New rules on authorised push payment fraud in the UK

Yesterday was a big day for UK consumers when the new rules on compensating victims of authorised push payment fraud (APP fraud) came into force.

APP fraud is when consumers are tricked into sending money to the fraudster. It can happen in various ways, e.g. via impersonation fraud, romance fraud or email takeover fraud. The point is that the consumer makes the transfer of the money (and therefore the transaction is authorised by the consumer), and this fact differentiates the type of fraud from others where the consumer does not consent to the transaction e.g. when the consumers' bank card is stolen and is used for purchases (unauthorised transaction). APP fraud is the most prevalent fraud in the UK, and in Europe. The number of consumers affected increases year by year.

UK reforms started under the pressure of the consumer group Which? by submitting a Super-Complaint to the Payment Systems Regulator, noting the increasing prevalence of APP fraud and calling for rules to tackle the problem. They pointed out that the general rule of shifting the liability for the loss from the consumer onto the bank applied to all unauthorised transactions, but it does not apply to authorised transactions, and they argued that there are no legitimate reasons for maintaining this exception.

In 2019 the Contingent Reimbursement Model Code was adopted. This voluntary code was signed by most major retail banks. However, although the Code established the desired main rule, it had numerous exceptions, such as effective warnings and gross negligence. After a while, it became apparent that the Code was not as effective as it could be, and the Government decided to take action. The Financial Services and Markets Act 2023, in Section 72, deals with the payment service provider's liability for fraudulent transactions, empowering the Payment Systems Regulator to bring rules in the area. These rules (PSR Specific Direction 20) entered into force yesterday:

• the new rules apply to all payment service providers, not just banks
• the rules protect individuals, microenterprises and charities
• rules apply to UK domestic payments only and using some payment systems
• the rules provide for mandatory reimbursement except when consumers were complicit in fraud or grossly negligent, the Regulator, however, clarified that the gross negligence exception is a high bar and does not apply to vulnerable consumers
• firms can choose to have a £100 excess (except in the case of vulnerable consumers)
• the maximum amount claimed can be £85,000, or firms can opt for a higher threshold internally
• reimbursement amount is shared 50-50 between sending and receiving bank
• there are set claims and reimbursement deadlines.

The new rules are certainly welcomed. APP fraud caused a lot of consumer detriment, and the lack of effective rules led to legal uncertainty. It is a positive development that there are much fewer exceptions in the new rules. However, exceptions and limits do exist, e.g. the rules do not apply to international transactions, and there is uncertainty about how the gross negligence exception will be enforced and who will be considered vulnerable consumers for the purposes of the exceptions. These nuances will need to be carved out by practice, and the Financial Ombudsman Service, which handles consumer complaints, is likely to play a key role.

Although these rules apply to UK domestic transactions only, they are helpful to know given the prevalence of APP fraud in other countries, including EU Member States and can be beneficial in developing PSD3. 

Coronavirus and unfairness: scams and unfair practices

Dear readers,

The news is full of warnings of scams and other unfair practices that consumers are exposed to these days. Using the words of The Guardian, what is for some the 'greatest heath and economic emergency for a century', for others, is a chance to 'scam a fortune from a captive market under effective house arrest.'

The spread of COVID-19 and subsequent government interventions has led to unprecedented situations, completely rearranging our lives, from working from home to social distancing. Fear for the health of our loved ones and our own and social solidarity with those in need of e.g. food is all part of our daily lives now. This is a new situation for everyone, and as such we are all vulnerable and easy prey for those that wish to take advantage of us, as consumers, to obtain financial gain.

This advantage taking can take harsh forms of fraud, that seem very common in these difficult times. BBC News ran a special feature on scams recently, giving the example of a young woman who was misled by a scammer posing as a rental agent into transferring part of her rent in advance to the scammers account, believing that she was helping other vulnerable tenants who could not afford to pay rent (see more examples here). A couple of days ago Finextra reported on a new pop up malware activated by a cyber-attacker to open a webpage titled 'Coronavirus Finder'  which clams there are people nearby infected with the virus. In order to find the infected individuals the victim is asked to pay only 0.75 euros on a payment page set up by the hacker. The attempted payment of this money would then transfer the bank details of the consumer to the fraudster. Fraudsters even pose as the EU Commission sending fake debt collect letters for unpaid taxes. There are also teams of people showing up at consumers' homes dressed in protective gear, to supposedly check whether the consumer's environment is not contaminated with the virus. When some of them are talking to consumers, others are robbing the house. New COVID-19 themed scams appear virtually every day, and they cost, for instance, UK customers 800 000 pound sterling in the past month.

Apart from clear cases of fraud, there are other, perhaps less financially harmful but still unfair practices. While many traders have shown their goodwill by providing free (digital) services and digital content, such as fitness training and free entertainment for kids, and free delivery of goods, there are also those that have taken unfair advantage of the current situation, by raising the price of goods in high demand such as toilet paper and by selling fake goods such as face masks and sanitizers that allegedly cure the illness.

The current situation placed the key actors in consumer protection enforcement on high alert across Europe. Authorities are already taking steps to prevent the illegal content to reach consumers, for instance, the Italian Consumer Protection Authority blocked the website of a trader who claimed that he sells the only drug that cures the illness.  On March 20 the national consumer protection authorities within the CPC network issued their Common Position on COVID-19, and subsequently the EU Commissioner for Justice and Consumers wrote to online platforms and marketplaces to combat these practices.

The new situation will be yet another grand challenge for EU consumer law. It is our job as academics and policy makers to question whether the current legal framework and enforcement tools are fit for purpose. In particular, enforcement of consumer rights at the EU level and the functionality of the CPC network and the role of the EU Commission might be questioned once again (see for instance our reports here  and here). It is also less clear what will the EU Commission and national authorities do about stopping specific scams such as the illegal transfer of money and the theft of personal data. These may even be outside the competence of national consumer protection authorities and will require further cooperation and coordination with the relevant authorities. Finally, we should consider whether the concept of consumer vulnerability needs to be further worked on in the new circumstances, and generally whether these new circumstances require new or redefined measures of protection.

If you are interested in these issues, please listen to the recording of the public webinar of our colleague Dr Christine Riefa (with contributions of Professor Christian Twigg-Flesner) on Consumer Rights, Scams and Coronavirus (accessible here). You can also share your views and information on COVID-19 related scams or unfair practices in comments.

And finally, please stay safe and stay alert at all times 🌈