Delaying UK APP fraud compensation scheme ‘may be considered prudent’

Jacob Hay of Pinsent Masons was commenting after the Financial Times reported on Tuesday that the UK Treasury has questioned whether pushing ahead with the planned introduction of a new mandatory reimbursement scheme for authorised push payment (APP) fraud on 7 October 2024 is “sensible”.

APP fraud occurs when someone is tricked into sending money to a fraudster posing as a genuine payee. Fraudsters often use methods such as social engineering and impersonation to manipulate and gain the trust of victims.

Under the new regime, which the Payment Systems Regulator (PSR) developed in accordance with its obligations under the Financial Services and Markets Act 2023, payment firms, including banks and building societies, will be required to reimburse customers within five working days of a report that they have fallen victim to APP fraud, subject to any ‘stop the clock’ provisions applying. The reimbursement requirement applies when the Faster Payments scheme operated by Pay UK is used, with the maximum compensation payable set at £415,000. Firms may apply a maximum excess of £100 to a claim except where a customer is vulnerable, in which case no excess may be applied.

For a claim to be valid and therefore qualify for reimbursement, the customer is expected to have exercised a minimum degree of caution – known as the consumer standard of caution – and to have reported their claim no later than 13 months after the incident. If a consumer, with ‘gross negligence’ – which the PSR states means a significant degree of carelessness - fails to meet one or more of these standards, firms will not be required to reimburse them. An exception again exists for vulnerable customers, where the consumer standard of caution cannot be used to deny reimbursement.

Earlier this month, the PSR reported there were 252,626 cases of APP scams across the UK’s 14 largest banking groups as well as 11 other smaller firms, in 2023. The total value of those scams was almost £341 million. 

At the time, David Geale, managing director of the PSR, said that shift from a voluntary system of reimbursement to the mandatory scheme in October “will dramatically increase protection for consumers” and that the regulator is “already seeing payment firms innovating and improving their controls, which is key to preventing scams from happening in the first place”. However, some stakeholders within the UK finance industry have raised concerns about the potential impact of the new mandatory reimbursement scheme.

When plans for a new mandatory reimbursement scheme for APP fraud were first trailed, Jamie McNaught, founder and chief executive of cryptoasset exchange Solidi, told Out-Law that a “cottage industry for fraud” could emerge if mandatory reimbursement for victims of APP scams was introduced without proper safeguards.

McNaught said at the time: “We know that there are legitimate victims of APP fraud, but we also know that there are ‘victims’ who are complicit in the scams. We know this because of the complex fraud systems we have in place. These people include ‘money mules’ who are directed by sophisticated criminals on how to move money around, including on cryptoasset exchanges, and who subsequently claim to be innocent victims of fraud. They seek ‘refunds’ whilst also sharing in the defrauded funds.”

"The due process that currently exists for APP scam reversals is very, very poor and not transparent. We don’t get to see any of the evidence. If this continues under the proposed mandatory reimbursement scheme, funds would be lifted from our client money account even if we suspect the customer is complicit in the fraud. There would be no way to disprove what the fraudster says. It would be our word against theirs. To my mind, this essentially creates a cottage industry for fraud,” he said.

In an article published by trade body UK Finance last month, Rob Woods, a director at LexisNexis Risk Solutions, said implementation of the mandatory APP reimbursement scheme could “risk destabilising the financial ecosystem”. He warned of “unintended consequences” from the way the new rules might operate, including a “a decline in innovation and competitive standards” as a result of the £415,000 cap being set too high, as well as of the potential for “a two-tier system” to emerge – where some payment providers would “view one another as safe” while deeming “outsiders … as higher risk”.

Woods also said the rules could negatively impact customer service, result in consumers becoming “more ambivalent to scams, knowing they are covered by their payment providers”, and lead to the “wrongful debanking” of “unwitting money mule” account holders.

Hay said: “Recent reports make clear that there is a tension between, on the one hand, the wish to compensate genuine victims of fraud and, on the other hand, the need to ensure proper controls to avoid abuse of the scheme and the need for a fair allocation of risk.”

“There are legitimate fears of misuse of the proposed mandatory reimbursement requirement. While there are sadly a large number of instances of APP fraud, the scope for abuse of the proposed scheme – by making a payment and later claiming it was fraudulent – and the limited defences open to a bank under the proposed rules are significant issues. The burden of the proposed rules would be felt by all industry actors, but particularly smaller payment service providers who will need to underwrite a significantly increased operating risk,” he said.

“Given that the contingent reimbursement model is already in place, government and regulators may consider a delay to implementation a prudent step to allow these concerns to be more fully explored,” Hay added.