HSBC has thrown its weight behind calls for tech firms to pay up for fraud, saying incoming compensation rules requiring banks to reimburse scam victims up to £85,000 will fail to stem the flow of fraud and prove that the financial sector is not the problem.
David Callington, the head of fraud at HSBC UK, said rules coming into force on 7 October would motivate banks and payment firms to improve their fraud detection systems. However, he said that would not be enough to shift the dial and curb scam cases across the UK.
City lobby groups have long complained that members have been left to shoulder the costs of fraud against their customers, despite a surge in the number of scammers targeting consumers through online platforms and social media.
They said the vast majority of authorised push payment (APP) scams, in which people are tricked into sending money to accounts operated by criminals, was facilitated by text messages, or fake online adverts on platforms such as Instagram, Google, TikTok or Facebook marketplace.
APP fraud losses totalled £459.7m in 2023, and the total number of cases increased to 232,429 last year, according to data published by the banking body UK Finance.
“The wider ecosystem, and key players in that ecosystem, have to be held to account,” Callington said. While banks needed to be vigilant, the financial obligations needed to “sit with those other sectors as well”, he said. “They need the financial incentive.”
The UK government has yet to crack down on tech and social media firms, and has instead asked them to sign up to a voluntary online fraud charter, in which they promise to take steps to block fraudulent material and protect people from fake adverts.
Callington said APP fraud would proliferate unless the charter became law and forced large tech and telecoms companies to help compensate customers in cases where their efforts to prevent online fraud fell short.
“What we would urge for is a shifting of some of those obligations into regulation, so there is an actual obligation on other sectors who are part of the ecosystem to take action and protect what are our common customers, our common users,” he said.
However, “regulators will only step in when they see that actually there’s not enough traction [on preventing fraud], and we’re not generating the outcomes that we want … from the voluntary aspects that have been put in place”, Callington added.
Efforts to protect consumers has so far focused on the banks and payments firms that move the funds from customer accounts. Britain’s Payment Systems Regulator (PSR) is expected to make reimbursement of up to £85,000 mandatory from 7 October, after most firms failed to sign up or consistently apply, a voluntary industry code introduced in 2019.
However, a spokesperson for the lobby group techUK said technology firms had worked quickly to implement the voluntary charter and were committed to working with banks, law enforcement and government to tackle online fraud.
“There is no lack of incentive for action, and the online safety act will place further significant legal obligations on online service providers,” the spokesperson said. “Extending responsibility for reimbursement would be neither effective nor proportionate. Instead, the focus must be on working together to develop better technical solutions to identify and disrupt online fraud and to prosecute the criminals who commit this crime.”
From next month, the costs of fraud will be shared equally by the banks and payment firms on both sides of the transaction, meaning there will be a fresh burden on the companies whose accounts receive the victims cash. That could be a blow to firms that are the biggest recipients of fraudulent funds by volume, according to PSR data, including smaller players such as PayrNet, Modulr, and the banks Zempler and Kroo.
The industry was relieved, though, after the PSR U-turned on plans to impose a maximum reimbursement cap of £415,000, following pressure from banks, fintech firms and some politicians. Some argued it could have put many smaller companies under severe financial strain. The smaller £85,000 cap, which the PSR said would cover 99% of claims, is expected to be finalised by 30 September.
A Treasury spokesperson said reimbursement for victims of APP scams was a matter for the PSR. “The announcement of a consultation shows the regulator is listening to feedback as it seeks to strike a balance between protecting fraud victims and managing the impact on industry,” they added.
