Authorised Push Payment Fraud – latest developments for the mandatory reimbursement scheme

On Monday 7 October 2024 the long-awaited mandatory reimbursement scheme for consumer victims of authorised push payment fraud (APP fraud) comes into effect.  This article seeks to gives some context to the new scheme and also explains the recent, controversial changes to the scheme.

In summary, the Payment Services Regulator (PSR) describes APP fraud as something which happens "when a fraudster tricks someone into sending a payment to an account outside of their control". Millions of pounds are being lost every year as a result of APP fraud, especially in a digital age where people are increasingly reliant on making payments online.  Alarmingly, the PSR stated in a report from July 2024 that for every £1 million of Metro Bank transactions sent in 2023, £266 of that was lost to APP scams. 

One important feature of APP fraud is that it is often extremely difficult to find and enforce against the fraudster, leaving the victim without any realistic prospect of recovering its loss directly.   The existing voluntary reimbursement policies of the mainstream banks and payment service providers (PSP's) also differs markedly.  Data published by the PSR shows a divergence in the current approach adopted by PSPs – for example, Nationwide fully reimbursed 96% APP scam cases reported by its customers in 2023, whereas Monzo fully reimbursed 9%.  The only other previous avenue was to complain to the Financial Ombudsman Service (FOS) who were able to make recommendations to PSPs in respect of the role they played in an individual case, but which provided no mandatory or uniform policy.

It was against this backdrop that new rules were announced by the PSR on 7 June 2023 which (broadly) requires all UK PSPs to reimburse all in-scope customers who fall victim to APP fraud when using the Faster Payments system, with a few limited exceptions. This will be implemented from 7 October 2024. 

In short, the rules will:

• require sending PSPs (ie the victim's bank) to reimburse all customers who fall victim to APP fraud (subject to certain exceptions and limits)
• require that receiving PSPs (ie the recipient bank used by the fraudster) pay 50% of the reimbursement that the sending payment service providers paid to the customer
• provide additional protections for vulnerable customers
• introduce a Customer Standard of Caution (ie an exception to reimbursement if the customer has acted with gross negligence)
• set a time limit for reimbursement
• allow sending PSPs to charge an excess up to a maximum of £100 per claim
• cover 'multi step' fraud (ie payments to an account controlled by a person other than the customer, where the customer has been deceived into granting that authorisation for the payment as part of an APP fraud)

Recent changes to the scheme

The most controversial element of the new rules was a maximum level of reimbursement which had previously been set at £415,000. However, on 25 September 2024, the PSR confirmed that this limit would be reduced substantially to £85,000.  This has brought it in line with the Financial Services Compensation Scheme, for deposits in banks that fail.  

The PSR stated in its full report dated 2 October 2024 that this change was intended to strike a balance between protecting the interests of consumers and also not creating too heavy a burden on banks and service providers, such that it would stifle innovation of new products and prevent new market entrants.  It is fair to say that the changes came about as a result of substantial industry pressure. Indeed, in their policy statement published in December 2023, the PSR noted that this was an area which had 'attracted a particularly high level of feedback and involves difficult trade-offs' and this was reiterated in the October report.

What were the considerations?

It is important to bear in mind that APP fraud would not be possible but for the ability of the fraudster to set up, or at least control, an account at the receiving PSP.   Therefore one of the intentions of this scheme is to incentivise PSPs to implement more rigorous account opening procedures, to reduce the prevalence of APP fraud.  The reduced upper limit probably does not alter or weaken this incentive because, according to the PSR, over 99% of APP fraud transactions are below the £85,000 threshold in any event (and over 90% by value).  Therefore the vast majority of the risk to PSPs in respect of their operating systems remains and, equally, most consumers will continue to be protected.

The PSR did not conclude with any great force that the lower limit will produce positive results, but rather they concluded that it more effectively balances the need to protect consumers with the potential impact of the PSPs, especially smaller ones.  Finally, regardless of the reimbursement limit that has been set, consumers still retain their right to complain to the FOS for the balance, if they think they have suffered a loss because of the acts and omissions of the PSPs.