UK Finance proposes payments tax to compensate fraud victims

UK Finance proposes payments tax to compensate fraud victims

Banking lobby UK Finance has floated the idea of imposing a universal tax on funds transfers which banks could dip into to compensate victims of push payments fraud.

Push payments fraud, which happens when businesses or individuals are conned into sending money to a fraudulent account to pay for goods or services, has become a political hot potato in UK financial circles.

Statistics released by UK Finance show that, in the first half of 2018, consumers lost £92.9 million because of this type of fraud.

The UK's Payment Systems regulator has been working with banks and consumer groups to develop an industry code for reimbursing victims of APP scams.

Last month saw the publication of a draft voluntary code drawn up by a steering group of UK banks and consumer rights campaigners.

One sticking point which has yet to be resolved occurs in instances where a victim of an APP scam has met their requisite level of care, and so should be reimbursed, but no bank or other Payment Service Provider involved in the payment journey has breached their own level of care.

In a presentation to The UK's treasury Select Committee, UK Finance chief Stephen Jones suggested that “a tiny levy on each payment” made in the UK could be a suitable mechanism to resolve the deadlock.

“Customers will pay if the banks have to pay,” Jones told MPS. “There’s no such thing as a free lunch here. It’s a question of how can the cost be fairly distributed across the system.”

The proposal has been derided by consumers groups and cyber-fraud firms. Brooks Wallace, head of Emea at fraud prevention out Trusted Knight comments: "Mr Jones talks about reducing financial incentives for cyber criminals, but asking consumers to pay the bill does nothing to stop the ultimate payday for the criminal. Rather, it seems like a cynical attempt among banks - who know that online crime is growing - to shift financial responsibility to the customer before it really starts to impact their bottom line."

Comments: (23)

Bill Trueman
Bill Trueman - Riskskill.com - London 10 October, 2018, 11:204 likes 4 likes

Interesting - this infers that we all need to pay for the frauds that need to be stopped rather than funded. Why don't we start by following and recovering the money?

 

 

A Finextra member
A Finextra member 10 October, 2018, 11:322 likes 2 likes

I don't get it. So if "a victim of an APP scam has met their requisite level of care, and so should be reimbursed, but no bank or other Payment Service Provider involved in the payment journey has breached their own level of care", how does the fraud occur? Something must have failed somewhere. Perhaps it's the bank of the fraudser in which the account was created and which accepted the payments and which then allowed the fraudster to abscond with the funds that should be held liable - for failing to do adequate KYC checks.

Bill Trueman
Bill Trueman - Riskskill.com - London 10 October, 2018, 11:35Be the first to give this comment the thumbs up 0 likes

Absolutely how it shoudl happen: it is rather starange that no-one seems to realise this though and to be addressing this issue.

Peter Robinson
Peter Robinson - Liberti Consulting - Northampton 10 October, 2018, 11:38Be the first to give this comment the thumbs up 0 likes

I agree with you both. Perhaps it's just too problematic to obtain the fraud funds back from an overseas bank!

Melvin Haskins
Melvin Haskins - Haston International Limited - 10 October, 2018, 13:223 likes 3 likes

Many of these frauds occur because the fraudster has been able to open a UK bank account with forged or stolen documents. They then receive money and immediately remove the funds. Please tell me why banks should be absolved from responsibility for allowing the fraudulant account to be opened and also tell me why they are not picking up the immediate removal of the funds received. I do not agree that the general public and businesses should pay for this.

Victor Van Rij
Victor Van Rij - EUIRD - Duivendrecht 10 October, 2018, 14:02Be the first to give this comment the thumbs up 0 likes

The increase of succeeded fraudes with large amounts that cannot be retrieved after the crime has taken place ,has much to do with the endeavour to persuade all banks to introduce the faster (real) time payments , for which the banks seem not to have found out what applications and services they may connect to this faster payments (see next finextra mail). Fraudsters and money laundriers found out the comfort of this innovation of real time payments as soon as it was introduced. So we can expect more and more it is the duty of banks to resolve this, unfortunaltely we will all have to pay our share either as customers, share holder and perhaps tax payers.

