UK payment firms face new compensation requirements of up to £415,000 to victims of authorised push payment (APP) fraud from later this year, the Payment Systems Regulator (PSR) has announced.
The PSR was tasked under the Financial Services and Markets Act 2023 to impose a requirement for reimbursement to protect victims of this type of fraud, which occurs when someone is tricked into sending money to a fraudster posing as a genuine payee. Fraudsters may use methods such as social engineering and impersonation to manipulate and gain the trust of victims, with losses nearly £500 million across the UK last year due to APP, according to figures from UK Finance.
The PSR has now confirmed (69 pages/753 KB) that a reimbursement scheme will become mandatory from 7 October 2024. The regulator had previously consulted on its reimbursement requirement proposals in a series of consultations published throughout 2023.
Under the new regime, payment firms, including banks and building societies, will be required to reimburse customers within five working days of a report that they have fallen victim to APP fraud, subject to any ‘stop the clock’ provisions applying. The reimbursement requirement applies when the Faster Payments scheme operated by Pay UK is used, with the maximum compensation payable set at £415,000. Firms may apply a maximum excess of £100 to a claim except where a customer is vulnerable, in which case no excess may be applied.
For a claim to be valid and therefore qualify for reimbursement, the customer is expected to have exercised a minimum degree of caution – known as the consumer standard of caution – and to have reported their claim no later than 13 months after the incident. If a consumer, with ‘gross negligence’ – which the PSR states means a significant degree of carelessness - fails to meet one or more of these standards, firms will not be required to reimburse them. An exception again exists for vulnerable customers, where the consumer standard of caution cannot be used to deny reimbursement.
The consumer standard of caution involves four elements. These are that the consumer should have regard to interventions including any police warning about the payment; that the consumer should report the matter promptly and in any case within 13 months; that the consumer should respond to relevant and appropriate requests for information about their claim; and that the consumer should report the incident to the police or consent to their bank or building society reporting the matter to the police.
Payment services and financial regulation expert Andrew Barber of Pinsent Masons said: “The PSR is sending a strong message about the importance of preventing fraud. We expect to see this incentivise firms to examine their systems to ensure robust fraud prevention controls, which will ultimately benefit both firms and customers if payments never reach fraudsters in the first place.”
He added: “The additional clarity over the consumer standard of caution is welcomed. Firms seeking to use this as a basis to refuse reimbursement in any particular case will, however, need to be mindful of both assessments of consumer vulnerability and of the threshold of gross negligence. The PSR has stated that a firm will have to look at the reason why a consumer did not meet one of the requirements in the standard of caution before determining that there has been gross negligence. Firms would be well advised to document any decisions they make in this area.”
Financial regulation expert Venetia Jackson of Pinsent Masons added: “Where firms seek to rely on having provided warning to consumers to decline reimbursement, they should note that the PSR policy statement makes it clear that firms cannot rely on general warnings when looking at the consumer standard of caution and potential gross negligence. Interventions must offer a clear assessment of the probability that an intended payment is an APP scam payment.”
“The PSR expects that interventions will be broader than purely textual interventions. If a firm is relying on a textual intervention, it will need to be sufficiently specific to meet the clear assessment and specificity expected by the PSR,” she said.
Information sharing is built into the new regime both from the consumer and firm perspective. Where consumers bring claims through a claims management company, the same information sharing expectation in the consumer standard of caution applies as if the consumer had brought the claim directly. From the firm perspective, the scheme rules to be created by Pay.UK will include requirements on firms to notify the firm on the receiving end of the payment of APP fraud claims and for receiving firms to co-operate and provide information to help in the assessment of claims. A potential incentive for prompt and accurate assessment lies in the ability of the sending firm to require the receiving firm to contribute 50% of the compensation, but if the sending firm declines the reimbursement claim and this is later overturned by the Financial Ombudsman, the sending firm will be liable for 100% of the claim and cannot seek a contribution from the receiving firm under the scheme rules.
Pay.UK is required to create and publish the new Faster Payments scheme rules providing for these measures by 7 June 2024.
Jackson said that the PSR’s statement reflected “the general approach of the financial sector regulators to require firms to be more proactive in improving their systems and controls to minimise risks and to be more co-operative with each other when issues arise”.
Contact an adviser
