Changes To APP Fraud Reimbursement
From 7th October 2024

While fraud is not new, digital fraud took off as we all became increasingly reliant on the internet. A Faster Payments System (FPS) was launched in 2008 to help people move money more quickly and securely between UK banks, 24 hours a day. As the use of FPS increased, so did the number of fraud cases.

Since FPS is a real-time payment system, it is possible to move money into a scammer’s control before a victim even realises that they have been scammed. Modern-day fraud requires modern-day fraud prevention, including real-time monitoring and robust risk profile assessment.

Authorised Push Payment (APP) fraud is a global issue that is rising year on year. In 2023 alone, the UK lost over £450 million to APP Fraud. The APP fraud reimbursement rate was around 67% in 2023, but varied considerably depending on who you bank with. The new rules should mean a more proactive focus on protecting customers and less variation between banks when reimbursing customers.

Section 72 of the Financial Services and Markets Act 2023 required the Payment Systems Regulator (PSR) to draft a document explaining how customers will be reimbursed after losing money through fraudulent transactions made over the Faster Payments Scheme. The PSR oversees contactless payments, money transfers, and cash machine use in the UK. Its vision is to ensure that “payment systems are accessible, reliable, secure, and value for money.”

The PSR proposed the new regulation in June 2023, and it was implemented on 7^th October 2024.

The Payment Services Regulations 2017 have been updated to The Payment Services (Amendment) Regulations 2024, and apply in England and Wales, Scotland, and Northern Ireland.

According to the Payment Systems Regulator:

“The new requirements will prompt a step change in the culture of payments to improve fraud prevention and focus all firms on protecting people.

• There will be new rules in Faster Payments – the payment system across which the vast majority of APP fraud currently takes place – strengthening Pay.UK’s ability to tackle fraud.

• All payment firms will be incentivised to take action, with both sending and receiving firms splitting the costs of reimbursement 50:50.

• Customers will be more protected under consistent minimum standards, with most APP fraud victims being reimbursed within five business days and additional protections offered for vulnerable customers.

• Industry will have clearer guidance to follow, including around the ability to apply a claim excess and maximum level of reimbursement, which the PSR will consult on later this year.”

Both the banking industry and the Treasury expressed concerns over the new proposals, which they said were likely to increase costs for all payment service providers and could be unaffordable for smaller firms. Some firms requested a delay to enable them to fully prepare and ensure that the correct policies, technology and systems were in place.

Since 2019, a voluntary scheme (the Contingent Repayment Model) was in place, which most of the bigger banks signed up to. It offered additional consumer protection and guaranteed refunds unless there were exceptional circumstances. Although it is claimed that this covered more than 90% of APP transactions in the UK, the Financial Ombudsman said that the code might only have covered around half of APP fraud cases.

Companies can now find themselves under increased scrutiny from the city watchdog, the Financial Conduct Authority (FCA), and expected to demonstrate good fraud prevention and investigation systems, as well as excellent customer service, communication, and education.

Under the 50:50 reimbursement model, firms that were working hard to combat fraud were not distinguished from those that hadn’t. Concerns were also raised that the changes could lead to new types of APP fraud scams, where scammers pose as victims to claim reimbursement money.

It should also be noted that the new regulations do not cover certain types of APP fraud, including payments made by debit or credit card for fake investment opportunities advertised on social media. Currently, social media companies bear no responsibility for reimbursing victims.

A claims management system will be in place, operated by Pay UK, which the sending and receiving payment services firms (PSPs) should use. This is known as the Reimbursement Claims Management System (RCMS) Core + Claims.

The specific details of how this system works can be found in a 27-page document published on 3^rd September 2024. Some of the key takeaways include:

• If PSPs cannot access the system, they can report cases manually. However, this could add a time delay for reimbursement. There is a proposed date of 1^st May 2025, by which time all PSPs must be onboarded to and using the new system.
• Scam victims initially make an APP scam claim to their sending PSP (the bank that sent their money to the scammer’s account). A £100 excess fee will apply per claims, except for vulnerable customers. Refunds must be made by the sending PSP within five business days. The sending PSP then submits refund details to the receiving PSP, who must reimburse their share within five business days.
• The five-day window can be paused to allow further information to be gathered from the victim or other PSPs, and to verify that the claim is legitimate
• If a PSP can demonstrate the consumer acted negligently, PSPs are not required to pay.
• The rules apply to APP scam payments on or after 7^th October 2024.

The limit had been initially set at £415,000, in line with what the Financial Ombudsman Service can award, however after additional evidence was provided by the financial industry and the FCA, the Payment Systems Regulator confirmed that the maximum liability amount is set at £85,000, in line with the lifeboat Financial Services Compensation Scheme (FSCS) limit. According to the PSR, the lower limit would still cover over 99% of claims (by volume).

City watchdog, the Financial Conduct Authority (FCA) published guidance on the Payment Systems Regulator’s new APP fraud reimbursement requirement within the Faster Payments System. The document proposed:

“… changes to the guidance in the FCA’s ‘Payment Services and Electronic Money – Our Approach’ (Approach Document) to explain how PSPs should apply the legislative changes to minimise the impact on legitimate payments. We are consulting on changes to the Approach Document which explain how we expect PSPs to address suspicious inbound payments while continuing to process payments quickly and efficiently.”

The FCA added:

“We want to amend our guidance in the Approach Document to ensure PSPs have clear information about how to implement and apply the new payment delays legislation and existing, related legislative provisions. The change will also help PSPs take a proportionate approach in line with the legislation’s intended effect. This will include clarifying:

• when and how PSPs should consider whether to delay an outbound payment transaction, and when to tell customers about these
• how PSPs should treat potentially suspicious inbound payment transactions and
• how we will monitor and evaluate PSPs’ implementation of the payment delays legislation, and the types of information we plan to get from PSPs.”

In other words, the FCA is seeking the views of the financial payments industry on the new legislation and how it will be used without having a negative impact on customers. Following the consultation period that closes in October 2024, the FCA intends to update its draft guidance document. It then plans to publish the final Approach Document for payment services “by the end of 2024”.

Sarah Spruce, Legal Director at TLW Solicitors, says:

“Our experienced APP fraud team and I have been keeping a close eye on developments and the implications of the proposed changes. With ongoing consultations right up to the October deadline, it looked like the FCA and wider financial industry simply may not have been ready for the PSR’s new reimbursement changes. For the sake of the many fraud victims that are out there, we are concerned about the £85,000 cap. Another point to note is that not all APP fraud cases will be covered by the new regulations, and other ways to seek a refund will still be available.

“Regardless of the new changes, I encourage anyone who has been the victim of a scam and lost out to get specialist professional advice to ensure that they receive the compensation they are rightfully owed. Get in touch with my team to see how we can help. We can investigate whether you may be eligible to make a ‘no-win, no-fee’ refund claim.”