Why companies should adopt our guide to SMS Best Practice

Richard, I agree with the part of your comment about the convincing nature of some emails and texts that lead to some customers being defrauded. But I do not see it follows that the bank must refund them if they had no way of knowing the transaction was fraudulent and all they did was obey their customer’s instructions to transfer money to another account. We can all make mistakes.

I would like some explanation as to what more the banks, and other bodies, can do to identify potential fraudsters and scams before they are perpetrated. One view as to why banks should refund money is because they have more money than those defrauded. That money is, of course, effectively their own customers and will be retrieved by higher charges on loans and lower savings interest.

However, if the banks can be shown to be negligent I would look at “refunds” differently. I would look to see the receiving bank taking responsibility as it is they who host the fraudsters’ accounts and should, maybe, take more care in who opens accountsand how those accounts are monitored for questionable activity.

Richard — I agree with Malcolm that there are limitations to what it is reasonable for banks to take responsibility for. We live in a world where communication via e-mails, text messages and social media contact is regarded as trustworthy despite plenty of evidence to the contrary. As a consequence of this misplaced trust scammers are intercepting communications and pretending to be friends or relatives asking for money.

The banks should certainly educate and inform their customers about the best way to stay safe in this new uncertain and fraudulent world, and about the risks of responding to texts and e-mails without verification. I feel they should also do more to identify which customers might need additional help or protection in the management of their money. Banks should make it clear that they cannot be held liable for the loss of money if customers give transfer instructions without a simple checking process. However, I don’t think banks should accept responsibility for their customers’ negligence.

You say “seemingly genuine” but nothing is genuine until you can prove it to be so, person-to-person. If someone has a phone that can send a text they can make a phone call to inform their mother of a new number and ask for money, and then voice recognition, vocabulary and dialogue content would prove their credentials. On receipt of such a message people must stop and think – Why didn’t he or she speak to me?

We all have a responsibility to adapt to the new reality and to learn that a text, e-mail message or social media contact does not, by itself, have guaranteed reliability. There is no inherent reason to trust someone you cannot see or speak to directly at the time.

If I have a debit or credit card stolen or simply lose it, my understanding is that my loss is limited to £50 providing I report the problem promptly. I have not tested this. The bank would not be responsible if had acted irresponsibly, for example by writing the PIN on the card or if I had allowed someone to use the card and PIN. I have long believed that this is rather generous protection but equally it has made me comfortable about carrying around my cards.

Neither my bank or credit card company has done anything to assess my abilities to avoid fraud yet I have the ability to transfer thousands of pounds. A great deal of fraud could be avoided if the banks – collectively – acted more responsibly. The intended subject of this discussion is the Which? Guide to SMS Best Practice. The reason that we have this Conversation is that banks are not following established best practice. The banks could have put in place what we now know as Confirmation of Payee from the start rather than simply ignoring the name of the payee, thus allowing payments to be misdirected for years. Before computer systems were in place there was the possibility of contacting our bank to request to have a cheque stopped for good reason. Now we have the ability to transfer large sums of money so quickly that it may not be recoverable, a system that facilitates fraud. It seems logical that payments to new payees should be delayed to allow time for suspected fraud to be reported to the bank and investigated before the transaction is completed. Banks should be working together to tackle crime and if customers losses are restricted to £50, as with cards, that would provide an incentive. Banks need to be able to recover money transferred to recipient banks in event of fraud.

Banks can protect themselves by restricting what their customers can do with their money, whether these are young and inexperienced people, old people with declining abilities, and anyone who has not acted responsibly in the past. As Richard has said, the banks should collectively do far more to sort out the problem.

I suspect that in the final analysis this will all come down to the question of negligence and what tests are applied to justify a reimbursement claim on the banks.

It would not surprise me if the Confirmation of Payee procedure has dramatically reduced the Authorised Push Payment [Payment Diversion] scam but, with many banks, and presumably all or most foreign ones, outside the scheme, significant risks remain.

