Queen's Speech confirms new legislation to force banks to help scam victims

New legislation to force banks to help victims of authorised push payment (APP) fraud was confirmed in the Queen's Speech on 10 May¹. The forthcoming Financial Services and Markets Bill will include measures to better protect scam victims who are tricked into transferring money to a fraudster, making sure victims are reimbursed swiftly and fairly¹.

The confirmation came alongside plans outlined by the Payment Systems Regulator (PSR) to extend the fraud prevention tool Confirmation of Payee (CoP) to a further 400 financial firms by mid-2024¹. CoP tells a payer whether the name they have entered matches the account details held by the receiving bank, and is designed to prevent both mistakes and APP fraud¹.

The PSR has proposed that a group of almost 50 firms expected to have the biggest impact on preventing APP fraud adopt CoP by 30 June 2023, with a second group of more than 350 firms given until 30 June 2024¹. The first group includes Bank of Ireland UK, Citibank, Coventry Building Society, Metro Bank, Revolut, Sainsburys Bank, Skipton Building Society, Tesco Personal Finance, PayPal, Virgin Money (including rebranded Clydesdale Bank and Yorkshire Bank accounts) and Yorkshire Building Society¹.

The six largest banking groups were forced by the regulator to introduce CoP: Barclays, HSBC (including First Direct), Lloyds Banking Group (including Bank of Scotland and Halifax), Nationwide Building Society, NatWest (including Royal Bank of Scotland and Ulster Bank) and Santander¹. They were originally expected to start checks by June 2019, but multiple delays meant this was not introduced until 30 June 2020¹. Challenger banks Starling and Monzo were the first to implement CoP voluntarily, and there are now a total of 33 firms offering it¹. Several key players are yet to fully introduce it, including Metro Bank and Virgin Money, as well as many building societies; Virgin Money started to roll out CoP in April on its app and in-branch¹.

The PSR has said the volume and value of misdirected payments, as a share of all Faster Payments, has fallen by between a quarter and a third since CoP was rolled out¹. It also identified "some evidence that it has helped to curtail the increase in some types of APP fraud", though it did not provide figures to back this up¹.

Why it matters for households

APP fraud overtook card fraud in the first half of 2021, with victims losing £28,203 an hour, and more than £700,000 is lost to bank transfer scams every day¹. Until the new legislation takes effect, reimbursement depends on whether a customer's bank is signed up to the voluntary APP scam code, under which it should reimburse a victim who can show they paid attention to warnings before making the transfer, had a reasonable basis for believing the recipient was genuine, or is considered vulnerable¹. If a bank is not signed up to the code, a customer can complain to it and may be able to escalate the complaint to the Financial Ombudsman Service if a refund is refused¹. The expansion of CoP means more payments will be name-checked before they leave an account, though Which? said improved CoP does not remove the need for mandatory reimbursement for all victims who are not at fault¹.

What happens next

The PSR's proposed deadlines are 30 June 2023 for the first group of almost 50 firms and 30 June 2024 for the second group of more than 350 firms¹. The Financial Services and Markets Bill, confirmed in the Queen's Speech on 10 May, will carry the measures on reimbursement for scam victims¹. The PSR has said it must be ready to ensure firms treat customers consistently and fairly, with tough enforcement for those that break the rules¹.