/ Scams

Why the PSR must take action to protect APP scam victims

We’re calling on the Payment Systems Regulator (PSR) to introduce new transparency requirements on banks so that customers can see exactly how they treat and reimburse victims of APP scams.

8/07/2021: the PSR must not let victims down

Today, Rich Piggin (@rpiggin), Head of External Affairs and Campaigns at Which?, is appearing in front of the Treasury Select Committee to give evidence about the devastating impact of bank transfer scams and what action the regulator needs to take to make life better for victims. 

The chances are that in the past year you either have, or know somebody that has, received a text, call or email that turn out to be a scam attempt. While we should all be vigilant online, nobody intends to be the victim of a crime. Scam victims frequently talk of feeling scared and untrusting of others after the event, and often feel re-victimised when their bank blames them for not realising quickly enough that something wasn’t right.

These victims all too often struggle to get their money back, despite most major banks being signed up to a code that should ensure customers are reimbursed when they are not at fault. Banks are failing to implement the Code that they helped to write properly and consistently. Don’t just take our word for it – the Financial Ombudsman and the Lending Standards Board (which oversees the Code and is funded by the banks) have both criticised banks repeatedly over the years for their failures. The result is a lottery of protection for victims.

The situation is unsustainable. Encouragingly, the Payment Systems Regulator (PSR) is proposing mandatory protections be introduced. One solution they have put forward is to let the banks modify and rewrite the existing code, effectively handing them the opportunity to water down the consumer protections they disagree with and ignoring the evidence from the last two years. We firmly oppose this. Instead, the regulator should take forward its other proposal and introduce a requirement on all firms to reimburse customers who have acted appropriately.

Self-regulation has failed. We must do better. Letting banks act as judge and jury when it comes to scams has not worked. We must put in place a new system centred on helping the victims of this terrible and growing crime.

Banks and the regulator have had two years to try and make self-regulation work. All the evidence shows that this approach has failed. £700k a day is being lost to this crime, but less than half of it is reimbursed. Victims – particularly vulnerable ones – are being routinely failed by banks whose actions are undermining the Code they helped to write.

It is vital that the PSR does not hand the banks the power to modify or rewrite the existing code. Instead, it must take writing the new rules into its own hands and make it mandatory for all firms to reimburse victims when they are not at fault.

Rich will be giving evidence from 10:30am today (Thursday, 8 July).  A longer version of this update appeared as an Op Ed in Times Redbox (paywalled content)


Do you agree that the regulator must not give banks the power to write their own rules on scam reimbursement?
Loading ... Loading ...

15/06/2021: Update

28/04/2021: PSR must take action

When you fall victim to a crime, you expect to be believed. If someone breaks into your house, you don’t expect the police officer to point out where you should have installed CCTV. If you get mugged, you don’t expect to be asked for proof of how you put up a fight. And if you fall victim to a sophisticated and intricate scam, you don’t expect your bank to add to your feelings of guilt and distress by pinning the blame on you.

Yet that is exactly what is happening at the moment, with victims of authorised push payment scams (otherwise known as bank transfer scams) when they are tricked into unwittingly transferring money to a scammer. 

Which? News: Banks routinely blame victims of fraud

We receive information from hundreds and thousands of victims every year. The case studies we see highlight the impact on victims of this horrific crime – and how this is often exacerbated by banks who appear not to care about what has happened to one of their own customers who may have just lost a life-changing sum of money.

Blaming the victims

Recent evidence published by the Lending Standards Board (LSB) and the Financial Ombudsman (FOS) demonstrate just how poorly some banks are treating victims and the lengths they will go to to try and pin the blame on individuals rather than accept any wrongdoing on their part.

The LSB oversees a voluntary code that industry helped to write and which sets out protections for APP scam victims. The Code states that victims should be reimbursed other than in a few specific circumstances – and even then banks are expected to consider the scam in the round and how individuals may have been affected by the context of what happened and how.

Data showing just how well banks are adhering to the letter and spirit of the Code was recently provided to the LSB by signatories to the Code (which includes all the major banks plus Co-op, Metro, and Starling) and published earlier this year. 

