personal finance

Cruel lottery as banks play blame game over push-payment fraud


Elena Rossi* was quoted £2,400 by her plumber for repairs to her boiler. The bill was duly emailed and Rossi transferred the sum. Only when the plumber chased her for payment did she discover that the money had been paid to a fraudster. “We found out that the scammer had hacked the plumber’s email account and was sending and intercepting emails from it,” she says.

“The invoice arrived when expected, for the exact amount, from the correct email address with the company logo on its letterhead and the correct breakdown for the work. We had no reason to suspect that there was anything wrong.”

Her bank, The Co-operative, refused to refund the stolen money and when Rossi complained to the Financial Ombudsman Service, it upheld the decision because she had authorised the payment and the bank had not acted negligently.

Rossi’s misfortune was that she was defrauded last March, two months before a voluntary code, the contingent reimbursement model, was introduced. The code requires participating banks to refund blameless victims of authorised push-payment (APP) fraud and The Co-operative became the ninth bank to sign up in December.

The bank told the Observer Rossi’s case was under review by the ombudsman, but since the code is not retrospective, it will be assessed according to the criteria in place last March, when refunds were only due if banks were found to have been negligent in investigating the fraud.

More than £200m was stolen from customers through APP fraud in the first half of 2019 and the crime is soaring. Rossi’s ordeal exposes the lottery of trying to claim a refund as success depends on when the fraud happened, the bank and what method the scammers used to deceive.

Customers who bank with one of the 10 big players such as Monzo and Tesco who have yet to sign up to the code, remain unprotected. Even those with banks who have adopted it are not guaranteed their money back as the code excuses them from refunding victims who have been “careless”. Since “carelessness” is not defined, it can be interpreted as they wish.

Victoria Ross lost £25,000 after fraudsters sent her texts purporting to be from her bank flagging up suspicious activity on her Lloyds account and advising her to transfer her balance to a “secure” account in her name. “The texts were on my genuine Lloyds text message feed and I was asked to verify that the phone number was the same as the phone number on my Lloyds bank card which it was,” she says.

Lloyds told the Observer that Ross did not take sufficient steps to verify that the text message was genuine and ignored a fraud warning about spoofed numbers’ “safe” accounts.

Ross only recalls a generic fraud alert which the scammers told her was a default message sent before every transaction. .

A report by campaign group Which? has concluded that banks are unfairly penalising customers who ignore automated fraud warnings. These are required by the code to be clear, impactful, timely and tailored to the specific scenario.

The practice could result in a PPI-like scandal, according to Pradeep Oliver, partner at Cripps Pemberton Greenish. “If it can be proven that the banks are adopting a blanket procedure in which they are refusing to refund customers due to generalised and non-specific warnings, I would hope that the FCA would intervene sooner rather than later,” he says.

Scammers are so adept at “socially engineering” victims to engage their trust and instil panic they are commonly too flustered to think rationally, even when banks specifically flag up a suspicious transaction.

Last month, business owner Emily Church* was groomed over nine hours of phone calls from criminals posing as officials from the Royal Courts of Justice and her bank, to believe she faced jail over irregular tax returns. Fraudsters gained her trust by spoofing the Royal Courts phone number, reeling off official-sounding case numbers and citing the dates of warning letters she had failed to respond to. She was told that she could settle out of court provided she signed a confidentiality agreement.

“They impressed upon me that a custodial sentence would mean the possible loss of my home, inability to get a mortgage, not being able to see my children and losing my business and reputation,” she says.

She was duped into paying £12,500 from her Lloyds and Santander accounts and misleading bank staff when they called her to question the transactions. “I was frightened that if I didn’t make something up then I wouldn’t be able to make a payment, and would end up not seeing my boys grow up,” she adds. The fraud was exposed when her partner, alarmed by her changed behaviour, prised the truth from her. Santander and Lloyds were unable to reclaim the stolen funds and told the Observer they would not refund her because she overrode automated and verbal warnings of a possible fraud.

Church plans to refer her case to the Financial Ombudsman Service which recently upheld a complaint from a victim of a very similar scenario. It ordered the bank to refund the £100,000 stolen, despite the fact that the customer, like Church, had given a cover story to staff.

Critics claim that regulations have failed to keep pace with evolving technology. The ombudsman was only given powers to investigate complaints about APP fraud a year ago. And not until the end of March will the UK’s six largest banking groups finally be required to confirm that the name of the account a customer is paying into matches the name they have entered in the payee box. Currently, only the account number and sort code is matched, enabling fraudsters to convince victims that they are transferring money to a safe account in their name.

A recent Treasury committee report concluded that this has led to thousands being defrauded since banks were first warned of the problem in 2016 and they should retrospectively reimburse them. The committee also recommends that first-time payments to a new account are delayed 24 hours to allow customers to reconsider and that the CRM code is made compulsory.

Crucially, current rules do not allow banks to prevent a payment authorised by a customer, even if they suspect it’s a scam, or to retrieve fraudulently transferred funds from a beneficiary account without a court order. They are also expected to complete a transaction within two hours under banking regulations.

These rules cost Nick Hutchinson* the £4,000 that left his account with The Co-operative 10 days after he informed the bank he’d fallen victim to an APP scam and it refused a refund. It said that the sum consisted of several card transactions made by the fraudster before Hutchinson reported it and which it was powerless to prevent under card scheme rules, even though there was a 10-day delay before the money was claimed. After contact from the Observer it refunded £3,750, as he only specifically authorised an initial £250 payment.

Financial trading body UK Finance reckons urgent reform is needed to give banks more powers when a customer is taken in. “A clearer and more effective legal and regulatory framework is needed to help address early indications of fraud and thereby help reduce harm to victims,” it says.

* Name has been changed



READ SOURCE

Leave a Reply

This website uses cookies. By continuing to use this site, you accept our use of cookies.