Peter Robinson
Peter Robinson - Liberti Consulting - Northampton 10 October, 2018, 14:49Be the first to give this comment the thumbs up 0 likes

My personal view is that the cost of any fraud should be borne by the weakest link - otherwise no one has any real incentive to address it! Sharing the cost of fraud doesn't address the underlying problem.

Ketharaman Swaminathan
Ketharaman Swaminathan - GTM360 Marketing Solutions - Pune 10 October, 2018, 19:51Be the first to give this comment the thumbs up 0 likes

This suggests some kind of credit card like chargeback mechanism to be put in place for A2A payments. But chargeback works in credit card because the Beneficiary is a Merchant, who not only has an ongoing relationship with the Acquirer Bank but is also pre-vetted by Acquirer Bank for issue of Merchant Account. In the A2A context, all that the Bene's bank does is KYC. KYC is neither a character certificate nor a background check, so a guy who proves to be a fraudster after-the-fact will pass KYC as easily as a genuine Beneficiary. OTOH, Merchant Account issuance process involves a certain degree of vetting the Beneficiary's business and nobody can question the Acquirer Bank if it denies Merchant Account to someone. There's no way the Bene bank can retrieve money from Fraudster, who can always claim he delivered whatever he committed to the Customer - it becomes a "he said, she said" kind of situation. Again, while many Merchants do consider credit card chargeback unfair, they live with it because that's the cost of popularizing credit card among Payers. Not sure whether the same will be possible in A2A.

Victor Van Rij
Victor Van Rij - EUIRD - Duivendrecht 10 October, 2018, 20:52Be the first to give this comment the thumbs up 0 likes

Dear Kethamaran, the "he said, she said" situation should lead to a slow down or freezing of payment usually people go to the police if they get frauded. At the moment it is free play for crimials who can get their money intstantaneously while the victim is helpless. In the Netherlands there are now many cases where private bank accounts were ripped for several ten thousands of Euros each(by so called Microsoftscams) . In some case the money first was transferred to english accounts and than dissolved through fast payments. The bank feels sorry but places the full risk on the victirms that never asked for fast payments procedures espacially not with these high amounts to fraudsters. 

Melvin Haskins
Melvin Haskins - Haston International Limited - 10 October, 2018, 22:171 like 1 like

As both a private individual and a business owner, I was never asked whether I wanted faster payments, nor was it made clear to me when faster payments were introduced, that the risks would be transferred to me rather than my bankers.

A Finextra member
A Finextra member 11 October, 2018, 09:071 like 1 like

The problem here is that the bank customer is defrauded by a third party to hand over login credentials by being asked to log into their account on a bogus website via the screen scraping technology or by a man in the middle attack. Please note that the sponsors on open banking (TPP:s and authorities) have advocated for not legally banning screen scraping making it harder for customer to look out for fraudulent requests. Sometimes consumers are also asked to send monies to cousin Jeff who is in trouble... via social engineering. The bank security system works as intended and the customer does the strong two factor login and allows monies to be sent to somebody, normally a mule account, a brit who lends his account to fraudsters to receive fraud funds. The banking secerecy requirement does not allow the receiving bank to communicate the recepient bank account holder identity to the payer! The funds then bounce on to other accounts via faster payments and end up being taken out as cash or prepaid cards or other easy to dispose tokens, or on accounts in far away countries where controls may be less. Anyway the monies are rapidly transferred several times and then disappear. Legally the transactions are backed by the finality of a payment requirement and cannot be taken back without the consent of the fraudster or his mule! In Sweden the consumer complaints board recently ruled that the bank of the defrauded party should compensate its customer unless the customer showed major neglect. If so one is not compensated for the first 1 000 Euros but anything above that. The careful customer pays a 50 Euro deductible, all this according to the brand new EU payment services directive no 2. The Swedish defrauded customer takes the 100% blow only if  he/she was in wilful neglect or deliberately acted to allow a known fraud scam. I guess that UK banks are worried that the "swedish syndrome" will spread to the UK and they end up footing the bill and like to transfer it to customers throgh a credit transfer sur-charge. The real problem lies with politicians and legislators setting rules that help fraudsters.

