We use cookies to allow us and selected partners to improve your experience and our advertising. By continuing to browse you consent to our use of cookies. You can understand more and change your cookies preferences here.
When you click on a retailer link on our site, we may earn affiliate commission to help fund our not-for-profit mission.Find out more.
Fraudsters steal more than £228m a year by duping unwitting victims into making bank transfers. A new code offers reimbursement and increased protection from scams - but almost half of the UK's major banks and building societies haven't signed up.
Meanwhile, another bank security measure designed to prevent you accidentally sending money to crooks has been delayed until March next year.
We reveal the banks that haven't yet signed up, and what measures are being put in place to protect you.
On 28 May, the Authorised Push Payments Scam Code came into force, making it easier for victims of bank transfer scams to get their money back.
But as of August, 12 major banks and building societies in the UK had not yet signed up, potentially leaving millions of customers unprotected.
Of these, nine said they were working towards becoming signatories, namely:
Co-operative Bank told us it would implement the code by September. Monzo, meanwhile, said the code would be implemented 'by the end of July', although this had not happened as of 7 August. None of the other banks have committed to a firm timeline.
A further three - Danske Bank,First Trust Bank and N26 - told us they were still assessing what becoming a signatory involves.
TSB, meanwhile, has actually gone beyond the requirements of the code by committing to compensate any blameless customer that falls victim to a scam.
We are urging all banks and building societies to sign up to the voluntary code to give their customers reassurance.
Jenny Ross, Which? Money editor, said: 'People's lives are being derailed every day as life-changing sums of money are lost to bank transfer fraud, so it's incredibly concerning to see so many banks not yet signed up to this vital code.
'If the code is to deliver results for victims of fraud, all providers need to now urgently work towards implementing it - any more time wasted could result in millions more being lost as a result of this devastating crime.'
By current estimates, around 85% of bank transfers are processed by signatories to the code. So will your bank protect you?
You can find out if your bank has signed up by searching the table below:
Although hundreds of millions of pounds are lost to bank transfer scams each year, just a tiny fraction of the money - a fifth last year - is ever returned.
People lose life-changing sums to these sophisticated schemes. In some cases, criminals pose as trusted organisations, like your bank, solicitor or HMRC, to trick you into sending funds. In others, they pretend to sell goods that never existed.
Under the new code, victims who banks deem to have lost money via bank transfer through no fault of their own will get their money back. Compensation will be paid either by their own bank, or the bank that received the money, if either bank failed to meet the standards set out in the code.
If the banks did everything right, victims will be reimbursed from a fund contributed to by major banks, although this is only guaranteed until the end of the year.
To be reimbursed, you'll need to take care. You bank could refuse to compensate you if:
The first thing you should do if you realise you've sent money to a scammer is contact your bank. It should try to get your money back from the bank it was sent to.
If your bank has signed up to the code, and the scam happened after 28 May, you should be told whether you'll be reimbursed within 15 business days (or 35 days if it needs to investigate).
If your bank hasn't signed up, and it can't retrieve the funds, compensation may depend on whether your bank believes you authorised the transaction, and whether you were 'grossly negligent'.
Whether a signatory or not, if your bank unfairly refuses a refund, you can make a complaint to the Financial Ombudsman Service.
You can also report any scams to Action Fraud, the national fraud and cyber crime reporting centre.
Aside from reimbursing victims, the code also puts in place best practices that banks should follow to better protect their customers.
One major development is introducing a check on the person who is being paid - known as 'confirmation of payee'.
When you enter account details, your bank will check that the sort code and account number exist. But it doesn't check whether the name you've entered matches the account's owner.
This means it's possible, for example, to think you're moving money to another account in your name, when the payment is actually going to a criminal.
With confirmation of payee, banks would be obliged to check if the name on the account matches up. If there's a discrepancy, the bank will give you a warning.
Originally, the Payment System Regulator proposed a deadline of 1 July 2019 for the 'big six' banks (Barclays, Lloyds Banking Group, RBS, Santander, HSBC and Nationwide) to start making checks. After feedback from the banks, this has now been pushed back to 31 March 2020.
We have been campaigning for years for regulators and banks to better protect people from fraudsters. If you want to support our campaign sign our petition: Stamp Out Scams.