Countdown to accountability: The UK’s APP fraud reimbursement rules face last minute changes

The United Kingdom’s new Authorised Push Payment (APP) reimbursement rules are slated to commence in under 30 days. Given the significant amount of consultation between the industry and the Payment Systems Regulator (PSR), you might well imagine that the details are set in stone.

Whilst the industry and PSR have largely been operating on this basis, we have in the interim seen a change of government. This brings to mind the idiom, “A new broom sweeps clean, but an old broom knows the corners.”

Unsurprisingly critics of the new regime have sought to leverage a change of political leadership, leading to an eleventh-hour debate on key elements of the new regulations.

The outcome is a further consultation to consider (again) what the maximum level of reimbursement should be.

Limits and alignment

Alongside the consultation, the PSR has changed its initial position with the consultation proposing a drop in the reimbursement limit from £415,000 to £85,000, aligning the limit to that of the Financial Services Compensation Scheme (FSCS) rather than the Financial Ombudsman.

Crucially the implementation date, which some commentators had suggested might slip, remains October 7, 2024.  

The impact

Thanks to figures from the contingent reimbursement model, we’ve known for quite some time that most APP claims are under £85,000.

Contained within CP 23/6: APP fraud: Excess and maximum reimbursement level for FPS and CHAPS, the figures demonstrate that a reduced reimbursement limit will have a limited impact on consumers and Payment Service Providers (PSPs).

Source: PSR: CP 23/6 - Data provided by UK Finance on behalf of eight PSPs for H2 2022. The cases include personal accounts, microbusinesses and charities.

Assuming outcomes under the CRM are consistent with those of the new regime, a mere 0.28% of claims will exceed the £85,000 limit.  

However, the 0.28% makes up 25.21% of the value of claims, suggesting that, against the full year 2023 losses they would equate to a loss of £115,890,370. This is potentially the more pertinent number for those who have sought to question the wisdom of a £415K limit.

CP24/11 provides further insights concerning the impact different limits will have.  

On this basis, an immediate consequence of the change from £415,000 to £85,000 would appear to be that 8% of losses will no longer be reimbursed. Against the full year 2023 loss of £459.7M, consumers could be left out of pocket to the tune of £36.7M.

The PSR also points out that APP claims data shows that out of 411 reported cases over £85,000, 98% comprised multiple payments. Fifty-five percent of which involved multiple receiving PSPs. 

This is a crucial point as many people imagine that the limit relates to a single transaction, which is not the case. The reality of APP is illustrated in the details of 402 high-value cases from 2023, all of which involved multiple payments, compared to nine that involved a single payment. Of the 402 cases, 230 involved ten or more payments ranging from £0.01, to over £300,000, with the average payment ranging from £3,000 and £5,000.

The PSR also points out that many APP scams span many months and sometimes years, with specific examples including:  

• A case in which the victim made 2,206 payments as part of a single APP scam

• Another from April 2024 in which the victim sent £236,000 in 113 individual payments ranging from £310 to £24,000, with payments made to six different payees over three years.

Next Stop: The Financial Ombudsman Service

Perhaps the most significant element of CP 24/11 is 3.29, which reminds the reader that victims of APP “retain their rights to refer any complaint to the Financial Ombudsman Service (FOS) if they remain unsatisfied by the firm’s response.” This is a crucial point as regardless of whether the limit is £30K or £415K the FOS has the power to award up to £430K.

With a potential correlation between multiple transactions and total loss in mind, the PSR is right to point out that consumers who have not been fully reimbursed may decide to bring complaints against sending and/or receiving PSPs. It would seem highly likely that those complaints will focus on alleged faults in their services, an issue that the FOS has shown a willingness to address.

The PSR also highlight that most complaints to the FOS will focus on the sending PSP. In such circumstances, the sending PSP could be liable for a greater share of the amount lost (if the FOS upholds the complaint).

Let's assume the limit remained at £415K. In an APP scam of £450,000, in which the sending PSP upholds the claim for reimbursement and the consumer’s fault-based complaint against the sending PSP is upheld by the PSP or FOS, then the sending PSP would be liable for £242,500 (£207,500 under the APP regime and £35,000 redress for the fault-based complaint), and the receiving PSP would be responsible for addressing a loss of £207,500.

With a reimbursement limit of £85,000, the sending firm is potentially liable for £407,500 (£42,500 under our policy plus £365,000 on the fault-based complaint). So, the loss is ultimately shared between the sending and receiving PSPs in the amounts of £407,500 and £42,500, respectively.  

Great news for the receiving PSP, but not so great for the sending PSP.

Conclusion

Regardless of what limits are applied to APP reimbursement, the regime is set to be in place by October 7^th. A limit of £85K is to some degree an irrelevance, given the small numbers of victims impacted and the scope for those who are to seek further recourse via the Ombudsman.

With that last point in mind, it is hard to see what those who have called for a lower limit hope to achieve. With the consultation set to close on September 12^th it will be interesting to see what the outcome is, especially given how little time there is to effect a change.

It is also important that we do not lose sight of the fundamental objectives of the regime which is to make sure payment service providers have the right incentives in place to drive fraud out of their systems. Or to put it another way, deny criminals access to their customer's money.