Consumers to be protected from Authorised Payment Push (APP) fraud

Wednesday, December 19, 2018

APP fraud


The Financial Conduct Authority (FCA) has published new rules to allow victims of Authorised Payment Push (APP) fraud to complain to the payment services provider (PSP) receiving their payment.

Currently, the complaint is dealt with by the PSP sending the payment but from 31 January 2019, this will be extended to the PSP receiving the payment. The new rules will also allow victims to take their complaint to the Financial Ombudsman Service if they are unhappy with the outcome of their complaint.

What is APP fraud?

APP fraud occurs when an individual or business is deceived into sending payment under false pretences to a bank account controlled by a fraudster. Victims can’t revoke payments as they are made in real time. Payments are made in real time so victims can’t revoke the payment when they realise it has been made fraudulently.

In 2016, the Telegraph reported on an APP scam where a number of people were tricked into paying private school fees to a fraudulent account. The report revealed that a gang of thieves had broken in to multi-occupancy mailboxes and stolen letters. When they came across private school bills they doctored the payment details and replaced the letters, scamming several families out of thousands of pounds.

UK Finance data shows there were 43,875 cases of APP fraud amounting to total losses of £236 million in 2017.

APP in the spotlight

A super-complaint from Which? brought APP fraud into the spotlight in 2016. The complaint called on the Payment Systems Regulator (PSR) to investigate whether banks are doing enough to protect consumers from bank transfer scams. In December 2016, the PSR responded to the super-complaint. The body acknowledged that banks need to improve how they work together to respond to these scams and launched a programme of work to better protect consumers.

Confirmation of Payee

In November 2018, the PSR opened a consultation for Confirmation of Payee (CoP).

CoP is the industry recognised way of checking recipient names are confirmed before payment is sent. It is regarded as an effective way of protecting consumers. Currently, PSPs ask payers for the name, sort code and account number of the account they are sending payment to; however, the name is not checked making it easier for payments to be sent to fraudulent accounts. This lack of checking also means that payments are regularly sent to incorrect accounts accidentally.

The proposed timescales for the implementation of CoP are as follows :

  • From 1 April 2019, PSPs must be capable of receiving and responding to CoP requests from other PSPs.
  • From 1 July 2019, PSPs must send CoP requests and present responses to their customers.

The consultation is open for feedback until 4 January 2019.