/ Money

Update: what more can be done to minimise the harm caused by bank transfer scams?

Bank transfer scams

Following our super-complaint last year, the Payment Systems Regulator (PSR) has set out its approach to tackle the problem of bank transfer scams. But will these plans go far enough?

As we pointed out last year, unlike with the protections in place for other payment methods, such as credit or debit cards, those who fall victim to a scam when transferring money from their bank account will find that they aren’t protected.

The PSR has already agreed with us that banks could to do more to protect their customers.

And in its response to our super-complaint last year, it suggested that banks need to improve the way they respond to bank transfer scams, and do more to identify fraudulent payments.

It also proposed a package of work for the industry to take forward.

This included developing common standards to collect data, an approach to responding to instances of reported scams, and proposals for better sharing of information.

Terms of Reference

Under the PSR’s proposed plans announced today, the regulator will examine how other countries approach preventing and responding to this type of scam.

It will also compare how the payments industry tackles other types of scams and fraud, such as those involving payments made by credit or debit card.

In particular, it’s looking at what more the bodies who manage the payment systems (like Faster Payments) can do to protect consumers.

It’s also considering whether banks themselves could be required to do more, if they want to use these payment systems for their customers.

We’re pleased to see the PSR’s commitment to tackling the significant consumer harm caused by bank transfer fraud.

We strongly believe banks need to do more to protect their customers.

Currently there’s little incentive on them to put in place better safeguards, and banks have failed to adequately respond to the problem to date, despite seeing their own customers losing life changing sums of money.

Next steps

We need the PSR to take action, propose new measures and look at banks’ liability when it comes to sophisticated payment scams.

Which? will be responding to the PSR’s proposed approach by the deadline of 21 March.

But, in the meantime, there is nothing stopping the banks from taking a lead and setting out how they are going to ensure that consumers aren’t left out of pocket.

Banks are due to report back to the PSR later this summer, and we expect to see clear and meaningful progress.

If they fail to deliver, then the regulator must step in and require the industry to put in place better measures and checks to prevent customers from losing money to bank transfer scams.

Update: 4 April 2017

Following its consultation, the Payment Systems Regulator (PSR) has published the final Terms of Reference for its program of work to tackle bank transfer scams.

The PSR listened to feedback from Which?, as well as others, and accepted many of our points, including ensuring that:

  • the focus is on seeing better outcomes for consumers;
  • any proposals consider the way that scammers quickly adapt their methods and are future proofed; and
  • there is a clear timetable that starts to deliver real change for consumers quickly.

We will be watching closely to ensure that the PSR sticks to its timetable and makes swift progress.

There is still a massive gap in the protection for victims of transfer scams and there is more that banks can be doing themselves.

It’s now six months since we first raised the alarm, and we’ve not seen many changes from banks in terms of how they’re preventing customers from losing money.

We’re keen to hear from you – have you noticed your bank doing anything differently to protect people from scams? What do you think of the PSR’s approach? Would you like banks to be doing more?


When transferring an amount from your account, you have a choice of time, NOW or a date. some time between the transfer request and the actual transfer would give sufficient time to ensure the validity . N.T.

Hi Norman, so how about this?
The greatest risk is the first payment to a new Payee, because any new Payee may be a fraudster’s account.
I want an automatic 24 hour delay between the creation of a new Payee and the first payment being released to that Payee. During this time the bank will send me a text, an email and a voice message so that I can stop it if is fraudulent.

D Roberts says:
5 April 2017

I think if a large amount of money transfer is requested the Bank should Email the customer to confirm that it is correct !

Rajendra Ahya says:
5 April 2017

Banks must make you change your passwords more often using software prompts.

Margaret says:
5 April 2017

I think there should be much more stringent identity checks and other precautionary measures for this sort of transaction. Failure to take adequate precautions should result in a strong financial penalty or an obligation to compensate the customer fully for the amount of money lost.

Tim Chapman says:
5 April 2017

I bank with Santander. Now, before I make an online payment I must tick that I’ve read a list of 4 warning situations associated with a scam. While I am grateful that my bank is doing this I am also aware that I am signing away any rights I may have to hold the bank responsible for any loss… which makes me suspicious that my bank is simply doing what I expect & that is make sure that it’s hand is in my pocket (if at all possible) and that my hand never gets anywhere near theirs. But, honestly, can I blame them?

