Bank transfer fraud victims face refund lottery

Banks are treating many victims of fraud unfairly or inconsistently, a new Which? report reveals, as it presses for the industry reimbursement scheme to be made mandatory.

A year ago, the biggest banks and building societies signed up to a voluntary code setting standards for treating victims of authorised push payment (APP) fraud.

This code has led to more innocent people getting their money back but our evidence suggests that banks are relying too heavily on fraud warnings, placing unreasonable expectations on victims and failing to properly assess vulnerability.

Today, we're publishing a report called: 'Reimbursement for authorised push payment fraud: Consumer experiences of the Contingent Reimbursement Model Code' that captures the experiences of 150 scam victims who have been in contact with Which? since the code was introduced last year.

We've set out recommendations for improvement ahead of a review of the code by the Lending Standards Board. We're also calling for the code to be made mandatory so that all customers can benefit from its protections.

The reimbursement lottery

Though APP victims do stand a much better chance of getting their money back under the code, we're concerned that rates of reimbursement are lower than expected.

In the year before it was introduced, just 19% of the amount lost was returned compared to 41% reimbursed in the first six months since the code launched.

However, our analysis of anonymised data from the Payment Systems Regulator exposes huge inconsistencies in reimbursement rates between May 2019 and February 2020:

• Four of the eight firms signed up to the code fully reimbursed victims in 6% or fewer cases (one firm fully reimbursed just 1% of victims).
• One firm had chosen to partially reimburse 93% of cases, while another partially reimbursed just 1% of cases.
• The value reimbursed also varies significantly, with one firm reimbursing just 6% of the amount stolen compared to another firm that reimbursed 63% of the value of cases.

Which? has intervened multiple times to help victims who have been told they won't be reimbursed, frequently helping overturn banks original decisions.

We wouldn't have to do this if the code was being implemented fairly and consistently.

• Find out more:what to do if you are the victim of a scam

Unreasonable expectations

We've found that banks unfairly blame customers who ignore fraud warnings at the point of payment.

These warnings should be subject to much more rigorous testing and customer feedback if banks want to rely on them to reject reimbursement.

We think banks sometimes have unreasonable expectations of customers who may be victims of highly sophisticated scams.

The code doesn't detail a definitive list of dos and don'ts for consumers - because fraud is too diverse for this to be fair - so banks should look at the specific circumstances when deciding whether to reimburse a victim.

This is particularly true when fraudsters are able to spoof legitimate communications to trick victims into thinking that their number belongs to a bank or other legitimate business.

We think customers should be reimbursed in the vast majority of these cases.

• Find out more: Which? urges fraud victims to ask the Ombudsman for a review

Assessing for vulnerability

Banks may also be failing to properly assess vulnerability.

The code states that firms 'should provide a greater level of protection for customers who are considered vulnerable to APP scams and these customers should be reimbursed regardless.

In one case, a scammer stole £20,000 by pretending to call from Santander's fraud department. The bank said they victim would not be reimbursed because they went ahead with the bank transfer despite ticking a box confirming that they had read a fraud message.

Once Which? asked Santander to review the case, in light of the fact that they were undergoing medical treatment at the time, it agreed to refund the full amount.

A spokesperson for Santander said: 'In light of the new information that was shared about her medical condition, we have refunded her the full amount that was taken from her account.'

What Which? is calling for

We've set out recommendations for improvement ahead of a review of the code by the Lending Standards Board. We're also calling for the code to be made mandatory so that all customers can benefit from its protections.

Gareth Shaw, Head of Money at Which?, said: 'The scams code is a landmark milestone in the fight against fraud, but our analysis has found clear issues with how banks are meeting its core objective of reimbursing blameless people who have lost money through bank transfer scams.

'Even as this type of crime continues to surge, the lack of fairness, consistency or transparency across the industry means that the chances of people getting their money back is often a total lottery.

'A voluntary approach to tackling bank transfer fraud has failed. Banks, regulators and government must work together to make the code mandatory and ensure that strong standards on reimbursement are introduced.'

• Which? campaigns to make life fairer, simpler and safer for all. Find out more about our campaign to stamp out scams.

How to get your money back

If you're the victim of bank transfer fraud and your bank is signed up to the code, you should make a formal complaint asking for reimbursement.

Banks currently signed up to the code are:

• Barclays
• HSBC Group (includes First Direct and M&S Bank)
• Lloyds Banking Group (includes Bank of Scotland and Halifax)
• Metro Bank
• Nationwide
• NatWest Group (includes Royal Bank of Scotland)
• Santander
• Starling Bank
• The Co-operative Bank

TSB is not a signatory of the code, however it promises to reimburse all victims of fraud under its 'Fraud Refund Guarantee', launched on 14 April 2019.

If you've been told your bank won't reimburse you following a scam, you can ask the Financial Ombudsman Service (FOS) to assess your complaint, for free.

You must have received a final response from the bank first, although if they haven't resolved your complaint within eight weeks, you can take your complaint straight to the FOS.

• Follow our step-by-step guide on how to take your complaint to the FOS.