudulently made without customers' authorisation, they haven't been obliged to give a refund when someone has been tricked into making a payment themselves.

This is a new and untested code of practice, so we'll have to see how effective it is in practice. While we explain what's in the code and your new rights below, the most important thing to know is what to watch out for to avoid becoming a victim. 

For more help staying safe, see our 30+ Ways to Stop Scams guide.

What is an authorised push payment scam?

APP scams occur when someone transfers money from their own bank account to one belonging to a criminal. The lost money is then transferred to numerous other accounts, often abroad, and withdrawn by the crooks.

Figures released by trade association UK Finance last year show that in the first half of 2018, consumers lost £92.9 million because of this type of fraud.

How to avoid being a victim – what to watch out for

Earlier this year, UK Finance worked with the Government to produce help-sheets and a website to try to prevent consumers falling victim to this kind of scam. Here are a few of its tips:

• Remember that just because someone knows some personal details – such as your name and address or your mother's maiden name – that doesn't mean they are genuine.

• Banks or trusted organisations such as the police will NEVER contact you asking you to give your PIN or full password, or transfer money to another account. 

• Always question uninvited approaches asking for information – they could be scams. Instead, contact the company directly using a trusted email or phone number to check the request is genuine.

• Never automatically click on a link in an unexpected email or text.

See our 30+ Ways to Stop Scams guide for more help. 

How does the new code of practice work?

The voluntary code commits banks that are signed up to it to a series of measures to tackle APP fraud, such as educating customers about scammers and how they work. It also says banks must try to identify customers who are at higher risk of becoming a victim, warn customers when they've spotted a scam and try to delay payments while investigating potential scams.

It's worth noting the code only applies to transfers between UK accounts. Overseas accounts aren't covered.

The way refunds will work is as follows:

• If the bank's to blame, it'll give a full refund. Where a bank fails to meet the code's standards, it'll fully reimburse the customer, providing they did everything expected of them. 

• If neither bank nor customer is to blame, the customer will still get a full refund. This won't come direct from the bank though. Where the customer and banks involved in a transaction have met their expected level of care, the customer will be reimbursed from a collective pot funded by the banks – the long-term funding arrangements are in the process of being agreed.

• Where there's shared blame, the customer will get a partial refund. The amount depends on who's to blame out of those involved. For example, if you and the banks receiving and sending the money all fail to meet the standards expected, you'll get a third of the money you lost from each bank but have to swallow the remaining third of the loss yourself.

• If customers are to blame, they won't get a refund. If customers are found to be "grossly negligent", they won't get any money back. See more below on what's expected of the customer. 

Banks will usually have to decide whether or not to refund a victim within 15 working days of the scam being reported, up to a maximum of 35 working days "in exceptional cases", and must then issue the refund as soon as possible. If you disagree with your bank's ruling, you can complain to the Financial Ombudsman (see more below).

What's expected of the customer?

There's no set definition in the code of exactly what a customer must do to comply with its requirements, but it does state that you wouldn't receive a payout if, for example, you made the payment without a reasonable basis for believing that:

• the payee was the person you were expecting to pay

• the payment was for genuine goods or services

• the person or business who you were completing the transaction with was legitimate

For example, you might not get a refund if you bought a car on eBay, the seller asked you to complete the transaction off the site and you sent them a large amount of money without ever having seen the car or pictures of it. However, if you'd gone and seen the car and spoken to the seller before making the payment, you could have a reasonable basis for thinking the payment was for a genuine purchase, even if it turned out to be a fraud.

There's an exception to the rules above if a customer is classed as 'vulnerable'. The code says: "A customer is vulnerable to APP scams if it would not be reasonable to expect that customer to have protected themselves, at the time of becoming victim of an APP scam, against that particular APP scam, to the extent of the impact they suffered. This should be assessed on a case-by-case basis."

In these cases, customers should be refunded even if they don't meet the provisions set out above.

Which banks are signed up to the code?

The following banks and payment service providers have signed up to the code:

• Bank of Scotland

• Barclays

• Cahoot 

• Cater Allen

• First Direct

• Halifax

• HSBC UK

• Intelligent Finance

• Lloyds Bank

• M&S Bank

• Metro Bank

• NatWest

• RBS

• Santander

• Starling Bank

• Ulster Bank

Big names that haven't signed up so far include Tesco Bank, Co-operative Bank, Clydesdale Bank, Yorkshire Bank and Virgin Money.

What to do if you're a victim of a bank transfer scam

Your first port of call is to complain to your bank. You should also then report the scam to Action Fraud (you can call it on 0300 123 2040).

If your bank won't help, or you haven't heard back within eight weeks, you can then go to the ombudsman. It can help sooner if your bank has sent you a rejection letter suggesting you use the ombudsman.To start your complaint, fill in a form at the Financial Ombudsman Service website or call 0800 0234 567.

From today, the ombudsman will consider the code for banks that have signed up to it, and some within the industry expect that it may become considered across the board in future.

If you were the victim of APP fraud before today, the code technically won't apply. However, you could still complain in the normal way, perhaps using the existence of the code to help make your case.