A Finextra member
A Finextra member 11 October, 2018, 10:221 like 1 like

I agree with the second poster - there must be blame somewhere, and in my experience, it's usually a lack of vigilance on the part of the victim.  Until we start following the money (even if offshore), this problem will only get worse.

By trying to create a pot of money to pay people back, not only do you disincentivise vigilance, but you also create a new scam where pairs of criminals can rip each other off and claim it back!  The pot would be empty in minutes...

David Griffiths
David Griffiths - Number19 Consulting - Hertford 11 October, 2018, 11:03Be the first to give this comment the thumbs up 0 likes

Is this really a probem for the banks?  If the victims were defrauded out of cash in thier wallets - by scams of a similar nature - it would not fall to the banks to refund.  Indeed it would not be seen as a banking problem at all.  

So, if this is not a direct banking problem, the problem lies in the gulibility and therefore the vulnerability of bank customers, but the problem is exaserbated by the speed at which bank balances can be expropriated and transferred.

The development of real-time banking services has fueled the development of fraud vectors focussed on social engineering mechanisms.  

A victims fund finaced by a payment tax is not the answer.  The answer must lie in modifications to the ecosystem to reduce and limit the opportunities for fraud, but this has a cost.  There are solutions but fraud prevention has never been a headline grabber.     

A Finextra member
A Finextra member 11 October, 2018, 11:15Be the first to give this comment the thumbs up 0 likes

WP: Agree with David.  Also, if we start charging for bank transfers, we'll be back to cash and cheques in no time....

Ketharaman Swaminathan
Ketharaman Swaminathan - GTM360 Marketing Solutions - Pune 11 October, 2018, 19:39Be the first to give this comment the thumbs up 0 likes

@Victor Van Rij: 

At the point of making the payment, Payor knows or does not know that Payee is Fraudster. If former, Payor would / should not go ahead with the payment. If latter, I imagine the realization that Payee is Fraudster comes after the payment is made and goods / services are found defective or whatever i.e. ex post facto. In this case, how would the Payor's Bank slow down or freeze the payment while it is being made? Let's also not forget that Banks are governed by strict SLAs on payment roundtrip duration and, unlike PayPal et al, can't get away by freezing a payment / account for suspected fraud. As for the rest of your comment, your use of the passive voice obfuscates the reality that (a) Nobody forced the Payor to use Faster Payments (b) Payor transferred the money to whoever out of their own free will and volition. Therefore, Payor must take responsibility for their actions. 

BTW, it's "Ketharaman":)

Ketharaman Swaminathan
Ketharaman Swaminathan - GTM360 Marketing Solutions - Pune 11 October, 2018, 19:53Be the first to give this comment the thumbs up 0 likes

@Melvin Haskins:

At least two UK banks and three Indian banks I bank with warn customers that, if they use FPS or NEFT or IMPS or any A2A payment method, (a) they must ensure that they're directing the payment to the intended beneficiary's account number (b) Bank is not responsible for any misdirected payment. At other places, I've argued that Banks are stunting the adoption of A2A payment methods by using such scary language. But if the intrepid Payor still goes ahead and uses them, shouldn't they know that, by default, they're taking the risk of fraudulent payments? Especially since, AFAIK, Banks have never accepted the risk of fraudulent payments for any mode of payment. (Credit card is the sole exception, but, even there, I don't know a single Bank that advertises this fact.)

Ketharaman Swaminathan
Ketharaman Swaminathan - GTM360 Marketing Solutions - Pune 11 October, 2018, 20:11Be the first to give this comment the thumbs up 0 likes

Bank merely facilitates the payment. There are many other actors in the transaction: Customer, ISP, Fraudulent Supplier, Platform that connects Customer and Fraudulent Supplier (e.g. Craigslist). Just as Craiglist or the ISP won't accept the risk of fraud in the transaction despite their role in putting through the transaction, I don't see why Bank should. The Customer's Decision to buy from Fraudulent Supplier is the most culpable party for the fraud. If the entire cost of fraud can't be slapped on that party for political or whatever reason, the only other fair option I see is to hold all parties collectively culpable and slap the cost of fraud on all of them. If there's a practical method of recovering the cost from all of them, well and good. Otherwise, I'm afraid, a payments tax might the only way out.

