Fraudsters stole more than £208m from banking customers and small businesses through sophisticated bank transfer scams in the first half of 2019 - and only £39.9m was returned to victims.
New figures from UK Finance, the trade body that represents banks, revealed that the total sum lost to all fraud, including card, cheque and remote banking fraud, was £616m from January to June 2019.
Bank transfer fraud - which involves scammers tricking victims into sending them money from their bank accounts - has seen people losing huge sums of money without any way of getting it back.
A new code, introduced in May this year, aims to give customers more protection from this kind of crime. But the code is voluntary, and nearly half of the UK's major banks and building societies haven't signed up.
In fact, while the amount lost to scammers has increased, the amount refunded has dropped over the past year.
Here, we take a closer look at the scale of bank transfer fraud, and what banks should be doing to protect their customers.
Of the £208m lost to bank transfer fraud in the first six months of the year, £147m was stolen from personal account holders, and £61m from business accounts.
A large amount of this money went to investment scams, with people losing £12,200 each on average in fraudulent investment cases.
The most common type of bank transfer fraud was purchase scams, which accounted for two thirds of all cases targeting personal customers.
Over the past 18 months, the amount personal account holders have lost to bank transfer fraud has increased.
Yet despite the new code, which was introduced in May, victims are getting back less money, with the proportion of money reimbursed decreasing over the past six months.
The table below has the details.
|Period||Amount stolen||Amount returned||% returned|
Often, scammers will impersonate people or organisations you trust. They could pose as your bank, your solicitor, or official bodies such as HMRC.
Their methods of impersonation can be highly sophisticated, with 'spoofing' techniques allowing them to use what appear to be genuine phone numbers and email addresses.
Fraudsters will sometimes pretend to be calling from your bank, contacting you because your account has been 'compromised'. They will then tell you to transfer your money into a 'safe' account - which actually belongs to them.
If someone claiming to be from your bank calls you with a request like this, it is extremely unlikely to be genuine. Hang up the phone, wait several minutes, and then call your bank from a number on its official website.
Scammers can also pretend to be in a romantic relationship with someone online to convince them to send large sums of money. Alternatively, you might come across fraudsters who take payment for goods or services and then never deliver them.
The code requires banks, building societies and other payment providers to do more to protect customers from scams or, if they fail to do so, to reimburse victims.
Banks will need to take steps to detect payments that might involve scams, provide clear warnings to customers about the risks of bank transfers, and identify potentially vulnerable customers. They must also freeze or delay payments that they think might have come about from scams.
If either the bank that sends the funds or the one that receives them fails to meet these standards, it must reimburse you for the money you have lost. If neither you nor the bank was at fault, you will still be reimbursed from a bank-funded compensation fund.
Bank transfer scams are increasingly difficult to spot, but the new code does give banks the option of refusing to reimburse you if it finds that you:
As of September, there are 12 major banks and building societies that haven't signed up to the code, leaving millions of customers without the full protection it offers.
Of these, the following nine said they are working towards becoming signatories:
Monzo told us it was planning to sign up 'by the end of July', but as of 26 September we have not heard any developments. The Co-operative Bank said it would implement the code by the end of September.
The other three banks - Danske Bank, First Trust Bank and N26 - were still assessing what becoming a signatory involves.
On the other hand, TSB has exceeded the code's requirements by committing to compensate all blameless customers who fall victim to scams.
Search the table below to see if your bank has signed up, or is planning to sign up, to the voluntary code:
The code also requires banks to introduce new technology to warn customers about fraud.
At the moment, although you do have to write something in the 'name' field when you make a bank transfer, UK banks won't check this against the account holder's actual name.
Scammers can exploit this by telling victims to make a payment to 'HMRC', for example, when the account is in the criminal's name.
Banks were originally meant to implement this technology by July 2019, although a spokesman for UK Finance told the Treasury Select Committee it could be delayed until 2020.
Since the code and reimbursement scheme are currently still voluntary, Which? is urging every bank and building society to sign up to the code to give their customers the reassurance they deserve, regardless of who they bank with.
It's also important that the reimbursement fund for victims where no bank is to blame continues past the end of 2019, when its funding is scheduled to end.
Jenny Ross, Which? money editor, said: 'The continuing rise of bank transfer fraud - with huge losses and little progress made returning money to victims - shows why the new banking industry code is so important and must deliver results.
'In force since the end of May, it promises better protection for fraud victims, and must lead to a significant increase in the amount of money being reimbursed to victims of these sophisticated scams.
'The banking industry must now urgently ensure that reimbursement for blameless victims continues beyond the end of this year. It is unthinkable that some innocent people could once again be exposed to the threat of losing their life savings to this devastating crime.'