Banks feel heat over fraud protection

Customers are paying price for big-money scams, says Jeff Salway

You have no legal right to get your money back from your bank if youve been tricked into transferring money to a fraudster. Picture: Getty
You have no legal right to get your money back from your bank if youve been tricked into transferring money to a fraudster. Picture: Getty

Banks have been told they must do more to protect their customers against fraud, as pressure grows on the industry to stem the alarming flow of losses resulting from bank transfer scams.

Consumer group Which? yesterday made a super-complaint to the Payment Systems Regulator (PSR) calling on it to make banks bolster the protection given to people who are tricked into transferring money to fraudsters.

Sign up to our daily newsletter

The move came in the week that a Glasgow man was jailed for leading a bank fraud that conned millions of pounds out of small businesses. The fraud was based on a “vishing” scam, where companies received calls from a man claiming to be from their bank’s fraud department and asking them to disclose financial data or use card readers to authorise online payments.

The information was then used to access and empty their accounts, costing victims some £113 million in total (very little of which has been recovered).

The case was just the latest in a series of big-money scams that have exposed weaknesses in bank defences against fraud attempts.

Similar scams have been targeting elderly people. Two Edinburgh pensioners, including one in her 90s, were conned out of thousands of pounds earlier this year after being persuaded by someone claiming to be from their bank’s fraud department to transfer cash to a different account.

The super-complaint by Which? argues that bank protections have failed to keep up with a vast increase in recent years in the number of bank transfers made by consumers.

As it stands, you currently have no legal right to get your money back from your bank if you’ve been tricked into transferring money to a fraudster. All you can do is inform your bank, which can then try to recover the funds.

In contrast, if you’ve been scammed into paying by credit card for goods or services which have then failed to materialise, card providers are jointly liable under Section 75.

Six in 10 people surveyed by Which? didn’t realise that they weren’t protected by their bank if they fell victim to a bank transfer scam. It said more checks should be in place for money transfers and argued that banks should be more accountable for money lost to scams made by bank transfer.

Alex Neill, director of policy and campaigns at Which?, said: “With scams on the rise, consumers can only protect themselves so far​ and we believe that​ banks ​must do​ more to tackle bank transfer fraud and safeguard their customers from scams.” While there are steps that customers can take to protect themselves against fraud, scammers are becoming increasingly sophisticated.

“No matter how tight your bank’s security is, they will never be able to mitigate all fraud attempts,” said Dan B Brown, security consultant at Edinburgh-based IT consultancy Farrpoint.

“The most important factor is that your bank has a comprehensive reimbursement policy so you can get your money back regardless of what happens.”

In an ideal world consumers would be able to compare the fraud protection efforts of different banks and take their business to the one that inspires the most confidence.

The Bank of England has started to conduct tests on banks to prove they can withstand sustained, advanced cyber attacks, with Lloyds Banking Group the first lender to pass.

But it isn’t currently possible for customers to assess how well a bank defends them against certain threats.

“The most common weakness leading to bank fraud is the customer. There is no security measure that can stop a fraud attempt if all of a customer’s details have been compromised,” said Brown.

“The best advice we can give is to contact your bank’s fraud team and ask them in what circumstances you will not be reimbursed when you are a victim of fraud.”

The PSR has 90 calendar days in which to respond to the super-complaint, which has also been flagged with the Financial Conduct Authority.

The options open to the PSR include enforcement action against providers; reviewing its guidance; referring the complaint to a different regulator or authority; or even deciding no action is needed.