It paints a damning picture of how banks are interpreting and implementing the Code in wildly inconsistent ways and how victims are being mistreated across the board:

🔹 Victims were held fully or partially to blame 60% of the time, and therefore often denied any reimbursement

🔹 Blame was shared between the customer and either the bank sending or receiving the money, or between the two banks themselves, in a further 17% of cases

🔹 Two banks pinned the blame on victims in nine out of every ten instances

🔹 For investment scams – which often involve the highest amounts of losses – victims were blamed 67% of the time

🔹 Romance scams, which can involve extreme emotional and psychological manipulation, had a blame rate of 61%

Final adjudication

When a victim is dissatisfied  with the outcome of a decision made by their bank they can escalate it to the Financial Ombudsman for a final adjudication. In some cases, these decisions are published.

We had a look at some recent decisions, which were all upheld in favour of the victim (as are the vast majority of APP cases), and found evidence of banks placing extreme and unjustifiable expectations on what a customer should have done to avoid being scammed. 

These included HSBC telling a victim who lost £2,000 to a HMRC scam that it was “inconceivable” that he didn’t spot the red flags because he worked in a professional industry, and Nationwide refusing reimbursement of £1,146 because the victim “didn’t listen” to warnings given – despite receiving a call from a spoofed number which made her believe she was speaking to her building society.

In a separate case, Halifax only returned half of a £60,000 loss to an investment scam victim who had “failed to make sufficient checks” before investing – before backtracking after Which? intervened to point out they had never asked the victim what checks they had actually made.

All of these and more provide further evidence for what we have been saying for years: the banks are consistently misinterpreting the Code they helped to write in order to put the blame on the victim, and the Payment Systems Regulator (PSR) is doing little to ensure they adhere to the rules.

Our calls on the PSR

We are calling on the PSR to use its upcoming consultation to introduce new transparency requirements on banks so that customers can see exactly how they treat and reimburse victims of APP scams. It must do this as quickly as possible to prevent banks making this a race to the bottom, and many more victims being denied rightful reimbursement

That same consultation will also recommend a way to make APP scam protections mandatory. We strongly believe that industry has been given sufficient time and opportunity to provide the solutions so under no circumstances must the banks be allowed to write another new code to replace the existing voluntary one as the PSR has suggested. 

We will be continuing to make this case over the coming months so that the PSR stands firm and takes action to protect victims.

What would you say to the PSR if it suggested allowing the banks to write another new code?


I agree with most of the comments made by other readers. My concern is with the Financial Ombudsman. Frankly, they are a joke. The investigators have no proper experience in investigating the documents. I had a case where a bank provided a copy of their email sent to me. The email had no date and no details of what they wrote and the investigator ruled in favour of the bank. When I complained vigorously, it was passed to another investigator who held up the case in my favour but decided to offer me a compensation of £100. The Ombudsman service needs to overhaul its system and train the investigators. The present system is disgraceful.

Iagree with above statement

Derek McCarthy says:
8 July 2021

In my opinion, given the chance, banks and insurance companies would be as bad as the people trying to get into our pockets. All they see is £££££££ and we need protecting from them all.

Karen Clowes says:
8 July 2021

The banks are a disgrace, they know the situation with all the scams going on. Nearly everyone I have spoken to has had problems being scammed myself included. There has to be more help for people the government must do all it can to ensure this.

Warren says:
8 July 2021

The banks need to be hold to account. They treat customers with contempt, and all this after being responsible for the credit crunch, they were bailed out by the tax payer. They got themselves into debt and expected to be treated fairly, unlike the way they treat their customers by repossessing etc. They should be responsible for their on line banking systems, this would ensure that they stamp down on scams etc. They always blame the customer.

Everybody has to have a bank account ,we use it as currency to pay bills, get our salary etc. So it’s absolutely the banks responsibility to keep us safe , but they don’t . Scams and fraud are completely ruining everyday people, not just people who have invested . As soon as there is a problem we should be informed, that day asap, but again the banks don’t. ITS OUR MONEY STOLEN FROM OUR BANK ACCOUNTS, so if the banks are not interested in keeping us safe then we should have another secure option to put our money into !

