Criminals are making plans to exploit incoming fraud refund rules from the UK payments regulator, City A.M. has learnt, as banks and fintechs warn of harm to consumers if the measures come into force unaltered.
Analysts have voiced concerns that a combination of unprepared firms, less cautious consumers and new ways of claiming money could encourage organised criminal groups to target the UK.
From 7 October, the Payment Systems Regulator (PSR) will force payment firms to refund victims of authorised push payment (APP) fraud up to a limit of £415,000. The cost would be split between the companies used to send and receive the payment.
Dozens of firms are lobbying the PSR to scale back its rules, demanding a lower reimbursement threshold, loosening criteria for refusing a claim, and setting a later deadline to give them more time to prepare.
“There’s a plan for 7 October,” an industry figure with knowledge of fraud activity told City A.M. “Fraudsters have got it in their diaries.”
They added that criminals were discussing the incoming regime on the dark web.
The person argued that the rules could drive fraud to account for 50 per cent of all crime in England and Wales – up from a current level of some 38 per cent, according to the Home Office.
Britons lost roughly £459.7m to APP fraud last year, according to banking trade body UK Finance. However, some experts believe the true figure is likely closer to £700m as around a third of scams are estimated to go unreported.
Tony Sales, once a major fraudster who co-founded anti-crime consultancy We Fight Fraud after leaving prison, said an active criminal had recently told him he was planning to “totally exploit” the PSR’s rules and had “found people who would be willing to do it”.
“It’s totally something I would have exploited – it’s a no-brainer,” Sales added.
A fraud analyst who works with banks said the rules’ deadline was a key date for scammers looking ahead to the rest of 2024, similar to how they target periods like Christmas or tax season.
“As soon as the new regulations come into force, I would expect a new text messaging campaign telling people ‘Click on this link to get a refund from XYZ bank’, or maybe trying to impersonate the PSR directly,” they said.
“It’s highly possible that scammers end up reaching the mules they generally hire, willingly or unwillingly, do fraudulent-looking transactions from one to another, and then get their money back but ask the mule to submit a scam claim.”
The analyst added that “regular people” would likely try to exploit the measures by filing a claim with their bank over “any fraudulent-looking transaction and asking for the money”.
“I have heard from some banks that generally, if it’s a small amount and the first time, they will not really investigate it that much,” they said.
A senior official at a major British fintech agreed with this notion, citing the costs of formally questioning a refund claim between the two payment firms.
A PSR spokesperson said it was “working closely” with the payments industry “to ensure preparedness and effective, timely implementation”.
“We have also been clear that while we want much higher and consistent levels of protection in place, at the same time we also want to encourage people to be careful and genuine,” they added.
“Our standard of caution sets out the few exceptions to reimbursement, including where the consumer seeking reimbursement has acted fraudulently. Our policy also confirms that sending payment firms can apply a claim excess of up to £100 if they choose to, helping to ensure people are taking care when making payments.”
It emerged earlier this week that the Treasury, to which the PSR reports, had questioned the timetable for its rules. Then City minister Bim Afolami said in May that the measures had “significant problems”.
Draft plans from Labour leaked before the general election show it calling the PSR’s rules “unfair and unsustainable”, although this is not an official policy position.