It is possible that some people do not read the warnings on the transfer instruction pro forma and do not take any notice of a statement that there is not a match between the payee’s name and the account number specified for the payment. If people press the ‘continue’ button the deed is done. I don’t know what can be done about that other than, in the case of new payees, to have a mandatory stay of execution of the transfer, but even that is not guaranteed to lead to a cancellation unless there is direct communication between the bank and their customer.

I do not know what happens if the customer over-rides a mismatch warning and proceeds with the payment transfer anyway. I feel there should be a bold red warning on the screen and a bank message to say they will not process the transfer until the customer has telephoned to confirm it. That would be in the bank’s interest as much the customer’s.

I don’t expect we will be given full details of how claims are handled, John. This information could help those of us who are interested in the subject but also aid exploitation by fraudsters.

I do not understand why it is possible to proceed with a transaction when CoP shows ‘no match’ with the payees name. Why not require the customer to contact their bank rather than allowing the customer to ignore the warnings?

After Ian commented on problems with CoP, I spoke to friends and they have had problems too.

If, as you say, CoP is not possible with foreign banks then that needs to be addressed. The customer still needs to be protected from being the victim of crime.

A great deal has been said about negligence of customers and perhaps attention should now focus on the failings of the banking system. I have no personal grouse against my bank or others but feel that we are very much let down by the banking system.

Responsibility rests with customers as well as banks.

Confirmation of Payee has been discussed ad infinitum inclding why it might not have been introduced earlier and why not all banks are included, although Phase 2 should deal with that. See other Convos.

It would be useful if informed proposals were sumnarised from time to time that would advance protection rather than continually blaming banks, or anyone else.

Restricted account facilities have been suggested a number of times to protect those less capable from making expensive mistakes.

I think no communications in this context -SMS or text – should include links or phone numbers. Just point the customer to the official site.

As far as “standardised” SMS formats are concerned I would have thought fraudsters would simply adopt the same style, wouldn’t tbey?

I wonder if there is a case for eliminating links from SMS messages. DerekP has pointed out that they are convenient for resetting passwords but many organisations avoid using links for this purpose.

wavechange says: Today 12:06

I do not understand why it is possible to proceed with a transaction when CoP shows ‘no match’ with the payees name. Why not require the customer to contact their bank rather than allowing the customer to ignore the warnings?

This is actually what I had to do, simply because I wasn’t prepared to override the COP warnings. But what’s interesting is that the banks actively promote one of the advantages of switching to them is faster payments between banks.

For me, anyway, the answer is simple: the banks are made responsible for all fraudulent APPs unless they can definitively prove their own systems were in perfect working order and the customer was adequately warned.

I agree, Ian, but I want to see the banking system run in a way that allows all payments to fraudulent accounts to be recoverable by reverse payment – from the receiving bank to the customer’s bank. In my view, rapid payments seem to have facilitated fraud by removing the time needed to report and cancel any transaction if it would be fraudulent.

I have given the example of customers liability being limited to £50 if they lose their providing that they do not contribute to fraud by divulging their PIN or delay reporting the loss. If we buy products online, we are legally entitled to return them for a refund without having to provide a reason. I don’t see complaints that this is unfair on the companies ‘that have done nothing wrong’ to borrow a phrase. I have only done this once and that was when a company contacted me to substantially delay a delivery without even asking whether the new date was acceptable.

Online returns are permitted because you have not had the opportunity to
examine the product, so it is effectively on approval. That is not, I suggest, the same as instructing your bank to carry out their obligation to transfer your money.

In principle, as I and some others have repeatedly suggested, I think the payee’s bank should refund not the payer’s. I would like to see informed input as to the possibilities and difficulties of this.

But tbis Convo is about SMS Best Practice. Perhaps a discussion of the banking system should be moved to another Convo?
https://conversation.which.co.uk/scams/financial-ombudsman-service-psr-code/

malcolm r says: Today 14:21

Online returns are permitted because you have not had the opportunity to examine the product, so it is effectively on approval. That is not, I suggest, the same as instructing your bank to carry out their obligation to transfer your money.

