Will mandatory reimbursement of Authorised Push Payment (“APP”) fraud victims foster better outcomes for consumers or drive excessive risk aversion in banks? Although the future requirement to reimburse victims of APP scams in all but exceptional cases is aimed at encouraging banks and building societies to do more to prevent scams from happening in the first place, it may have some unintended consequences, including more onerous checks before the transaction is authorised and longer processing times. Contrary to the rationale behind the measures, it is also likely to place a disproportionate burden on sending payment services providers.

The Financial Services and Markets Bill provides a mandatory liability framework for the reimbursement of victims of APP fraud. This applies to any scams falling within the definition of a “qualifying case” set out in section 68(2) of the Bill: ‘(a) the case relates to a payment order executed over the Faster Payments Scheme, and (b) the payment order was executed subsequent to fraud or dishonesty’. This broad definition means that the mandatory reimbursement will apply to scams ranging from investment fraud to romance scams, despite the fact that the firm’s ability to safeguard their customers against these types of scams will vary.

Contrary to the views expressed by the Payment Systems Regulator (“PSR”), guaranteed repayment in all but exceptional cases is likely to have the effect of removing the link between conduct and consequence, with customers taking less personal responsibility for their actions. Coupled with an absence of a cap on the amount that has to be reimbursed, the potential liability is significant. Even though the PSR anticipates that in practice most PSPs’ Faster Payments transactions limits are considerably below £1 million, a risk remains that some customers may recklessly part with such substantial amounts, knowing that they have a safety net if the purpose of the transfer turns out to be fraudulent. This may have prudential implications, in the extreme affecting their ability to service other clients.

Even though this impact is meant to be offset by the receiving PSP bearing some of the cost of reimbursement, it is unclear how this will be enforced in practice. There is currently no proposal on how quickly the receiving PSP would be required to reimburse its proportion of the customer refund to the sending PSP who is obliged to compensate the customer within 48 hours from the fraud being reported. The fact that the 50:50 allocation consulted on is subject to possible adjustment is likely to further delay the payment by the receiving PSP and increase the costs for both parties of arriving at acceptable split. The actual adverse impact on the sending PSP will also be exacerbated if the receiving PSP is based outside the UK. Even though many scams have a cross-border element, the PSR’s proposal made only one reference to the use of accounts in jurisdictions outside the UK without addressing what the regulator’s expectation would be in this scenario.

Another aspect of the rules which is open to criticism is the speed at which the sending PSP must reimburse the victim, unless the sending PSP has evidence or reasonable grounds for suspicion of either first party fraud or gross negligence. The increasing sophistication of the fraudsters means that 48 hours may be insufficient to properly interrogate the report to establish whether the customer may have been party to the fraud or acted with gross negligence. The PSR also emphasised that gross negligence is a very high bar and there may still be circumstances in which it will be appropriate for a PSP to reimburse, or partially reimburse, a consumer who had acted with gross negligence if the PSP should clearly have detected and stopped the payment. The PSR noted that it would ultimately be for the Financial Ombudsman Service (“FOS”) to determine whether compensation would be required on the facts of a particular case. This risks the PSR’s intention to ensure consistent assessment of claims being undermined as the FOS’ determinations do not set precedents for future claims. There is, therefore, little prospect for consistent interpretation on what amounts to gross negligence.

In response to these rules, PSPs are likely to introduce more onerous checks that the customers will need to pass, before they can proceed with fund transfers, in particular where the amounts are significant. This may have the effect of customer flight to institutions with lesser safeguards.

CONCLUSION

Mandatory reimbursement requirement in cases of APP fraud is a step too far. Any measures that are ultimately implemented should balance the need to protect consumers against the principle of personal responsibility and what can realistically be done to prevent ever more sophisticated scams.