New bank tech will protect from scams
You should take comfort that your bank has taken proactive steps to make it harder for fraudsters
QI’ ve had an email from my bank telling me it is carrying out more checks when I make payments from my account. Do you know what this is? Should I be concerned that I’m getting scammed?
We are facing a fraud and scams epidemic in the UK. Figures published just last week by trade body UK Finance found that £1.2 billion was lost to fraud in 2019, despite the banking industry working to prevent a further £1.8bn being stolen.
In most cases, victims will get their money back – more than £800m was lost to unauthorised fraud, meaning that money is stolen from your account, credit or debit card without you knowing. Unless you’ve been grossly negligent with your details, your bank or credit card provider is obliged to reimburse you for your losses.
There is one type of fraud which offers you no such protection.
If you receive a call, text or email from a scammer and are convinced to send them money via a bank transfer – technically known as an ‘authorised push payment’ – your bank or building society has no legal obligation to give you your money back.
You were the one putting in the sort code and account number to your online banking,therefore you have authorised the payment.
This type of fraud has been rising dramatically over the past few years. In 2018, some £354m was lost to bank transfer fraud; last year, it increased by 29 per cent to £456m. There
were 122,000 cases in 2019, up 45 per cent year-on-year.
Which? has long campaigned for greater protections for victims of bank transfer scams, launching a legal complaint to the payments watchdog, the Payment Systems Regulator (PSR), almost four years ago. We argued that banks and payment providers were best placed to tackle bank transfer fraud – through better monitoring of suspicious payments, stopping
fraudsters from operating accounts, providing effective warnings during payment journeys and introducing new technology that would make bank transfers more secure.
As a result, a voluntary code of conduct was produced, to which a large number of banks have signed up.
If banks had fallen down on their duties to protect their customers or neither the customer nor the payment provider was to blame for the fraud taking place, victims would be reimbursed. This took effect in May 2019.
Prior to the code, around 20 per cent of the money lost to bank transfer fraud was returned to victims. The latest figures suggest that, since the code has been in place, this has gone up to just over 40 per cent – a positive sign, but this still means that tens of thousands of people are potentially not being reimbursed.
For its part, the PSR has
demanded that banks introduce new technology to allow people to check that they are sending money to the actual person or business they had intended. You might assume that your bank already checks whether or not the name entered matches the account details, but it doesn’t – payments are currently processed using the sort code and account number only.
This means you could be convinced to send money to a fraudster posing as your solicitor, bank or even a government body (often HM Revenue & Customs) and send money to what you think is their genuine account, without your bank telling you that the details don’t belong to the person or business you think it does.
The PSR has asked the six largest banking groups to introduce this technology – dubbed ‘Confirmation of Payee’ – by 31 March, and some
have already gone ahead and implemented it early (like your bank, Bank of Scotland). These are Lloyds Banking Group, HSBC, Nationwide, Santander, Barclays and RBS Group. Both TSB and Starling Bank have also committed to introducing it, too.
When this tech is in place, your bank will request the full name of the account holder, along with the type of account they have and sort code and account number.
Once you’ve done this, you’ll be served one of four options – an exact match, giving you the confidence to proceed with the payment; a partial match, which should prompt you to double-check the payment details, and for any spelling mistakes, but at the very least put you on alert; no match, meaning that the details do not match up and that you should cancel the payment; or no name check, meaning it has not been possible to check
the name as either the bank doesn’t have confirmation of payee technology in place, or it doesn’t apply to the recipient’s account.
The PSR says that this should shut down more than £70m of fraud every single year, and Which? is urging as many banks as possible to introduce it for it to be truly effective. But you should feel comforted that your bank has taken proactive steps to protect from scams.
For customers of other banks, a note of caution. Because of the ongoing strain on the banking system due to the coronavirus pandemic, the PSR has said that, while it expects banks to go ahead with the implementation of the tech, it will not take any action on those that have not implemented it until 30 June – effectively giving banks another three months to introduce it if required.
The Payment Systems Regulator says that this should shut down more than £70 million of fraud every single year