New rules on authorised push payment fraud in the UK

Yesterday was a big day for UK consumers when the new rules on compensating victims of authorised push payment fraud (APP fraud) came into force.

APP fraud is when consumers are tricked into sending money to the fraudster. It can happen in various ways, e.g. via impersonation fraud, romance fraud or email takeover fraud. The point is that the consumer makes the transfer of the money (and therefore the transaction is authorised by the consumer), and this fact differentiates the type of fraud from others where the consumer does not consent to the transaction e.g. when the consumers' bank card is stolen and is used for purchases (unauthorised transaction). APP fraud is the most prevalent fraud in the UK, and in Europe. The number of consumers affected increases year by year.

UK reforms started under the pressure of the consumer group Which? by submitting a Super-Complaint to the Payment Systems Regulator, noting the increasing prevalence of APP fraud and calling for rules to tackle the problem. They pointed out that the general rule of shifting the liability for the loss from the consumer onto the bank applied to all unauthorised transactions, but it does not apply to authorised transactions, and they argued that there are no legitimate reasons for maintaining this exception.

In 2019 the Contingent Reimbursement Model Code was adopted. This voluntary code was signed by most major retail banks. However, although the Code established the desired main rule, it had numerous exceptions, such as effective warnings and gross negligence. After a while, it became apparent that the Code was not as effective as it could be, and the Government decided to take action. The Financial Services and Markets Act 2023, in Section 72, deals with the payment service provider's liability for fraudulent transactions, empowering the Payment Systems Regulator to bring rules in the area. These rules (PSR Specific Direction 20) entered into force yesterday:

• the new rules apply to all payment service providers, not just banks
• the rules protect individuals, microenterprises and charities
• rules apply to UK domestic payments only and using some payment systems
• the rules provide for mandatory reimbursement except when consumers were complicit in fraud or grossly negligent, the Regulator, however, clarified that the gross negligence exception is a high bar and does not apply to vulnerable consumers
• firms can choose to have a £100 excess (except in the case of vulnerable consumers)
• the maximum amount claimed can be £85,000, or firms can opt for a higher threshold internally
• reimbursement amount is shared 50-50 between sending and receiving bank
• there are set claims and reimbursement deadlines.

The new rules are certainly welcomed. APP fraud caused a lot of consumer detriment, and the lack of effective rules led to legal uncertainty. It is a positive development that there are much fewer exceptions in the new rules. However, exceptions and limits do exist, e.g. the rules do not apply to international transactions, and there is uncertainty about how the gross negligence exception will be enforced and who will be considered vulnerable consumers for the purposes of the exceptions. These nuances will need to be carved out by practice, and the Financial Ombudsman Service, which handles consumer complaints, is likely to play a key role.

Although these rules apply to UK domestic transactions only, they are helpful to know given the prevalence of APP fraud in other countries, including EU Member States and can be beneficial in developing PSD3. 

Tecnoservice judgment (C-245/18): Payment services providers not liable for payer's incorrectly provided IBAN

On the 21st of March, the ECJ published its judgement in the Tecnoservice case (C-245/18) on the Payment Services Directive (PSD1), which can have interesting repercussions for everyday payments. The case revolved around a payment made to a wrong payee, an occasion feared by most consumers when making a payment in a bank, even though it is not as common. Should the bank warn you about such a mistake, if it is clear that the name of the payee and the account number do not match, and would it be hold liable if it does not but simply proceeds with a transaction?

A debtor of Tecnoservice, an Italian company in liquidation, made an order for payment via a bank transfer in a branch of Poste Italiane. The transfer order stated the name of the account holder, as well as the international bank account number (‘IBAN’).

The transfer was made to the IBAN number provided, which, however, did not correspond with Tecnoservice, meaning the payment went to another account. Tecnoservice proceeded to bring an action against Poste Italiane for failing to check whether the IBAN provided corresponded to the account holder's name. Poste Italiane argued they transferred to the IBAN provided and were not required to conduct any additional checks.

Articles 74 and 75 of Directive 2007/64, which were in force at the time of the dispute (now replaced by Directive 2015/2366), regulate such errors.

Article 74 of Directive 2007/64, entitled ‘Incorrect unique identifiers’, provides:

‘1. If a payment order is executed in accordance with the unique identifier, the payment order shall be deemed to have been executed correctly with regard to the payee specified by the unique identifier.

2. If the unique identifier provided by the payment service user is incorrect, the payment service provider shall not be liable under Article 75 for non-execution or defective execution of the payment transaction.

However, the payer’s payment service provider shall make reasonable efforts to recover the funds involved in the payment transaction.

3.      If the payment service user provides information additional to that specified in Articles 37(1)(a) or 42(2)(b),he payment service provider shall be liable only for the execution of payment transactions in accordance with the unique identifier provided by the payment service user.’

Article 75 of the directive, entitled ‘Non-execution or defective execution’, provides, in essence, in paragraphs 1 and 2, that the liability established by those paragraphs is ‘without prejudice to ... Article 74(2) and (3)’ of the directive.

The referring court asked whether articles 74 and 75 must be interpreted as being applicable only to the payment service provider of the person who ordered the payment, or as being applicable also to the payee’s payment service provider?’

As the main question of the referring court related to the interpretation of art. 74(2), namely the case where the unique identifier provided (IBAN) is incorrect, the Court focused on that provision. According to the Court, the use of the term 'payment service provider' in that article should include both providers involved (payer's and payee's) as no other distinction is being made (para. 25). This means the limitation of liability applies to both.

Conversely, the second subparagraph of art. 74(2) states that it is only the payer’s payment service provider that shall make reasonable efforts to recover the funds. Therefore, if there was an intention to limit the applicability of also the first subparagraph of art. 74(2), it could have specified only the payer's payment service provider, as well (para 27).

Following that, the Court decided that the limitation of liability provided for by art. 74(2) of Directive 2007/64 in the case of a payment order executed where the unique identifier and the payee name provided do not match, applies to both payer’s and payee’s payment service providers. (para 31).

However, the Court made sure to point out that thet MS can require payment services provider of the payer to act with due diligence in order to correct such mistakes.

So, you've been warned, payment services providers will not be held accountable for mismatching IBAN and account holder names!