Global menu

Our global pages

Close

More questions than answers – PSR consults on mandatory scam payment reimbursement

  • United Kingdom
  • Financial services disputes and investigations

05-10-2022

The Payment Services Regulator (the “PSR”) has published a new consultation on how it intends to implement mandatory reimbursement for consumer victims of APP scams.

Background

  • in November 2021, we reported on a PSR consultation paper, which first signalled an intention to require mandatory reimbursement by payment service providers (“PSPs”) for APP scam victims. A new consultation published on 30 September 2022, “APP Scams: Requiring Reimbursement” sets out how the PSR hopes to achieve those aims (the “Consultation”)
  • the PSR invites responses to the Consultation by 25 November 2022

Main proposals

  • the PSR’s proposals would provide for mandatory reimbursement to be built into the Faster Payment rules and administered by Pay.UK. The rules would apply to all UK, Authorised Push Payment (“APPs”) scams made by Faster Payment, regardless of value. Excluded, therefore, would be any credit or debit card payments (which are not ‘push’ payments and are perceived as having a greater level of protection) and payments made internationally or by CHAPs
  1. PSPs would be required to reimburse:
    • consumers, micro-enterprises and charities (together, referred to as consumers in the Consultation).
    • as soon as possible, and “no more than 48 hours from the fraud being reported”.
  2. the proposed exceptions to reimbursement are where the consumer:
    • is involved in the fraud; or
    • has acted with gross negligence (the “Exceptions”)
  3. in circumstances where there is “evidence or reasonable grounds for suspicion” that one of the Exceptions applies, the PSP is entitled to delay a refund. There is no proposal as to how long refunds can be delayed, or whether sums could be clawed back if investigations subsequently demonstrate an Exception applies.
  4. it is additionally proposed that PSPs can:
    • set a minimum threshold for a reimbursement claim (no more than £100);
    • withhold an excess (no more than £35); and
    • set a time limit for claims to be reported (no less than 13 months from the payment).

Allocation of reimbursement costs

  • there would be a default 50/50 split between paying and receiving banks, subject to a dispute management process.
  • the Consultation states that 50/50 is not intended to be “a fine-tuned allocation” but it does not detail how a dispute management process would work. For example, could a receiving bank refuse to refund 50% if the paying bank failed to identify an Exception applied?

Vulnerable consumers

  • vulnerable consumers would be exempt from the Exceptions.
  • the PSR confirms it would adopt the FCA’s definition for vulnerable consumers, namely “someone who, due to their personal circumstances, is especially susceptible to harm – particularly when a firm is not acting with appropriate levels of care”.

Gross negligence

  • the PSR concludes that there should be exceptions to reimbursement, but that, aside from first party fraud, this should be confined to gross negligence on the part of a consumer.
  • it is generally accepted that gross negligence is a very high standard. The Consultation does not go into detail about the test, save to link in with the FCA’s guidance on this issue, which describes it as “a very significant degree of carelessness”.
  • in playing down concerns that consumers might be inclined to exercise less caution as a result of the lack of responsibility placed on them, the PSR is apparently influenced by TSB’s confirmation that “it had not identified evidence for customers taking less care since introducing its refund guarantee”.

Monitoring compliance

  • the PSR provides its long-term vision of Pay.UK monitoring and enforcing compliance with rules on mandatory reimbursement.
  • this may, in the long-term, be done by reference to “a separate supporting document or code”.
  • the PSR does, however, recognise that Pay.UK is not currently set up to perform such a role.

Next steps

  • the Financial Services and Markets Bill (the “FSM Bill”), which would empower the PSR to bring about its mandatory reimbursement changes, is currently undergoing readings in Parliament.
  • the PSR envisages the FSM Bill receiving Royal Assent in Spring 2023, with a view to its new rules being published in Q2 of 2023.
  • the PSR wants its “core requirements” of mandatory reimbursement to be in place by “no later than during 2024”.

Comment

  • it is clear from the Consultation that the PSR considers its changes are necessary, not only to ensure consumer reimbursement, but also to incentivise financial institutions to prevent fraud.
  • the existing voluntary Contingent Reimbursement Model Code places expectations on consumers to act on effective warnings provided by the PSP and to have a reasonable basis for believing the transaction to be genuine if they are to be fully refunded. In contrast, very little is expected of consumers under the proposals. This appears to overlook the vital role consumers - who interact directly with the scammer – can play in preventing APP fraud.
  • the Consultation states that there will be “additional friction for a small proportion of payments”, without considering how many transactions might be affected; it concedes that “we have not been able to quantify the likely costs of any delayed or declined payments”. PSPs’ efforts to prevent potentially fraudulent payments are likely to result in significant friction in payment journeys, particularly for higher value payments, given the costs consequences to PSPs should fraudulent payments be processed. This appears to be an inevitable consequence of the PSR’s proposals and one which may significantly impact legitimate customers. The potential impact of this is perhaps underplayed by the Consultation.
  • the Consultation does not engage with the great variety of APP scams and how they are perpetrated. The mandatory reimbursement solution replicates the unauthorised payments refund regime, but these two types of fraud and how they unfold differ markedly (for example, unauthorised payments typically take place without the consumer’s knowledge). This means that the existing refund regime for unauthorised payments does not necessarily provide an appropriate framework for more nuanced APP fraud refunds.
  • the requirement to refund within 48 hours overlooks the significant complexity of many APP scams. For example, in high-value investment scams it may not be immediately evident whether a customer has been scammed or simply made poor investment decisions. Concluding investigations and refunding within 48 hours, particularly across a weekend, seems unrealistic. Perhaps a tiered system, providing PSPs with more time to investigate more complex, higher value cases, would be sensible (although defining complexity in itself would require detailed consideration) .
  • an increasing proportion of scams involve consumers being convinced to move payments from their bank accounts to accounts in their name with legitimate cryptocurrency platforms, with converted cryptocurrency then transferred to the scammer. The funds remain in the consumers’ control after the initial transfers from the account with the PSP and the scam takes place from the cryptocurrency wallet (and not by Faster Payment). It is not clear if such scenarios are intended to be covered by the mandatory reimbursement proposal. This appears to be a potential gap in the analysis. The cryptocurrency exchanges cannot, as it stands, be required to refund their customers.
  • the PSR says that its proposals are proportionate. The decision to exclude large businesses and the application of the Exceptions are intended to reduce the burden for PSPs. Given that the main reimbursement exception is for cases of gross negligence, which is recognised by the FCA to involve “a very significant degree of carelessness”, the proposed shift would effectively require reimbursement for most domestic APP scam payments made by Faster Payment. PSPs might therefore be inclined to refuse any atypical payment instructions until they can be close to certain that an arrangement is genuine, with warnings becoming geared around demonstrating gross negligence on the consumers’ part if they proceed notwithstanding a clear warning of a potential scam.
  • UK Finance (“UKF”) has previously stated that introducing mandatory reimbursement will not, of itself, reduce fraud levels. The clear steer from UKF is that action must be taken, including by the technology and telecommunications sectors, to prevent scammers freely being able to reach consumers (whether by scam texts or adverts on social media) in order to perpetrate scams. The Consultation references that, but concedes that it is “focusing on the parts of the APP scam ‘ecosystem’ that are within [PSR’s] remit’.
  • the technology and telecommunications sectors are likely to be impacted in this area by the measures to be introduced by the Online Safety Bill. There is, however, no current plan to require those sectors to contribute towards reimbursement costs. It is disappointing that proposed legislation to address APP fraud will not adopt a joined up approach to tackling the problem and that the cost of reimbursing consumers is proposed to sit solely with PSPs.