Bill says:
8 July 2021

We need a truly independent organisation to set rules and which has teeth and is willing to use them

The FO is just another toothless and useless quango.
That said, this must NOT become carte blanche for victims to become lax because they think it doesn’t matter is they’re careless because the banks always reimburse the losses.
THIS IS OUR MONEY, not the banks. The money belongs to customers and investors. Banks are not money trees. So I believe they should only reimburse if they have been at fault.
Where the FO should investigate is how the crooks manage to open bank accounts so easily and use them for scams.

john menary says:
8 July 2021

I was 85 years of age when scammed for £12,000 plus by a really expert scammer. At NO time was I in any awareness that the the matter was a scam. I am uneducated without any skill in finance but wanted to leave my 4 children something when I die. To read some of the comments on this matter I can see that there are people who do not give a toss for anyone but themselves. “Ime allright jack” is their motto. On contacting my bank by 17 emails plus getting the run arround on the phone I rebelled and demanded that I speak to someone in authority. I eventually spoke to the Head of Security who informed me that he had all the necessary information and added “ITS YOUR OWN FAULT YOU SHOULD HAVE KNOWN BETTER” and when asked about my loss replied “THE MONEY HAS GONE”. He than banged the phone down. Such a caring bank??. Too late I researched the BLURB published by the bank with statements like “We will protect you at all times especially if you are vulnerable” and “Your money is safe with us” and “We are signed up to the compensation agreement “. Lies every one . They did absolutely NOTHING to fulfill these promises.

This all started in April 2020 at the start of Covid19 which did not help. 13 months later, after contacting all the agencies I could I reported it to the Financial Ombudsman who have been amazing in their efforts to the extent that there is light at the end of the tunnel, and that I MAY get my money back. However, reading the comments on this article I am again feeling stress and am not convinced that my disgusting bank will co-operate.

I personally don’t have a great deal of faith in these Ombudsmen, I think they make up
the rules as they go along to suit themselves and not the people they should be protecting
the public, all a bit one sided. Time they were replaced by people that actually do work in
the publics interest.

Paul Parsons says:
8 July 2021

The banks treat their customers as if they are doing us a favour to be dealing with them, instead of in a real sales environment where the customer is treated with the knowledge that is they are mistreated, customers will walk away. Whilst we can do that, not many people do, so banks have only loyalty to their share holders, with no real duty of care to the millions of people whose money they are mishandling.

Robert Kerf says:
8 July 2021

Money that is scammed is transferred via the banking system, the banks therefore have the ability to follow this money, they choose not too but it must be made law worldwide that any fraudulent activity is the banks problem and it is up to them to resolve it

Many of those falling for these scams are very elderly and they are finding it difficult to differentiate between genuine emails and scams, and it’s becoming more difficult to make payments by cash.

Ian says:
8 July 2021

If the Banks write the rules there is no need for a Regulator so they can all retire or find other jobs.

8 July 2021

They would not be able to scam you if it wasn’t for the people working in the banks giving the scammers all your info and taking their cut.

bob parslow says:
8 July 2021


When money is scammed out of your bank it must be paid into another bank. That other bank is supporting fraud so they must repay that amount.

Bill Thomson says:
8 July 2021

No organisation should be allowed to be the judge and jury on its own performance – this is contrary to natural justice. In the words so often used in Private Eye – they cannot be allowed to mark their own homework.

Maybe I’m a little cynical but banks writing their own codes seems a little like –
– motorists setting their own speed, alcohol and drug limits
– criminals deciding their own prison sentences
– MPs and Civil Servants determining their own pay rises …. oops … forget that … they already do.

Self-regulation doesn’t work because it invariably veers towards self-interest.
It makes no difference whether it’s the Banks, Mercedes, or Boeing. And the result can lead to catastrophe for the clients. Has nobody heard of human nature?

Gavin King says:
8 July 2021

It is about time ALL financial institutions including banks are properly “policed”.
The banks have for far too long created mayhem in society and while thousands are struggling financially,people have lost jobs and houses,how is it morally correct that bank staff,not all but enough,are still taking huge bonuses on top of their pay.Outragious.