Beware of push payment fraudsters
Yet again this month there are numerous reports in the press of people being duped out of thousands of pounds by fraudsters operating the authorised push payment scam, and yet again we have banks denying any liability for the losses.
The BBC reported a case of sophisticated fraud against Mr and Mrs Tack, a Hampshire couple, which began when they received an email, apparently from TV Licensing, reminding them the license was due for renewal and warning of penalties for late payment. It all seemed reasonable and looked above board, so they promptly filled in the form.
A couple of days later they received a call claiming to be from their bank, though in fact it was from the scammers who had previously sent out the fake license renewal, this time posing as the security desk at Nationwide Building Society. The scammer told Mr Task that they had detected fake transactions on the couple's bank account.
Under the guise of confirming identities, the scammer triggered a genuine reminder email from Nationwide to the couple's email address, the type you get sent when you have forgotten your login details, which reinforced the impression that this genuinely was someone working at Nationwide and sitting in front of a Nationwide computer terminal. Still believing they were talking to the bank and that they were verifying their own identity to the bank, they gave the scammer the authorisation code from the email. A couple of days after that, the couple received a call from Nationwide, the real one this time, advising them that their savings of over £9,000 had been drained from their bank account, and that it could not be recovered.
This case is by no means an exception. Laura Hodson, a nurse in Scotland, also fell for the TV license scam and lost £2,500 from her RBS account, of which the bank could only recover £2.21. In Dagenham, a fraudster masquerading as an RBS employee conned a 58 year old out of £11,500, and a few months earlier, a former teacher in London lost £2,500 from her bank account, believing she was talking to HMRC. The list goes on, and this modern day bank robbery known as push payment fraud is Britain's fastest growing crime. UK Finance estimates losses to account holders of well over £200 million in 2018.
You would think this type of crime would be easy to detect and that the computerised records would mean recipients of payment frauds would have nowhere to hide. Not so. With this form of electronic transfer, the funds are transferred instantly, and the scammers typically move and disperse the funds rapidly through a succession of fake bank accounts, currencies, and countries, before anonymously withdrawing it in cash at banks and wire transfer offices in numerous locations across the world. Students and their bank accounts are often recruited as unknowing mules in the money laundering process, believing they are collecting payment fees on behalf of a legitimate overseas company.
The banks take great responsibility for direct debit payments and will always refund customers for unauthorised fraudulent transactions, but for push payment fraud, where the customer has provided PIN codes or passwords to authorise the transaction, the banks insist they cannot be held liable.
But should banks be held liable? The banks created this system which lets all the money in your account be transferred instantly to the other side of the planet, so should they accept some responsibility for the criminal opportunity it creates? With all of their experience and expertise, they should have been able to forsee the potential for industrial scale fraud. We all know about credit cards, cashpoints, and direct debits for regular payments of bills, and over the years the banks have done a good job of educating us to those products. On the other hand, whilst most of us sometimes need to use transfers for large payments, now that cheques have all but disappeared, I suspect very few people realise that bank transfers are an instant transfer of funds, virtually irrevocable, and as unsafe as handing over a wad of cash.
An unfortunate side-effect of Brexit and the way it has dominated the news is that proposals to combat banking fraud have not received nearly as much press coverage as they deserve, nor as much public scrutiny. In response to calls for changes to legislation to make banks liable, the banks are instead promoting a voluntary code of practice which includes a compensation scheme.
However, Lloyds have said that they may need to add a levy to bank transfers as a way of funding the compensation scheme. It is also likely that this scheme will only be for "life changing sums". Santander has said it feels that smaller losses of "just a few hundred pounds" should not be covered. It is troubling when bankers think a few hundred pounds is a small loss. Most troubling is the potential marginalisation of people. Nationwide, for instance, has suggested that if it is to be liable for frauds then customers it classifies as "vulnerable" could be barred from using transfers at all.
Compensation schemes are a poor substitute for fixing the problem, and even if this scheme is introduced soon, it will still be no comfort to past victims. I suspect if the banks were made fully liable, they would quickly find ways handle transfers much more securely.
31st January 2019
This article comes from the SKILLZONE email newsletter, published monthly since January 2008, and covering topics related to technology and the internet. All articles and artwork in the SKILLZONE newsletter are orignal content.