APP fraud: the PSR’s quest for mandatory reimbursement

Posted: 18/11/2022

Authorised push payment (APP) fraud involves a payer being deceived or defrauded into authorising a payment to a criminal posing as a genuine recipient. Since payments made using real-time payment schemes are irrevocable, in most cases the victims are unable to reverse a payment once they realise they have been duped. In the first half of 2022, APP fraud losses amounted to £249.1 million of the £609.8 million that was lost to fraud during that period.

In March this year, we reported on the landmark case of Philipp v Barclays Bank plc [2022] EWCA Civ 318, in which the Court of Appeal ruled to extend a bank’s Quincecare Duty (the duty to exercise reasonable care and skill in carrying out a customer’s instructions) to include APP fraud. Further details can be found here. That decision is now under appeal to the Supreme Court.

Although payment services providers (PSPs) are not under a mandatory obligation to reimburse victims of APP fraud, the Financial Services and Markets Bill (FSM Bill) and the Payment Systems Regulator (PSR) look set to change the situation. The PSR’s consultation paper, published on 29 September 2022, sets out how it intends to achieve this.

Voluntary Contingent Reimbursement Model: 2019

The Voluntary Contingent Reimbursement Model (CRM) was published in 2019, setting out increased consumer protection standards which sought to reduce the number of APP scams. Under the CRM, any customer of a signatory of the code could expect to be reimbursed where they were not to blame in relation to a successful scam. However, in practice, this often does not occur and the signatories are not reimbursing customers uniformly.  

For this reason, the PSR has published its new consultation, setting out its proposals for implementing a mandatory reimbursement scheme for consumer victims of APP fraud. The PSR has invited responses to this latest consultation by 25 November 2022.

Mandatory reimbursement: 2022

The PSR proposes to build mandatory reimbursement into the Faster Payment rules, to be administered by Pay.UK (even though it acknowledges that Pay.UK is not currently set up to perform such a role). The mandatory reimbursement scheme is set to apply to all UK APP fraud carried out via Faster Payment, regardless of value.

PSPs would be required to reimburse consumers, charities and micro-enterprises (together categorised as ‘consumers’ in the consultation) which fall victim to APP fraud in the UK. While PSPs would be able to set a minimum threshold for a reimbursement claim (£100 at most), set a time limit for APP fraud claims to be reported (no less than 13 months from the payment) and charge an excess for processing a claim (£35 at most), they would be required to reimburse the consumer in question as soon as possible, and ‘no more than 48 hours from the fraud being reported’. The only exceptions to this relate to cases where customers are involved in the APP fraud themselves or have acted with gross negligence. The PSR has stated that the exception for gross negligence is a ‘high bar’ and would not apply where a consumer was vulnerable. Additionally, in circumstances where there is ‘evidence or reasonable grounds for suspicion’ that one of these exceptions applies, the PSP would be entitled to delay the reimbursement. It is worth noting, however, that there is no proposal within the consultation in relation to how long reimbursement could be delayed, or whether a refund could be ‘clawed back’ if an exception is determined to apply to a claim which has already been reimbursed.

The default position in relation to the costs of reimbursement is that they would be shared equally between the paying and receiving banks, subject to a dispute management process. The consultation admits that this 50/50 allocation is not ‘fine-tuned’, but a critical query remains in relation to the application of the dispute resolution process, as well as its impact on competition, particularly where one of the two PSPs is a smaller entity or a new market entrant. This is an important and welcomed move in making receiving banks more responsible.

The PSR anticipates that it will obtain the regulatory powers required to bring about its mandatory reimbursement changes from the FSM Bill which was introduced to the UK Parliament in July 2022. It is envisaged that the FSM Bill will receive Royal Assent in spring 2023, following which the PSR plans to publish a policy statement on mandatory reimbursement and establish the ‘core requirements’ of the scheme ‘no later than during 2024’.

Although consumers are expected to welcome this mandatory reimbursement scheme, this does not cover all payments made and lost to APP fraud. For example, CHAPS and international payments are not covered. As many fraudsters target the vulnerable and direct funds to be transferred abroad or into cryptocurrency platforms, this still leaves a big gap in the protection for consumers.

Whilst the consultation highlights the fact that it is ‘focusing on the parts of the APP scam ‘ecosystem’ that are within [the PSR’s] remit’, it is clear that further intervention is required from other relevant sectors and regulators in order to bridge the gaps left by the mandatory reimbursement scheme. This also highlights the significance of the outcome in Philipp v Barclays Bank plc [2022] EWCA Civ 318 which currently provides, potentially, increased protection to consumers where a bank has failed to exercise reasonable care and skill when implementing its customers’ instructions. However, whether or to what extent that decision survives the Supreme Court remains to be seen.

This article was co-written with Sophie Newman, trainee solicitor in the commercial dispute resolution team. 

Return to news headlines