Revealed: £208m lost to bank transfer scams this year

Fraudsters stole more than £208m from banking customers and small businesses through sophisticated bank transfer scams in the first half of 2019 - and only £39.9m was returned to victims.

New figures from UK Finance, the trade body that represents banks, revealed that the total sum lost to all fraud, including card, cheque and remote banking fraud, was £616m from January to June 2019.

Bank transfer fraud - which involves scammers tricking victims into sending them money from their bank accounts - has seen people losing huge sums of money without any way of getting it back.

A new code, introduced in May this year, aims to give customers more protection from this kind of crime. But the code is voluntary, and nearly half of the UK's major banks and building societies haven't signed up.

In fact, while the amount lost to scammers has increased, the amount refunded has dropped over the past year.

Here, we take a closer look at the scale of bank transfer fraud, and what banks should be doing to protect their customers.

How big are bank transfer scams?

Of the £208m lost to bank transfer fraud in the first six months of the year, £147m was stolen from personal account holders, and £61m from business accounts.

A large amount of this money went to investment scams, with people losing £12,200 each on average in fraudulent investment cases.

The most common type of bank transfer fraud was purchase scams, which accounted for two thirds of all cases targeting personal customers.

How much has been returned?

Over the past 18 months, the amount personal account holders have lost to bank transfer fraud has increased.

Yet despite the new code, which was introduced in May, victims are getting back less money, with the proportion of money reimbursed decreasing over the past six months.

The table below has the details.

How bank transfer fraud works

Often, scammers will impersonate people or organisations you trust. They could pose as your bank, your solicitor, or official bodies such as HMRC.

Their methods of impersonation can be highly sophisticated, with 'spoofing' techniques allowing them to use what appear to be genuine phone numbers and email addresses.

Fraudsters will sometimes pretend to be calling from your bank, contacting you because your account has been 'compromised'. They will then tell you to transfer your money into a 'safe' account - which actually belongs to them.

If someone claiming to be from your bank calls you with a request like this, it is extremely unlikely to be genuine. Hang up the phone, wait several minutes, and then call your bank from a number on its official website.

Scammers can also pretend to be in a romantic relationship with someone online to convince them to send large sums of money. Alternatively, you might come across fraudsters who take payment for goods or services and then never deliver them.

• Find out more:how to get your money back after a scam

Claiming for fraud compensation

In May 2019, a voluntary code of conduct was introduced to give customers more protection from bank transfer fraud. So far, just over half of the UK's banks have signed up to it.

The code requires banks, building societies and other payment providers to do more to protect customers from scams or, if they fail to do so, to reimburse victims.

Banks will need to take steps to detect payments that might involve scams, provide clear warnings to customers about the risks of bank transfers, and identify potentially vulnerable customers. They must also freeze or delay payments that they think might have come about from scams.

If either the bank that sends the funds or the one that receives them fails to meet these standards, it must reimburse you for the money you have lost. If neither you nor the bank was at fault, you will still be reimbursed from a bank-funded compensation fund.

When is the customer at fault?

Bank transfer scams are increasingly difficult to spot, but the new code does give banks the option of refusing to reimburse you if it finds that you:

• ignored warnings about scams
• did not take care to establish that you were sending money to a legitimate recipient
• were 'grossly negligent' - but this is hard to define
• are a small business or charity that didn't follow internal payment procedures
• acted dishonestly when reporting the scam.

If you disagree with your bank's decision, you can take it to the Financial Ombudsman Service to complain about either your bank, or the bank you sent the money to.

• Find out more:bank transfer scam victims to get refunds from May 2019

Which banks have not signed up to the code?

As of September, there are 12 major banks and building societies that haven't signed up to the code, leaving millions of customers without the full protection it offers.

Of these, the following nine said they are working towards becoming signatories:

• Bank of Ireland
• Citibank
• Clydesdale Bank
• Monzo
• Post Office Money
• Tesco Bank
• Co-operative Bank
• Virgin Money
• Yorkshire Bank

Monzo told us it was planning to sign up 'by the end of July', but as of 26 September we have not heard any developments. The Co-operative Bank said it would implement the code by the end of September.

The other three banks - Danske Bank, First Trust Bank and N26 - were still assessing what becoming a signatory involves.

On the other hand, TSB has exceeded the code's requirements by committing to compensate all blameless customers who fall victim to scams.

Has your bank signed up?

Search the table below to see if your bank has signed up, or is planning to sign up, to the voluntary code:

• Find out more:best banks for dealing with fraud

New scheme to warn customers of fraud risk

The code also requires banks to introduce new technology to warn customers about fraud.

This technology is called 'confirmation of payee', and it has a very simple meaning: your bank will need to tell you if the name you've entered for the account you're paying matches the account holder.

At the moment, although you do have to write something in the 'name' field when you make a bank transfer, UK banks won't check this against the account holder's actual name.

Scammers can exploit this by telling victims to make a payment to 'HMRC', for example, when the account is in the criminal's name.

Banks were originally meant to implement this technology by July 2019, although a spokesman for UK Finance told the Treasury Select Committee it could be delayed until 2020.

• Find out more:vital bank security check delayed until 2020

Which? urges all banks to join the code

Since the code and reimbursement scheme are currently still voluntary, Which? is urging every bank and building society to sign up to the code to give their customers the reassurance they deserve, regardless of who they bank with.

It's also important that the reimbursement fund for victims where no bank is to blame continues past the end of 2019, when its funding is scheduled to end.

Jenny Ross, Which? money editor, said: 'The continuing rise of bank transfer fraud - with huge losses and little progress made returning money to victims - shows why the new banking industry code is so important and must deliver results.

'In force since the end of May, it promises better protection for fraud victims, and must lead to a significant increase in the amount of money being reimbursed to victims of these sophisticated scams.

'The banking industry must now urgently ensure that reimbursement for blameless victims continues beyond the end of this year. It is unthinkable that some innocent people could once again be exposed to the threat of losing their life savings to this devastating crime.'

Join our campaign by signing the petition calling for the government to safeguard us from scams.