Vital bank security check delayed until 2020: are you at risk?

An important security measure to prevent people being tricked into sending life-changing sums of money to fraudsters has been delayed again until March 2020.

Once live, the Confirmation of Payee system will perform a name check when you make an online money transfer. You might assume this already happens, but it doesn't.

The system is coming too late for Marie-Helene Pedebernade, who believes it may have stopped her transferring a £12,000 inheritance to criminals who deceived her.

Which? explains the risks people are being exposed to, and how Confirmation of Payee could have helped the many victims of bank-transfer scams.

What's wrong with the current system?

Currently, when you do an online bank transfer to a new payee, you have to enter the name of the recipient, sort code and account number.

However, your bank only checks whether the sort code and the account number are correct, not the payee's name.

This flaw means criminals posing as trusted organisations, like your bank or solicitor, can trick people into making payments directly into their own accounts.

The screenshots below show how we were able to send money to 'Lisa Simpson' into an account held by Brean Horne from the Which? Money online team.

Why we need Confirmation of Payee now

Almost £400m has been lost to bank-transfer scams - or 'authorised push payment' (APP) scams as they are officially known - since 2017.

Confirmation of Payee will make it more difficult for scammers to impersonate trusted organisations, as the system will pick up that the account owner doesn't match the name provided.

If you make a typo, the bank will flag that the name doesn't match. Likewise, if the name of the account is linked to a different person, the system will give you an alert.

Ultimately you'll still be able to complete the transaction if you want to and trust the recipient. However, you'll have forewarning that the person you're paying may not be who you think they are.

'I truly believed I was talking to the bank and protecting my money'

Marie-Helene Pedebernade, 62, told Which? she could have benefited from the Confirmation of Payee system last year.

The self-employed translator and carer received a cold call from a scammer impersonating her bank. He said her account was at risk and urged her to move her money to another 'safe account'.

Marie-Helene was given an account code and sort code. and told by the 'adviser' that the account was set up in her name.

Marie-Helene told Which?: 'I started feeling anxious but a few years previously I had had a similar call from my bank's security which had been genuine.'

'I went along with it. I was instructed to set up a new payee, but wasn't prompted to name that new supposedly safe account.

'I moved £12,278. This was money that I inherited after the death of my mother and hadn't had time to transfer to a savings account. As soon as I put the phone down, a sense of dread came over me as I became certain this had been a scam.'

'I was in an absolute panic, so much money lost just like that! I couldn't think straight, I was angry and lost confidence in my judgment.'

Had Confirmation of Payee been live on her bank's system, Marie-Helene would have been warned that the money was being transferred to a complete stranger.

Marie-Helene lost sleep for weeks after the ordeal, but thankfully she was able to get her money back from the bank, as well as compensation and interest.

Why has Confirmation of Payee been delayed?

The Payment System Regulator (PSR) initially proposed a deadline of 1 July 2019 for the 'big six' banks (Barclays, Lloyds Banking Group, RBS, Santander, HSBC and Nationwide) to start making Confirmation of Payee checks for customers.

However, following a consultation and feedback from the banks in December 2018, the regulator needed more time to consult on the proposals.

This extended consultation closed on 5 June 2019, and the PSR told Which? it is currently reviewing the responses.

It has proposed a new deadline of 31 March 2020 for firms to get their systems up and running.

Chris Hemsley, co-managing director of the PSR, said: 'People should be properly protected. This includes taking steps to prevent the fraud from happening in the first place, and Confirmation of Payee is an important part of this.

'But it needs to be done in the right way if it is going to help protect people from APP scams and help stop payments being sent to the wrong account. This is why we have updated our plans and focussed our proposed direction so that more people start to benefit from this protection sooner.'

How are banks helping victims of fraud?

While Confirmation of Payee remains a while away, banks are taking other steps to protect their customers.

A new voluntary code of conduct, that pledges to reimburse innocent victims of bank transfer scams, came into force in May this year.

Under the new rules, banks that opt-in must pay back customers who lose money to a scam within 15 working days of their claim or up to 35 if further investigation is needed.

However, you'll have to take care. The bank can refuse reimbursement if you:

• Ignored warnings about scams when setting up and amending payees, or before making a payment.
• Did not take care to establish that the person you're sending money to was legitimate.
• Were 'grossly negligent' - although this is very difficult to define.
• Are a small business or charity and did not follow internal procedures for making payments.
• Acted dishonestly when you reported the scam.

Despite the caveats, the new code is a huge step forward in protecting consumers from increasingly sophisticated scams.

At launch, the following banks committed to the code: Barclays, HSBC, First Direct, M&S Bank, Lloyds Bank, Bank of Scotland, Halifax, Metro Bank, Nationwide, Royal Bank of Scotland, NatWest, Ulster Bank, Starling Bank, Santander, Cahoot and Cater Allen.

TSB went further andlaunched a Fraud Guarantee, pledging to refund all genuine victims of fraud, regardless of the circumstances.

What to do if you're hit by a scam

If you think you've fallen victim to a fraudster, you should call your bank immediately.

You will need to provide the details of the account you sent the money to in order for your bank to try and recover it.

You can use our template letter to help you make a formal complaint to your bank if it does not help you get back your money.

You have the right to complain if the sending or receiving bank fails to try and recover the funds properly.

If you don't get your money back and are unhappy with your bank's response to your complaint, you can go to the Financial Ombudsman, who will investigate what happened.

• Find out more:what to do if you're the victim of a bank transfer (APP) scam

Which? calls on banks to protect victims of scams

Which? has been campaigning for better protection against the rise of bank transfer fraud for the last three years.

It launched a super-complaint to the PSR in September 2016 urging the regulator to investigate the issue.

You can join our campaign bysigning the petitioncalling for the government to safeguard us from scams.