The Payment Systems Regulator (PSR) is proposing new measures to fight payment scams – and the Regulator issued a consultation paper (CP22/4) in September 2022 relating to authorised push payment (APP) scams. APP scams happen when fraudsters trick someone into sending a payment to a bank account controlled by the fraudster. Once a victim realises they’ve been scammed it’s often too late to stop it.
In July 2022, the government published its Financial Services and Markets Bill which placed a duty on the PSR to take regulatory action. The Bill also allows the PSR to use its regulatory powers to require PSPs to reimburse APP scam victims. And this is the focus of the above consultation paper. This reimbursement will be mandatory in most cases.
Currently, ten PSPs have signed up to a Contingent Reimbursement Model Code. However, the overall level of reimbursement under the Code is still below 50% – and participation in the Code is voluntary. Many PSPs are not signatories and offer lower levels of protection, leaving many consumers exposed to significant risk.
If the Payment Systems Regulator’s plans come into force, this will be a significant change for payment institutions and electronic money institutions – and responses to the consultation paper are required by 5pm on 25 November 2022.
What is being proposed by the PSR?
The PSR wants the payments industry to change the way it manages APP scams. It is proposing measures to:
- require reimbursement
- improve the level of protection for APP scam victims
- incentivise PSPs to prevent APP scams, whether as a sending PSP (which has the account the payment is made from) or a receiving PSP (which has the account the payment is made to)
These measures aim to protect people from scams and build their confidence in the UK payment systems.
Mandatory reimbursement
The PSR proposes to require all PSPs sending payments over Faster Payments to fully reimburse APP scam victims, with only limited exceptions. This will apply to consumers, micro-enterprises and charities. This will apply to both PSPs as Faster Payments participants and PSPs which access Faster Payments through an indirect access provider.
The exceptions will include scams where the consumer is involved in the fraud themselves, or where they have acted with gross negligence. The exception for gross negligence is a high bar, which the PSR expects will apply in only a small minority of cases. It would not apply where a consumer was vulnerable.
The sending PSP will have to reimburse the victim as soon as possible, and no more than 48 hours from the fraud being reported. If the PSP has evidence or reasonable grounds for suspicion of either first party fraud or gross negligence, it will have more time to investigate and can delay the payment.
The PSR proposes to allow PSPs to:
- have a minimum threshold for a reimbursement claim (of no more than £100)
- withhold an ‘excess’ (of no more than £35)
- set a time limit for claims (of no less than 13 months)
Allocating the costs of reimbursement
Both sending and receiving PSPs can take steps to detect potential frauds, and can stop payments or block accounts if they suspect fraud. Currently, sending PSPs pick up the vast majority of the costs of reimbursement under the CRM Code (over 95%). This means receiving banks do not have strong incentives to prevent fraud and stop fraudsters controlling their accounts.
The PSR proposes to allocate the costs of reimbursement equally between sending and receiving PSPs, with a default 50:50 split. PSPs can use a dispute management process to adjust the allocation, to better reflect the steps each PSP took to prevent the scam. The PSR doesn’t intend the 50:50 default to be a fine-tuned allocation, but to provide adequate incentives for both sending and receiving PSPs.
The PSR would like to see its core requirements for mandatory reimbursement in place for consumers as soon as possible, and no later than during 2024.