Perhaps strictly speaking, not; but it does place more responsibility on the retailer than the customer. I wrote a topic some time ago in which I highlighted the behaviour of some less scrupulous retailers. In that instance it became very clear that some retailers wield an arrogance in respect of their customers, which would leave those same customers unable to respond were it not for the current legislation, much of which was pioneered by Which?.

I am not arguing against the legislation that allows us to return unwanted products or the protection offered to holders of debit and credit cards, but these privileges are obviously paid for by all customers. Banks have obligations under the current CRM Code and Which? has found that claims are treated differently by different banks, demonstrating the need for legislation. The solution is for the banks to work together and ensure that payments to accounts run by scammers etc. are returned promptly to the customers’ banks. In my view, the CRM Code provides an incentive to tackle the problem.

Perhaps it is debatable whether we should be arguing for diminished consumer protection and leave that up to the companies. That would be a good topic for discussion elsewhere.

I agree, Colin. In my view, the fraudster’s bank should be responsible for returning the stolen money even if they were not aware that the account was going to be used for fraud. When this is not done it makes fraud worthwhile. Nowadays, transfer of money between banks is fast and introducing a mandatory delay would provide time for suspected scams to be reported and investigated before the transaction was completed, so that the payment can be blocked. That would only be necessary for payments to new payees and not ones we have used before.

Fraud is lucrative and the banks can work together to help prevent it.

I agree Colin that if a bank has opened an account without reasonably checking the applicant’s credentials then, if that account has been used to perpetrate a fraud the bank should be held liable.

However if they have made all reasonable checks, or if, as has been reported, legitimately-opened accounts are sold to criminals ( e.g by foreign students returning abroad) and the bank could have had no knowledge of this, then they should not be held legally liable.

I have asked to see information as to whether any particular banks are more prone to hosting fraudsters accounts than others; that might help focus attention on any lax checking procedures.

I see no logical justification for expecting a bank that has done everything correctly to return money that turns out to have been obtained by a fraudster. There may be an emotive reason, usually that banks have lots of money (mostly belonging to you and me as depositors, of course) and can therefore easily afford to make a sympathy repayment. Or that there are (unspecified) actions they should have taken. I think the latter is valid if their individual and collective systems could be shown to have been defective and could practically be improved; the threat of being held financially responsible should, if that were the case, incentivise action.

Many proposals have been made in Convos about how we could better tackle consumer detriment. It would be worthwhile summarising them so a better picture could be appreciated.

As this particular Convo is about SMS messaging these comments might be better moved elsewhere. However, we frequently see links in SMS messages from all kinds of sources and I, for one, rarely use them but go directly to the source. In many cases that is probably over cautious prompted by publicity, but no bad thing. Certainly I believe any financial provider should not use them in SMS but simply ask the recipient to access their account or the providers website in the normal way.

I had already copied Colin’s comments to another Conversation, Malcolm: https://conversation.which.co.uk/scams/financial-ombudsman-service-psr-code/#comment-1641892

Malcolm wrote: “However, we frequently see links in SMS messages from all kinds of sources and I, for one, rarely use them but go directly to the source. In many cases that is probably over cautious prompted by publicity, but no bad thing. Certainly I believe any financial provider should not use them in SMS but simply ask the recipient to access their account or the providers website in the normal way.”

We and others have suggested that it would be best for responsible organisations not to include links in text messages, now that they are widely used to support fraud. Undoubtedly they are convenient but is the risk too high? Perhaps Which? could look into this. Do we really need links in text messages at all?

I happen to think that no official business should be conducted through the medium of text messages.

Once we let businesses know our mobile phone numbers we become prey. We alone can stop it by our own actions.

I am sure many will give reasons why my comment is impractical but it works for me.

It seems that we need something more secure than SMS. I am concerned when businesses and other organisations want us to use social media and chat facilities. 🙁

With businesses and even the NHS making extensive use of mobile numbers I am not sure about the practicality of withholding them and I wonder how those without phones cope without using them. It would be an interesting discussion.