Mandatory reimbursement: The Impact on PSPs

If you look at fraud statistics in the UK, it is clear why APP scams are front and centre of the payments agenda. With total losses to customers exceeding £480 million in 2022, the drive to protect customers’ funds from malicious actors is a top priority for regulators and politicians alike. What is also clear is that the Government’s efforts in combating APP fraud remain squarely focused on the payment services sector.

What do firms need to know?

These are some of the key takeaways for firms on the PSR’s proposals:

• The PSR’s rules will only apply to payment transactions processed through Faster Payments, but there are plans to roll out reimbursement requirements for CHAPS and me-to-me payments, too, in due course.
• PSPs must reimburse customers up to a maximum amount less than the excess amount, which the customer must pay (the precise amounts are subject to consultation).
• The sending PSPs will be responsible for reimbursing their customers but may share the costs 50/50 with the receiving PSPs.
• Only in circumstances where customers are deemed grossly negligent will PSPs be able to avoid reimbursement.
• Vulnerable customers must be treated more favourably under the rules. For example, vulnerable customers won’t need to pay an excess if they make a claim.
• Unlike the Code, the new rules are designed to protect the smallest businesses – all payers who are consumers, microenterprises, and small charities will be covered. This gives some good news to smaller businesses following the Supreme Court decision in Phillips, which restricted the scope of the Quincecare duty of care on banks so as not to cover the prevention of payment scams.

When are customers responsible for their own actions?

In response to industry requests for clarity on when a customer should be held responsible for their own actions in an APP fraud scenario, the PSR has issued Consultation Paper CP23/7: ‘The consumer standard of caution’. This ‘standard’ refers to the criteria the customer should meet for their claim to be valid and comprises three key elements:

1. A requirement to consider specific, directed scam warnings by the PSP;
2. A requirement to notify their PSP promptly; and
3. An obligation to respond to reasonable and proportionate requests for information.

The desired effect of the ‘standard’ is clear: the bar will be set higher for PSPs to give “specific, directed” warnings. This suggests that generic warnings appearing as standard as part of all payment journeys may be insufficient: now, there will need to be an element of tailoring, which is a much higher bar. If this is the approach, the implication is that any lesser warning would invalidate a refusal to reimburse because the customer had not met the standard of caution. Firms might be tempted to warn the customer that all ‘at risk’ payments will likely be scams. However, such a blanket approach to warnings seems unlikely to pass the test of being specific and direct.

Gross negligence

Even if the customer fails to meet the ‘standard of caution’, PSPs must still show the customer was fraudulent or met the ‘gross negligence’ threshold before they can refuse reimbursement. This concept of ‘gross negligence’ will be familiar to PSPs in the context of unauthorised payment fraud, which means PSPs must show that the customer acted with a ‘significant degree of carelessness’. However, it is notoriously difficult to prove and often leaves PSPs with little choice but to reimburse. The PSR’s consultation paper does little to remove that uncertainty.

Vulnerable customers

Finally, firms must take heed of the carve-out from the standard for vulnerable customers. Determining who is a vulnerable customer (or who is not) will be one of the most difficult challenges for PSPs, given the broad interpretation applied by regulators. This is easier said than done in a digital age where many Faster Payments are instructed online and with less opportunity to engage with customers face-to-face.

What the PSR’s proposals mean for the provision of banking services

On the positive side, the new rules will help incentivise deploying more sophisticated technology to combat APP scams, and some PSPs may even manage to use this to their competitive advantage if done well. Already, industry initiatives are in motion to improve fraud information sharing between PSPs, with other PSPs also exploring introducing their own tools. For example, Monzo recently announced a new in-app feature to help customers check in real-time if they are talking to a customer agent or a fraudster.

The flip side is that such solutions come at a cost – a not-so-small ask when firms grapple with the extra costs of enhanced transaction monitoring, new process-builds for APP scam warnings, and the steadily rising costs of payment systems.  This impacts PSPs’ business models and, ultimately, their bottom line. If an unwelcome consequence of the proposals is to lead PSPs to increase charges to offset these costs, this will hit consumers and small businesses hardest, and at a time when their finances are already stretched.

Some final thoughts

Despite the potential for some fine-tuning, it is clear that the PSR’s proposals are a genuine step forward in combatting APP fraud. Indeed, introducing the new reimbursement framework was (and is) an important pillar of the Government’s wider fraud strategy, hoping that these measures will incentivise PSPs and, indeed, other industries to prevent APP fraud from happening in the first place. Only time will tell, however, whether or not the mandatory reimbursement proposals can truly set the benchmark in the fight against fraud without equally robust action in other sectors or whether they will simply create greater incentives to perpetrate more fraud, with compulsory reimbursement reducing customer caution and encouraging fraudsters.