Theft of $150,000 highlights gap in payments system

THE banking industry may be about to fix one of the longstanding cracks in antifraud protections – the failure to match account names and numbers before allowing online payments to be made.

In 2020, UK banks finally introduced a system that sends a warning if the name on the bank account and the account number do not match.

The system was designed by retail payment authority Pay. UK to stop payment mistakes and prevent cyber crime.

But in New Zealand, cases of payments going awry continue to blight lives, illustrated by a recent case handled by the banking ombudsman in which a woman lost $150,000.

The woman, whom the banking ombudsman called Briar to conceal her identity, was building a new home, and her bank was releasing funds in tranches as the work progressed.

She forwarded the builder’s invoices to the bank when they fell due, and the bank would release loan funds to her.

But in August last year, when she was due to pay a $150,000 invoice, crooks who appear to have hacked her email sent her a message claiming to be from her builder saying the company had a new bank account.

She paid the money online, only to learn shortly after that she had been defrauded.

Briar complained the bank should have spotted that the account number and name did not match, but Banking Ombudsman Nicola Sladden said banks could not check this when processing a customer’s instructions.

When people made online payments, banks required them to enter the name of the payee, and their account number, but customers were wrong to assume banks checked they matched, Sladden said.

‘‘Many New Zealanders incorrectly assume their bank will warn them if they send money to the wrong person.

‘‘However, banks cannot check whether a recipient’s name and account number match. This means transposing errors can result in lost funds, and scammers can impersonate others.’’

That could change, as

Payments NZ – the New Zealand equivalent of Pay.UK – has begun work to modernise its system.

Payments NZ’s Payments Modernisation Plan was first unveiled in September 2020.

‘‘By 2030, customers are highly likely to want worldclass, safe and secure real-time payment systems that are also data-rich,’’ the plan says.

The banking industry did not yet have a shared tool to manage and monitor payments fraud, or the ability to support interbank notifications of fraud, the document says.

The plan noted that in order for a payment to go to the right

place, a customer often needed to enter a string of 15 digits correctly.

In future it would include systems to increase customers’ confidence they were paying the right person.

Payments NZ chief executive Steve Wiggins said he had not been approached by banks wanting to work out a solution.

Payments NZ is owned by ANZ, ASB, Bank of New Zealand, Citibank, HSBC, Kiwibank, TSB Bank and Westpac.

But Wiggins said crosschecking account numbers and names was referred to in Payments NZ’s payments modernisation plan.

He had not seen any data on the number of misdirected payments, but Pay.UK said in 2018 that it may affect as few as one in 20,000 transactions, though it noted that ‘‘the impact on victims can be significant, and, in the worst cases, life-changing’’.

The UK system temporarily blocks transactions and issues a warning if the account name and number do not match.

An ANZ spokesperson said the current system of processing transactions by account number provided an efficient, reliable and secure way of making payments.

‘‘Any changes would be complex and need to be standardised across all banks,’’ the spokesperson said.

A Westpac spokesperson said matching names to payments would involve new processes and systems across the payments industry.

It could also result in payments being delayed or rejected if names were not entered correctly.

Wiggins said it would be a multi-year programme.

‘Many New Zealanders incorrectly assume their bank will warn them if they send money to the wrong person.’ NICOLA SLADDEN Banking ombudsman