Re. Anon's comment, A2A payments already attract a charge in India, and, yes, many customers have gone back to cash and cheque. In response, some banks have already started levying charges for usage of cash and cheques beyond a certain free number per month and other banks are seriously considering such a move.

A Finextra member
A Finextra member 12 October, 2018, 09:20Be the first to give this comment the thumbs up 0 likes

WP: Yes, well we definitely don't want to go there!

Ketharaman Swaminathan
Ketharaman Swaminathan - GTM360 Marketing Solutions - Pune 12 October, 2018, 09:52Be the first to give this comment the thumbs up 0 likes

@Anon: 

Agreed but I don't see any other choice eventually. Banks incur cost for cheques. Government incurs cost for cash. As of now, this cost is not explicitly passed on to Payors. OTOH, Banks / PSPs and Merchants incur cost for digital payments, which they try to pass on to Payors. Payors will keep protesting the cost of digital payments unless they're also made to foot the bill for cash and cheque.

PS: What does "WP" mean?

A Finextra member
A Finextra member 12 October, 2018, 10:201 like 1 like

WP are my initials. I post anonymously because I'm not representing my company.

Victor Van Rij
Victor Van Rij - EUIRD - Duivendrecht 15 October, 2018, 11:10Be the first to give this comment the thumbs up 0 likes

Dear Ketharaman ,You remarked " (a) Nobody forced the Payor to use Faster Payments (b) Payor transferred the money to whoever out of their own free will and volition." This is not true with the regular internet scams that take place. It is known that scammers ask for small payments on (copied and real) screens of the banks (which indeed sometimes are made voluntarily, but also under threat of destroying your pc) and  that the scammers seem to have possibilities to change the amount and the accountnumber where the money goes to. So it is not regular fraude but fraude using the sytem for payment created by the bank. Moreover the cammers also use the codes that they steal for small paymenst not just to higher one payment but also to rip saving accounts connected to the payment account and also the security settings that client put in. This is because many banks use the same safety procedure for normal payments as well as for the change of safety settings (also almost real time). This is a systemic fault of the bannks , which tenfolds the damage in ordinary scams that already take place for 15 or 16 years and has everything to do with the attempts of the banks to create the real time tranfers world,without asking clienst if they want this.

Victor Van Rij
Victor Van Rij - EUIRD - Duivendrecht 15 October, 2018, 11:27Be the first to give this comment the thumbs up 0 likes

Dear David, I hope you understand that the scams we  are talking about, are not comparabe with normal scams where people talk money out of your wallet. Wallets which in most cases will not contain all of your money. I think we should all look at the Swedish model because it gives the right incentives to the banks to look how they can make their system more resilient also in an age of social engineered real time payments and scams. Scams that use the weak spots of the banking systems and the way clienst use these systems. This is not only about better encryption but about an eye for the interaction of social engineering and the client system interface  plus brainstorming on the potential steps of cybercriminals to break into this. The beauty of the Swedish systems is that it places the largest burden on the banks who have the best opportunity to make their own systems more safe but also assumes some responsibilty of the clients(own risk) and also fights any fraudulant actions of customers with ill will.

Ketharaman Swaminathan
Ketharaman Swaminathan - GTM360 Marketing Solutions - Pune 15 October, 2018, 12:20Be the first to give this comment the thumbs up 0 likes

@Victor Van Rij:

This article and my comments pertain to the specific instance of "Authorized Push Payment" Fraud and not to any random "regular internet fraud".

While people who fall victim to APP fraud are deceived, that deception is caused by the Payee. There's no reason why a bank should be culpable of it. It's not a secret that, by design, A2A payments are irrevocable and non repudiatable. For years, many people including me have been shouting from the rooftop that Payors should be extremely careful before making an A2A payment and that they should do a sub-dollar pipecleaning payment, verify that the intended beneficiary has received it, before going ahead with the full payment. People who don't follow such basic best practices should use credit card and raise a chargeback request if they are deceived into paying the wrong person. There's no reason why a bank should be culpable for such instances. 

Featured Job
All Jobs »