10 Key Points from the PSR Consultation APP Scams: Requiring reimbursement

On 29 September 2022, the Payment Systems Regulator (PSR) published its latest consultation (CP22/4: Authorised push payment (APP) scams: Requiring reimbursement) containing its proposals to give greater protection to consumers against Authorised Push Payment (APP) scams.

In summary, it’s proposed that payment service providers (PSPs) will be required to reimburse all victims of APP fraud where payment is made over Faster Payments, subject to limited exceptions. The consultation is open until 25 November 2022.

We have set out below 10 key points to note. 

Background

Regulatory focus on APP scams began in 2016 following a super-complaint from the consumer organisation, Which?.

Which? was concerned that consumers tricked into transferring money to fraudsters are not appropriately protected compared to other types of payment. The PSR published its formal response to the super-complaint on 16 December 2016 and committed to developing an industry led programme of measures designed to investigate the issues raised by Which?.

On 7 November 2017, the PSR published its report and consultation on APP scams (CP17/2). CP17/2 included a consultation on an industry led “contingent reimbursement model”. In February 2018, the PSR and FCA published a joint statement on the outcome_of_the_consultation on the development of a contingent reimbursement model. The PSR considered that an industry code, developed collaboratively by industry and consumer group representatives that set out the rules applicable to the model was the most effective way to implement the proposal. A steering group was set up to develop the proposed model.

The Contingent Reimbursement Model for Authorised Push Payment Scams (the Code) was implemented on 28 May 2019. Whilst the Code has resulted in a significant increase in reimbursement for victims of APP scams, the Code is voluntary and the PSR has considered that more needs to be done to prevent against APP scams and ensure reimbursement for victims. The PSR has therefore been considering how to implement mandatory reimbursement. On 29 September 2022, the PSR published CP22/4 setting out its latest findings and  proposals.

10 Key Points to note from CP22/4 

Statistics: The PSR sets out the statistics to support its concerns and reports that, in 2021, reported APP scams totalled £583.2 million. As many cases go unreported, this figure is likely to be much higher. Faster Payments were used in 97% of the reported APP scams. The PSR says the overall level of reimbursement under the Code is still below 50% and participation in the Code remains voluntary. 

The changes: The PSR wants to change the way the industry manages APP scams and so are proposing measures: 

• requiring reimbursement in all but exceptional cases so more victims will get their money back;

• improving the level of protection for APP scam victims so there is greater consistency in protections for all victims, irrespective of who they bank with; and

• to incentivise banks and building societies to prevent APP scams because responsibility for allowing fraudulent payments is the responsibility of both the sending and receiving PSPs.  

Mandatory reimbursement: The PSR is proposing to require all PSPs (including indirect access providers) sending payments over Faster Payments to fully reimburse APP scam victims, with only limited exceptions. The PSR is proposing to allow the PSP to 

• set a minimum threshold for reimbursement (of no more than £100), 

• withhold an ‘excess’ (of no more than £35) and 

• set a time limit for claims (of not less than 13 months). Paying PSPs will need to reimburse within 48 hours of the fraud being reported, unless an exception applies.

Business customers: As well as consumers, the mandatory reimbursements rules will protect micro-enterprises and charities. The PSR considers that it’s not proportionate to require mandatory reimbursement for larger businesses (who have greater capability to protect themselves). 

The exceptions: The exceptions will be where there is first party fraud or where the consumer acted with gross negligence – which the PSR says will be a high bar expected to apply in only a minority of cases.

Gross negligence: The PSR says reimbursement can be declined where the consumer has been grossly negligent (although they propose that vulnerable customers are exempt from this exception). The PSR says it does not propose to provide any further guidance to that provided by the FCA on the interpretation of gross negligence. 

Allocation of costs: The proposal is to allocate the costs of reimbursement equally between sending and receiving PSPs (with a default 50:50 split). The default split can be departed from by negotiation, mediation or dispute resolution.   

Implementation: The PSR has set out its high-level approach to implementing its proposals. Long-term the PSR intends for Pay.UK to run the Faster Payments system by making, maintaining, refining, monitoring and enforcing compliance with what are intended to be ‘comprehensive’ scheme rules (including mandatory reimbursement). The PSR says it is looking to Pay.UK to consider how quickly this can be implemented and are consulting on alternative short-term implementation options, including exercising its powers under section 55 of the Financial Service (Banking Reform) Act 2013. If the Government’s Financial Services and Markets Bill (currently at the committee stage in the House of Commons) comes into force next spring, the PSR will be looking to make regulatory requirements to give effect to its proposals in Q2 2023. 

Other measures: In parallel to this consultation, the PSR is also taking forward its measures on publication of performance data and data sharing (part of the package of measures consulted on in the PSRs November 2021 consultation - CP21/10 Authorised push payment (APP) scams). The data sharing is expected to begin in 2023.  

Confirmation of Payee (CoP): The consultation also refers to the ongoing work on CoP and its importance in helping combat APP scams. The PSR says it has noted a trend of fraudsters migrating towards PSPs who are not participating in safeguards such as CoP. At the end of 2021, the PSR directed Pay.UK to move to the next phase of CoP, extending the service to up to 400 more PSPs.    

Comment 

The PSR recognises that the proposed changes will impose a significant cost for PSPs in the short term, but the PSR expects this to incentivise PSPs to invest further in reducing the prevalence of APP fraud. In its cost benefit analysis, it estimates that £100 million - £150 million a year could be saved as a result of better detection and prevention of APP fraud. 

There are a number of points which PSPs may want the PSR to consider further as part of its consultation process. For example:

• Whilst PSPs will welcome the lower payment threshold and the (maximum) excess which firms will be permitted to set, they might question if these limits are set at a high enough level to genuinely incentivise consumers to exercise greater caution when initiating payments. The PSR has limited evidence on the impact of mandatory reimbursement on consumer behaviour and invites submissions from respondents on this. 
  

• The PSR is clear that retailer disputes are out of the proposed scope of mandatory reimbursements. Nevertheless, the PSR seeks to draw certain analogies with the protections afforded by Section 75 of the Consumer Credit Act 1974. Further, given the wide definition of an APP scam, it could potentially cover allegations of fraudulent misrepresentation against retailers - and it’s unclear if that is really intended to be protected by these measures. 
  

• The PSR says it intends to allow PSPs to impose a (minimum) 13-month time limit for consumers to make a claim, as it considers this is a reasonable period. However, it goes on to refer to the much longer time periods which consumers have to appeal to the Financial Ombudsman Service. Stakeholders may wish to seek clarity as to whether it’s intended that the Ombudsman Service should be permitted to avoid time limits set under future scheme rules. 
  

• PSPs will note that no upper transaction limit can apply for mandatory reimbursement protection. In practice, many PSPs set upper transaction limits for Faster Payments well below the £1 million limit permitted under the Faster Payments scheme. By setting no upper limit, PSPs may be less willing to extend their own transaction limits for Faster Payment transactions.

The consultation is open until 5pm on 25 November 2022 and the PSR will be holding discussions with key stakeholders during the consultation period. The PSR acknowledges that its proposals will increase the cost of APP scams reimbursement for most PSPs and so it is important that firms engage on the key questions raised by the PSR about potential implementation. 

However, reimbursement is only part of it, and PSPs cannot be expected to be solely responsible. It will also be key for the industry to continue the education work to raise awareness and consider what else can be done to bring in other businesses to help combat fraud (such as social media platforms – where many such frauds originate). 

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at October 2022. Specific advice should be sought for specific cases. For more information see our terms & conditions.