Every hour, bank transfer scam victims lose more money than the average UK worker earns in a year, new Which? research reveals. That's why we're calling on the government to urgently act on its commitment to legislate for mandatory reimbursement of victims.
Authorised push payment fraud (APP) - where a scammer tricks you into transferring money to an account they control - is now more common than card fraud, but protection against these scams still lags behind.
The voluntary Contingent Reimbursement Model (CRM) Code was an important milestone for victims when it was introduced in May 2019, but Which? has found that banks apply the standards of this Code inconsistently or .
In the first half of 2021, losses to APP fraud hit £355.3m, overtaking card fraud for the first time.
Which?'s analysis of UK Finance figures show that between July 2019 and the end of June 2021 a total of £854m was stolen in 306,573 cases of APP fraud, and only 42% of losses were reimbursed.
That means the net loss to victims is a shocking £495m - a rate of £4.7m a week or £28,203 an hour, more than the average UK salary (£25,971).
Banks are required to refund you for losses for unauthorised transactions such as card fraud - unless you are particularly careless or 'grossly negligent' - but there is limited protection against authorised fraud.
The CRM Code was designed to readdress this imbalance, but it's clear the voluntary approach isn't working.
Repeated Which? investigations have found that banks signed up to the Code are who ignore warnings or expect too much from victims even though scammers are paying for online, calling from , or even to name just a handful of common tactics.
Victims often have to fight their corner to be treated fairly, including John Andrews, in his 80s, who recently lost £3,600 when a scammer posed as his son over WhatsApp.
Lloyds Banking Group reported at the beginning of the year that the number of WhatsApp scams had surged by more than 2,000% by the end of 2021.
This particular scam followed the same pattern as other reported to Which?: he received a message supposedly from his son asking him to pay a bill as a favour because he was having problems setting up his online banking. John transferred the money from his Santander account and only discovered it was a scammer when he spoke to his son later that day.
Santander initially said it wouldn't refund John, but after Which? advised him to make a formal complaint citing the bank's responsibilities under the CRM Code, he was fully refunded.
Victims who are told they won't be reimbursed by their banks can take their cases to the FOS but face many stressful months or even years before they get a final decision.
The CRM Code has provided an increased level of protection for some consumers, but the Payments Systems Regulator (PSR) has admitted that reimbursement levels have been significantly lower than expected.
The Lending Standards Board and FOS have also repeatedly found issues with inconsistent and unfair treatment of victims.
While the government's commitment is positive, these changes must be introduced swiftly. Which? thinks a reimbursement obligation should be placed on payment providers, with a clear liability framework set out in legislation.
Rocio Concha, Which? director of policy and advocacy, said: 'Despite huge sums being lost to bank transfer scams on an hourly basis, low reimbursement rates based on inconsistent and unfair decisions by banks demonstrate how the voluntary code isn't providing the safeguards promised to victims.
'While commitments to make reimbursement mandatory were a huge win for consumers, it's vital that the government introduces the right legislation that will ensure victims get fair and consistent treatment. The regulator must also ensure it's ready to introduce and enforce mandatory reimbursement rules the moment that this vital legislation is passed.