I have banked with Barclays for 48 years. Although I am in dispute with them at present concerning another matter, I made a large online payment via online banking last night and before it was paid I received a text asking was it me who had made the payment. When I text back yes, it went through.

Dominic says:
5 April 2017

Make Banks pay out now not later.

The Nationwide have been excellent. Improved login on internet banking and also sent out emails telling peopl not to give bank details to anyone on the phone or over the internet.

As a bare minimum, the paying bank must cross-check the sort code, account number and NAME of the recipient to ensure all three components are as specified by the payer. If any of the three components do not match, the payment must not be made.

Keith Hartrick says:
5 April 2017

As usual the banks are dodging responsibility & showing no concern for their customers. These fraudsters usually make several withdrawals over a day or two days. The bank’s computer systems should be able to recognise the dramatic change of usage in the customer’s account & stop payment until the bank has spoken to the customer. Where payments have been made the bank should be legally required to refund the customer in full. That requirement would force them to do something about this type of fraud. They are pushing people to make contact on line or via telephone, so they can continue to shut branches and pay huge salaries and bonuses to executives. Their first duty is to keep our money secure and perhaps banks where these scams are common should not be allowed to pay bonuses at all until they solve the problem.

I have noticed that Smile (co-op’s online bank) call me when a transfer has been made for the first time to check that I am aware of it

C Finney says:
5 April 2017

I can not understand how fraudsters can open bank accounts. When I last opened an account the proof of ID and address together with other details required seemed excessive, but obviously the fraudsters seem to be getting around these or the Banks are not checking the details given to them.

Kathleen Bentley says:
5 April 2017

Circulate to all customers what the current protocol is and how they propose to improve the system

I got fed up not being able to speak with a human being or one that was actually in my own country. I also felt I was personally paying for the debts that the banks had incurred by their own mis-management so I voted with my feet and dumped the big banks – Lloyds, Co Op etc and went to Handelsbanken.
I may pay a monthly fee but have the same protection and can speak to a real person, ( without hanging on while numerous pre recorded messages chant away telling me to press various buttons or ‘all their advisers are busy at the moment’), who actually answers the phone by name. They always ring to confirm anything new or unusual such as DD, cheques and the like.
When I opened the account the manager insisted on visiting my house to talk with us. Very, very happy, monthly fee well spent, more like an investment!

All bank branches should give a telephone number where they can easily be contacted by customers to check the validity of the transfer before the commit to it. Many branches are just not contactable.

As the scams are so widespread, how about extensive tv adds by all the banks jointly, warning of how to avoid being scammed!

In France, setting up a new payee with a French bank is much stricter than here in UK. You have to wait two days before one can initiate a transfer to a new payee. Also, it is much harder in France to open a bank account with direct proof of address, such as a utility bill, so that makes it much harder to open bank accounts with the intention of accepting fraudulent payments from. Here in UK, you can open a bank account online with no verification of address.

Anthony Wilkinson says:
5 April 2017

Given that these scams are actually serious crimes, I am surprised that victims do not seem to be treated in the same way as victims of burglaries, thefts and other criminal deceptions. I am not sure that banks can do much more from a practical viewpoint and I disagree with banks being forced to refund victims of crime with money that ultimately comes from their other customers. I feel that Insurance companies should be involved, with crimes involving this sort of scam being covered in household insurance policies. Since these scams often seem to involve the transfer of money during sales and purchases of houses, I would make it a legal requirement that solicitors involved in these sort of transactions ensure there is a relevant insurance policy in force at the outset of a sale or purchase. As in other insurance policies, the person making a claim after a scam would have to demonstrate they took all suitable precautions to prevent the scam happening.

Richard Stokes says:
5 April 2017

Banks should be able to verify a name with the bank account numbers so that you can be confident money is going to a bona fide account. I recently asked my bank if they could confirm that the account I was transferring money to was also a bank – and they couldn’t.

Gazz says:
5 April 2017

More and more transactions are online, the financial services industry have forced the public into this situation, at a loss, in many cases, to the public. The banks etc have a responsibility to protect customers money. So many branches have closed, and the banks have saved millions of pounds – customers have seen nothing coming back to them!