Fraud victims refused a refund are urged to ask financial ombudsman for review

Which? Money is urging fraud victims who have been refused reimbursement to ask the financial ombudsman to review their cases, following new guidance on handling fraud complaints issued to banks.

The Financial Ombudsman Service (FOS) resolves disputes between financial companies and their customers without having to go to court. It regularly publishes information to help banks and other firms better understand what it will consider when investigating complaints.

New FOS guidance on scams published this week suggests that firms can be too quick to dismiss refund claims, particularly where authorised push payment (APP) fraud is concerned.

APP fraud is ruthless and fast-growing, jumping 45% in 2019 and resulting in losses of £456m. Yet victims are often told they won't get their money back because they 'authorised' the payment themselves.

Chief executive at the FOS, Caroline Wayman, says that the service continues to receive a significant number of complaints from fraud victims:

'If you're concerned that you've been targeted, you should act quickly and get in touch with your bank as soon as you can. If you're unhappy with their response, get in touch with the FOS and we'll see if we can help.'

Authorised vs unauthorised fraud

An 'unauthorised' payment is one that you didn't ask your bank to make and should almost always be refunded, as long as you haven't acted fraudulently or with 'gross negligence' (a high bar that goes beyond ordinary carelessness).

Broadly speaking, 'authorised' payments are those that you instructed your bank to make, as in you knew that money was leaving your account. In cases of APP fraud, also known as bank transfer fraud, victims are tricked into authorising a payment to an account which is controlled by a criminal.

Redress is always more complicated in cases where you've authorised the payment because banks have a legal duty to carry out your instructions. But, the FOS says it will consider how the scam unfolded, how you were deceived and how the bank behaved.

Importantly, regulated firms are required to act with 'due skill, care and diligence', and should use reasonable care when executing a customer's orders (known as the 'Quincecare duty').

The FOS will also consider whether the Banking Protocol - a rapid response scheme through which branch staff can alert police and Trading Standards to suspected frauds - was implemented.

UK Finance collates data on different types of APP fraud including:

• Purchase scams Goods, such as those advertised on social media sites, that never arrive
• Investment scams Fictitious funds or fake investments
• Romance scams Maliciously targeting victims via social media or dating websites and asking them for money
• Advance fee scams Criminals pretending payment will lead to a windfall e.g. lottery win or inheritance
• Invoice and mandate scams Sending victims fake invoices from someone they're expecting to pay, such as a builder or solicitor
• CEO fraud Impersonating high-ranking officials from the victim's organisation to request money
• Impersonation scams Where criminals pose as the police, banks or other familiar firms and request bank transfers to accounts they control

The graph below reveals how many cases there are and how much money is lost each year according to UK Finance data.

Banks wrongly refusing to refund losses

These recent ombudsman rulings give a clearer indication of where banks are wrongly denying reimbursement after losing money to APP fraud.

Lloyds failed to protect number spoofing victim

A phone call in late 2018 from 'HMRC' led to Miss R losing £11,300, after being told she owed unpaid income tax from a previous job and would be taken into police custody if she failed to pay it.

When she queried how she could be sure the caller was genuine, the scammer called back and told her to look for the number on the HMRC website.

Satisfied that the number appeared to match the official HMRC telephone number (thanks to number spoofing) Miss R then followed instructions to make several payments both over the phone and in branch over the course of two days.

In a nasty twist, Miss R was coached to pretend she wanted to put the money on a prepaid travel card to pay for a long-distance holiday - banks should be aware that many fraudulent payments go on pre-paid travel cards.

Although the ombudsman accepted that Lloyds had provided warnings about scams over the phone, she thought the scam script was 'as much, or predominantly, about limiting Lloyds' potential liability rather than seeking to protect Miss R from financial harm'.

And, considering Miss R made a substantial payment to a new payee that virtually emptied her account, Lloyds should have asked extra questions to challenge the purpose of the payment and give her more tailored information about scams.

Lloyds was told to refund all losses and pay interest calculated at 8% a year from the date of each payment. A further £500 was awarded for material distress and inconvenience.

Santander branch staff should have called the police

In another case, Santander was ordered to refund £8,500, plus interest, and pay £300 in compensation to Mrs S, 85, who was scammed into withdrawing the cash at her local branch by a criminal posing as a chief constable.

He said her account had been compromised and the police believed someone at Santander could be involved. Believing that she was helping, she agreed to withdraw money to check for counterfeit notes. She was instructed to say she needed the cash to buy a car and keep quiet about what she was doing or or risk ruining the investigation.

Defending its decision not to refund the subsequent losses, Santander argued that branch staff expressed their concerns over the withdrawal at the time, and read Mrs S a 'scam script', which included a warning that the police would never ask someone to withdraw money for the purposes of an investigation or fraud.

However, the ombudsman found the wording of this script unclear and argued that staff should have realised that Mrs S could be at risk and called the police, due to these factors:

• She was 85 at the time and banks know that elderly customers are more likely to be targeted
• She was asking for a considerable amount of cash
• She said she was using the cash to buy a car and she was adamant that she wanted the cash that day
• The payment was significantly out of character and unusual for her.

NatWest failed to realise financial harm risk

In an almost identical case, Mr and Mrs S lost £40,000 as a result of a 'safe account' scam.

Over the course of multiple phone calls from people claiming to be fraud investigation officers from NatWest, they were told that two employees from their local branch were suspected of taking money from their account.

The calls appeared to come from a genuine NatWest phone number, thanks to number spoofing technology, so the couple took it very seriously when they were told to transfer their savings to a 'safe account' for protection.

They were told that two new accounts had been opened in their names and told them to visit their local branch to transfer £20,000 into each of them.

When they discovered they were the victims of fraud, NatWest said it had acted with due care and diligence and would not be refunding their losses.

An ombudsman disagreed, finding that branch staff should have recognised that these transactions were out of character and implemented the Banking Protocol to protect them - by taking the time to ask further questions in 'a more bespoke and tailored way'.

She found it likely that the scam would've come to light with further questioning from the cashier, the manager or even a police officer.

NatWest was ordered to refund the £40,000 with interest as well as pay £300 compensation.

New protection for APP fraud victims

As of 28 May 2019, a voluntary code has introduced significant new protection for APP fraud victims, although not all banks and building societies have signed up.

Under the code, customers should receive compensation if they fall victim to APP fraud, provided they meet the standards expected of them.

Industry data shows that banks have returned £41.3m from 50,311 fraud cases assessed under the code, but while this is significant increase on the 19% of APP losses that were reimbursed before the code was introduced, it only accounts for 41% of total losses.

Which? has previously published concerns that banks are shifting responsibility on to customers to avoid paying out for bank transfer fraud under the code.

If you've been told your bank won't reimburse you following a scam, you can ask the FOS to assess your complaint for free. You must have received a final response from the bank first, although if they haven't resolved your complaint within eight weeks, you can take your complaint straight to the FOS.

• Follow our step-by-step guide on how to take your complaint to the Financial Ombudsman Service.

Article updated on 3 March 2020, to include a quote from the chief executive at the FOS.