The eyes of the fraud prevention world are on the UK. On 7 October 2024, the Payment Systems Regulator’s (PSR) new rules on mandatory reimbursement come into force.
Payment service providers (PSPs) will enter uncharted regulatory territory. UK consumers will be entitled to automatic reimbursement for Authorised Push Payment (APP) fraud losses, with the costs shared 50/50 between sending and receiving banks. CHAPs and BACs payments, subject to a different regulatory regime, look set to follow.
The rule changes replace the current voluntary system of reimbursement operated by the signatories of the Contingent Reimbursement Model Code and have been many years in the making.
For consumers, the rule changes are undoubtedly good news. They sweep away a patchwork of practice and processes, in which the likelihood of getting money back depended entirely on where the victim banked, with some refunding almost all fraud losses, others much less. Now, much-needed consistency will be brought to the system, with automatic remedy for almost all consumers.
Consumer groups argue that the change is long overdue. And there are few that would disagree that fraud is rife, and APP fraud (or scams) in particular endemic. The most recent figures published by UK Finance point to the scale of the problem. UK consumers lost nearly £460 million to APP fraud in 2023 alone.
Industry’s response to the reimbursement cap
The regulator has been clear that more needs to be done. It has argued that forcing the full cost of reimbursement on to PSPs will drive investment in better fraud detection systems. There is some credence to this. A number of cross-industry initiatives and solutions have emerged to respond to the problem, including Cifas’ own peer-to-peer data-sharing services.
But for the industry, the changes have been nothing if not contentious. Some of the heat may have been taken out of the discussion by the PSR’s last-minute decision to reduce the higher limit for reimbursement from a proposed £415,000 to £85,000. But even at this lower level, the industry is concerned at the administrative and financial burdens the rule changes may bring.
Mike Haley, chief executive officer of Cifas
There are those that worry that the costs of complying with the policy may simply be financially unsustainable, driving some of the smaller players from the market and causing others to introduce new charges to help meet the costs. Others are concerned at the impact on consumer behaviours, not just reduced caution, but that the changes might incentivise people to commit fraud – so-called ‘moral hazard’.
Cifas research has shown that public attitudes to first-party fraud are increasingly worrying too, with 1 in 8 adults admitting to perpetrating some type of first party fraud in the last 12 months. The concern is that the PSR rule changes will only exacerbate the problem.
While the PSR policy provides important exemptions around individual consumers acting fraudulently, industry has been critical both about the lack of meaningful guidance around the standard of proof, and the very high bar for demonstrating negligence on the part of the consumer. For the scheme to work effectively, these gaps will need to be closed.
Will the PSR reforms make the UK even more attractive to fraudsters?
The greater danger is that organised fraud groups will see the rule changes as a way of making even more money. Whether by convincing members of the public into posing as victims of fraud or acting as mules in return for a share of the proceeds; the concerns are real. The sale of ‘crime-as-a-service/fraud-as-a-service’ toolkits online and the ease through which AI tools can be used to commit fraud will only make matters worse.
I am loathe to predict the future but, there a number of things that will need to happen if the worst potential impacts of this step into the regulatory unknown are to be mitigated.
- The PSR will need to work closely with industry to quickly locate pain-points and find solutions, issuing guidance as necessary.
- There needs to be a robust law enforcement response to any abuse of the reimbursement scheme. Clear deterrence will help ensure that consumers are not tempted to commit first-party fraud.
- The government must do more to help prevent re-victimisation. Research from Victim Support has revealed that, 18% of victims who are repeat victims of fraud, account for 35% of all fraud. Cifas is ready to help. We have launched our new APP Victim Check service to ensure that, through the sharing of data on victims of APP fraud, effective controls and protections can be put in place to prevent re-victimisation across all accounts that a victim holds.
No-one should doubt the intent of the PSR’s rule changes. Improved consumer protections should be welcomed, alongside the incentive to invest more in fraud prevention tools. But we mustn’t shy away from the risks.
For the rule changes to suit all – consumers and industry – the PSR will need to work with industry to close the gaps in the guidance and address loopholes as they emerge. But this is not for the PSR alone, it will take close collaboration with industry and law enforcement. Government for its part, will need to continue the reform of the wider fraud policy framework creating the right conditions, not just for the industry, but all parts of the value chain, to act together and stop the fraudsters.
Mike Haley is chief executive officer of Cifas
