PSR consultation: Authorised Push Payment Scams - Which? response

Four and a half years on from Which?’s super-complaint to the Payment Systems Regulator (PSR) on authorised push payment (APP) scams, progress to address the significant emotional and financial harm experienced by consumers has been far too slow. The time for strong intervention is well overdue.

The voluntary, industry-led approach that the PSR has taken on consumer protection has not worked. The improvements made to reduce the harm we identified have not been as significant as was expected or is required. For over a year the PSR has stated publicly that outcomes for victims of APP scams have been inconsistent and rates of reimbursement insufficient among customers of signatories to the voluntary Contingent Reimbursement Model (CRM) Code, which is based on the principle that the starting point should be to assume that victims of APP scams should be reimbursed in full.

The payments industry cannot be left to solve this problem on its own. The overwhelming evidence is clear that neither voluntary initiatives nor competition can be relied upon to provide the minimum, industry-wide levels of protection that are required. We instead need mandatory standards of consumer protection across the industry to provide fairer and more consistent outcomes, and regulatory supervision and effective enforcement to hold firms to these standards.

Which? therefore welcomes the PSR’s proposals to introduce mandatory protection for customers, to require greater transparency on outcomes and to require greater collaboration to share information about suspect transactions. On the specific measures that have been proposed:

• We strongly support the proposal to require payment service providers to publish their APP scam, reimbursement and repatriation levels (Measure 1). We do not agree with parts of industry which argue that this is likely to help fraudsters or that fair comparisons between firms cannot be made. Instead, greater scrutiny will lead to better incentives on firms to prevent fraud and protect their customers.
• We support the proposal to require payment service providers to adopt a standardised approach to risk-rating transactions and to share the risk scores with other payment service providers involved in the transaction (Measure 2). A standardised approach to risk-rating transactions has not developed on its own. The PSR therefore needs to intervene to establish such standards, and to ensure that these are adopted across the industry.
• We strongly support the proposal for the PSR to require Faster Payments to incorporate a reimbursement obligation into its scheme rules (Measure 3a). This should cover all types of APP scams and values of payments, rather than arbitrarily excluding certain types of payments such as purchase scams. If a simpler standard of care is required for a scheme rule than is currently included in the CRM Code, then this should be based on the same legal basis that is used for unauthorised fraud, with victims reimbursed except for cases of gross negligence or first party fraud.
• However, we strongly oppose the proposal for the PSR to require Faster Payments to introduce a new scheme rule ensuring protection to a regulator-approved standard (Measure 3b). This proposal would be a retrograde step that would take us back to the point in time prior to the CRM Code two years ago. It fails to learn the subsequent lessons of the CRM Code, which has been fundamentally undermined by its voluntary nature and lack of regulatory supervision and enforcement.

The PSR should urgently implement these measures and outline publicly the wider reforms it needs the government to undertake. There is a wealth of evidence on the issues with the current system from industry, consumer groups, the Financial Ombudsman Service and the Lending Standards Board. The PSR should therefore have outlined specific proposals for each of the measures suggested in its Call for Evidence rather than waiting to ask for further views from stakeholders on the issues. It should also take this opportunity to ensure the government removes any barriers the PSR faces in ensuring there is robust, future-proofed oversight of consumer protection for all types of payment fraud.