Refunds for victims of bank transfer fraud demanded
Financial companies should be required by law to refund victims of bank transfer scams, and should consider reimbursing the many thousands defrauded since 2016, according to a report from MPs.
They also said retailers and other companies that suffer data breaches that lead to fraud should be forced to pick up the bill for the costs of reimbursing customers and issuing new bank cards.
Another recommendation aimed at stemming the rising tide of financial crime is a mandatory 24-hour delay on all first-time payments between bank accounts to try to outwit fraudsters.
The report from
the Commons Treasury committee came after official data showed that scammers stole £616m from UK bank customers during the first six months of 2019. Of this total, £207.5m was lost after people were duped into authorising a payment to an account controlled by a criminal. This was up 40% on the figure for the same period in 2018.
This type of scam is officially known as authorised push payment ( APP) fraud and includes cases where email accounts - either those of individuals or the companies or tradespeople they have employed - are hacked in order to trick consumers into sending large sums to criminal accounts.
A voluntary code of conduct requiring banks to improve the way they treat victims of this type of fraud, and reimburse those who meet the criteria, came into effect on 28 May 2019. The committee said this should now be made compulsory via legislation.
However, the MPs noted this would not help previous victims of such frauds, and they said banks "should consider retrospectively reimbursing customers back to 2016".
The report said: "Financial firms have been warned since 2016 that they have been failing in their duty to protect customers by not linking information on account names to payments. Firms should strongly consider whether refusing to retrospectively reimburse customers who relied on the payee name is fair and just."
From the end of March next year, name checks will be carried out when UK bank customers send money to other people - though this system has been delayed and was originally set to start last summer.
The MPs said: "It's a serious failure that banks weren't already doing this. The regulators should consider sanctioning any firm that misses the March 2020 deadline."
Last year there were a string of high-profile data breaches at major companies, including Dixons Carphone, British Airways and Ticketmaster. In many cases people had their personal data, including payment details, stolen by hackers. Banks have long been angry about having to pick up the bill for the resulting problems, and the MPs said that when third-party companies were responsible for data breaches that led to associated fraud, "they should be responsible for the associated costs".
They said the government should consider making these companies liable for the associated costs to banks.
The so-called faster payments system has revolutionised banking and means consumers are able to send money to other people's accounts in seconds. Virtually all internet and phone banking payments in the UK are now processed this way - but MPs now want to slow things down in order to beat the criminals.
Fraudsters rely on this speed to move money into accounts that are then quickly emptied, often before consumers and banks have realised anything is amiss. But the committee said very few first-time payments needed to be received instantly. "Therefore, there should be a mandatory 24-hour delay on all first-time payments, providing time for consumers to consider if they are being defrauded," it said, adding: "All future payments to the same account could flow at normal speed."