Are you protected by the UK’s new fraud rules?

If you have the misfortune to lose £85,000 to a scammer next Monday, the money could be back in your account by Friday with very few questions asked.

The UK’s new fraud rules are, on one level, a victory for consumer campaigners: make this a problem for the banks, rather than their customers, and the industry will be forced to invest in fraud prevention and share information to fight the UK’s number one crime on a scale never seen before.

However, behind the scenes, banking bosses worry the new rules could cost them a fortune.

Nearly 3mn Britons fell victim to scammers last year, with losses totalling more than £1.1bn. Around half of this figure was lost to authorised push payment (APP) fraud, where consumers are tricked into transferring money into accounts controlled by fraudsters.

Until now, victims of this crime faced a lottery over getting their money back. Last year, 62 per cent of consumers had losses reinstated under the UK’s voluntary code of reimbursement, yet differing interpretations of the rules meant some banks refunded 96 per cent of cases, while others managed just 3 per cent. In some cases, victims faced protracted battles with banks and the Financial Ombudsman, a service which settles disputes between financial companies and their customers, to have losses reimbursed.

However, rules coming into force on October 7 will see most get their money back within five working days or less.

“It’s going to be much easier to get reimbursed, but there is a concern that criminals could exploit that process in ways we haven’t realised yet,” says Ben Donaldson, managing director for economic crime at UK Finance, the banking industry body.

Bank bosses know only too well how fast scammers can adapt to exploit any weakness in the system. Many fear the risk of “moral hazard” if customers drop their guard against scam attempts, or are tempted to collude in fraudulent behaviour.

So what changes might consumers notice — and will they really be better protected?

Under the new rules, most victims will see fraud claims settled more quickly, but those losing very large or very small amounts of cash could still be left out of pocket.

Some banks intend to deduct an £100 excess charge from payouts (see box) though roughly one-third of push payment fraud by volume is for less than this amount.

Plus, last-minute industry lobbying has slashed the level of automatic reimbursement from £415,000 to £85,000 per claim. The Payment Systems Regulator (PSR) says this is justified as only 411 push payment scams above £85,000 in value, totalling £72mn, were recorded by the UK’s biggest banks last year.

“They can say it’s only 411 cases, but let us not forget that these are 411 people who have suffered life-changing financial and emotional harm,” says Rocio Concha, director of policy at consumer group Which? “People don’t fall victim to scams because they’re careless, but because they’re ruthlessly manipulated.”

The highest value frauds include romance scams, conveyancing fraud (where solicitor’s emails are hacked and property deposits diverted), invoice fraud (where small companies and charities are duped by fake payment demands) and investment fraud.

Last-minute industry lobbying has slashed the level of automatic reimbursement from £415,000 to £85,000 per claim

“People who are very experienced investors have been caught out by this type of crime, which is indicative of how sophisticated the scammers tactics are,” says Donaldson. Fake websites are typically used, with money seemingly “invested” on a platform and often appearing to grow in value. Victims can have “profits” returned to them early on, which convinces them the scam is genuine — and then invest far larger sums.

The £85,000 cap applies not just to faster payments, but the Bank of England’s Chaps system, which is routinely used to settle higher value payments including car purchases and property transactions.

Which? has criticised this decision, saying it presents a “significant risk” for consumers. The Bank of England said it had “considered the feedback” from a consultation on the new rules, but believed the £85,000 limit should be applied consistently. It is committed to reviewing this within 12 months. 

Some banks told the FT they would still assess claims above £85,000 on a case-by-case basis. If banks refuse to cover losses, customers will be told they can take their case for free to the Financial Ombudsman, which has the power to reimburse cases up to £430,000 in value. However, Which? says this creates complexity and confusion for customers, and could increase the volume of high-value cases the Ombudsman must resolve, adding to existing delays in cases being processed.

Under the new rules, the bank that sends the fraudulent transaction won’t be solely on the hook for the losses. The bank receiving the payment has to cover 50 per cent of the cost, which will fundamentally change how the industry tackles fraud.

Kate Fitzgerald, head of policy at the PSR, stressed that one of the key outcomes was to spur payment firms of all sizes to detect and prevent fraud from happening in the first place.

PSR data shows that smaller fintechs, as opposed to traditional high street banks, received a whopping 53 per cent of all fraudulent transactions last year, even though they were responsible for just 8 per cent of all faster payments.

Sharing the liability for compensating victims forces all providers to invest in fraud detection and prevention as well as share information.

“In the past, we’ve seen instances of the sending bank logging a transaction as fraud, but the receiving bank either didn’t know or didn’t take any action,” Fitzgerald adds. “What chance have we got of shutting the scammers down if the receiving banks are not using this information and taking steps to close down accounts?” 

Another problem is social media. Many bank bosses privately express their frustration with the networking sites — which have no skin in the game when it comes to compensating victims — yet could be doing much more to clamp down.

Nicola Bannister, customer support director at TSB, says customers have been duped by fake adverts, fake accounts, purchase scams, impersonation scams and investment scams — often involving crypto — and stresses that social media sites should not wait for banks to report fraud. “They can run their own intelligence on their own systems and identify accounts doing these things.”

In the first half of this year, 80 per cent of all TSB fraud cases involving some kind of manipulation or coercion (they refer to it as “social engineering”) came from Meta, either through Instagram, Facebook or WhatsApp.

“We need them [social media platforms] to act quickly by swiftly removing and blocking scam content as soon as they find it, but despite the Online Safety Act, it’s still not happening fast enough,” says Bannister.

Meta this week launched a data-sharing partnership with UK banks to fight fraud, following a pilot with NatWest and Metro that the tech group said had helped it close 20,000 accounts. It is looking to expand this partnership with other UK banks. However, Revolut said the scheme did not go far enough, and called for social media platforms to pay a share of the costs of compensating victims of fraud.

Customers will notice some significant changes from next week. Under the current code, banks have deployed large teams of specialist staff to find fault with claims and limit payouts.

Paul Davis, former head of fraud at TSB, has said there are probably more people passing judgment on fraud victims than there are investigating the fraudsters themselves. Under the new system, banks have the right to “stop the clock” and delay refunds for up to 35 days if they suspect customers have colluded with fraudsters or been grossly negligent. But overall, the goalposts will be shifted: to reduce payouts, they must invest in detecting and preventing scams.

Banks are using the latest AI-powered tech to do so, and will soon have greater powers to challenge and delay suspect payments for up to four days under new legislation. Many banks are investing in alerting capability, so consumers should expect to receive more checks that payments are genuine in future. Greater scrutiny when customers open new accounts is also likely.

Banks blocking payments to accounts or payment providers considered to be high risk is also tipped, as already seen with different crypto platforms.

July’s launch of Project Fusion, a groundbreaking initiative where seven UK banks share fraud transaction data with the National Crime Agency, is expected to provide powerful intelligence to detect and disrupt how organised crime groups use the banking system. In future, the ambition is to use real-time data insights to prevent fraud.

For now, bank bosses are focused on the level of fraud claims in the coming weeks and months, and whether the new risks and unintended consequences of the new legislation will lead to a spike — or even a reduction — in claims.

One year from now, the PSR will review the effectiveness of the system and whether any changes need to be made. Let us hope the group most negatively affected will be the scammers, for a change.