Fraud victims left in the lurch and exposed to scammers by their banks, Which? research reveals

Some banks are failing to provide satisfactory support for devastated fraud victims, leaving them feeling abandoned at a time of crisis and exposed to future scam attempts, according to Which? research.

The consumer champion found that some customers struggled to contact their bank after they had been a victim of a scam, including one HSBC customer who waited a total of seven hours on hold, racking up a £50 phone bill.

When Which? surveyed more than 400 people who had been victims of fraud or attempted fraud in the last 12 months, eight in 10 (83%) said they were satisfied overall with how their bank managed the incident. But that still leaves a significant number of victims potentially slipping through the cracks and getting substandard treatment, considering the Office for National Statistics estimates that for the year ending March 2021 there were 4.6 million fraud offences.

Of the people who reported fraud to their bank via phone or webchat, one in seven (15%) said that they waited 30 minutes or more to speak to someone. This is a concerning amount of time in what will often be an emergency – in extreme cases, this delay could cost thousands of pounds.

The consumer champion also found that a third (32 per cent) of victims of fraud or attempted fraud said that their bank did not offer advice or resources to help them better protect themselves in the future.

The figures come amid growing concerns over ‘recovery fraud’ – where victims are scammed again by fraudsters pretending to help them recoup their losses. This type of fraud has seen a 39 per cent increase since last year, with victims losing a shocking £14,408 on average.

Which? contacted banks representing 98 per cent of the customers surveyed to ask them what protocols they had in place for victims of fraud. All of them said that they offer advice or guidance in some form or other – but the findings of Which?’s survey highlight concerns about whether this information is reaching consumers and how effective it is at preventing scams.

The entitlement to a refund depends on the type of fraud that a person falls victim to. In the case of unauthorised fraud – where money is taken from your account without permission (for example, your card is stolen and used to make online purchases) – your debit or credit card provider must refund you unless they can prove that you’ve been grossly negligent or acted fraudulently.

But if you were tricked into sending money to a scammer – known as authorised push payment (APP) fraud or bank transfer fraud – there is no such legal protection against losses.

Most major banks have signed up to a voluntary reimbursement code on bank transfer scams which not only instructs them to reimburse customers who are not at fault, but also to provide them with adequate support.

However, firms signed up to the code have been criticised for how they are providing support to customers. A recent report by the Lending Standards Board (LSB) found that some firms were failing to meet the requirements of providing a response on reimbursement claims within 15 days, or 35 days in ‘exceptional circumstances’.

To make matters worse, the LSB said there was little evidence in these cases of firms providing any updates to the customer about the delay and when they could eventually expect a decision.

Which? is calling for the voluntary code on bank transfer scams to be replaced with a mandatory reimbursement scheme, which will include stronger protections against bank transfer fraud for consumers, and tough enforcement against firms that break the rules.

In order to achieve this, the government should grant the Payments System Regulator the powers it needs to make changes through the Faster Payments system.

As the information about how banks handle cases of bank transfer fraud is currently anonymous, Which? is also calling for the regulator to introduce greater transparency so customers can clearly see how their bank chooses to treat victims of crime.

Jenny Ross, Which? Money Editor, said:

“Fraud can have a devastating impact on victims. When banks fail to offer proper support, it can make a nightmare situation even worse, and an absence of information from firms about how people can protect themselves could even lead to ruthless scammers striking for a second time.

“The lack of help provided to some victims of bank transfer scams is particularly concerning, and protections for this type of fraud have to be strengthened.

“The payments regulator must introduce a mandatory reimbursement scheme for all payment providers, to ensure that customers are treated fairly and consistently when applying to get their money back.”

Case studies

Julie, from Devon, was the victim of a scam attempt, losing £3,900 after fraudsters posed as her bank.

Julie spent a total of 7 hours on hold on the phone to her bank, racking up a £50 phone bill. The process took so long that her landline provider temporarily cut her off.

It was four days until Julie’s bank, HSBC, contacted her after she had been scammed to tell her that she would be refunded. Julie was so disappointed with the service she received from HSBC after the event that she switched bank.

She said: “I don’t blame HSBC for the scammers, but it was completely inaccessible by phone.

“I was terrified because I didn’t know what information the scammers had got… I didn’t know whether they could get hold of my card details, or whether they could get something else from my laptop.”

—

Emily* was another victim of fraud. She noticed two foreign transactions on her HSBC current account that she had not made, phoned the bank and was told that the call centre was busy so she should try the HSBC online web chat. When Emily sent a message, it took 45 minutes to get a response and subsequent messages thereafter had reply times of ten minutes.

The following day, Emily noticed that she had missed a call from her bank, so phoned back to get an update on the status of her scam report. She was told that there was no record of her web chat and no action had been taken.

A week later, no replacement bank card had been sent to Emily and there was still no record of her previous conversation. On the phone to HSBC, Emily felt like the agent was insinuating that she had made the transactions herself and had forgotten them.

Eventually, Emily’s case was put through as a stolen card. She said: “I was very, very surprised that HSBC couldn’t find any notes about my case.” She described it as a “total breach of trust”.

*not her real name

—

Mark Wheeler, 62 from Richmond, received a phone call from a fraudster posing as a Lloyds fraud investigator in May 2019.

The caller listed suspicious transactions and asked if he still had his bank cards on him. When Mark realised that his wallet had been stolen from his jacket, he was then persuaded to enter his card Pins into his smartphone on the phone. The caller said this was to authorise reimbursement of fraudulent purchases. Shortly afterwards, thieves had made large withdrawals, stealing over £9,000 in total. Mark said that Lloyds’ initial response was very good but quickly turned sour.

Mark said: “My account was suspended pending investigation, which I understood, but Lloyds refused to pay pre-existing standard orders and direct debits, causing me to be threatened with penalty charges. Despite the fact I had been the victim of a telephone scam, Lloyds initially told me that it would contact me by phone to advise me of the outcome of its investigation. It did not seem to appreciate the irony.”

The bank initially said it would not refund him. Later, going through the transactions by phone, a Lloyds call handler noted that the branch withdrawals were made over the counter without the use of a Pin.

Mark added: “When I queried how I could be held liable, their attitude changed. Eventually, all the funds fraudulently withdrawn were refunded, aside from ATM withdrawals totalling £1,000. The investigation was wound up when it was found that the Lloyds branch at which the transactions occurred had no working CCTV on the day in question.”

Following Which?’s involvement, Lloyds refunded the £1,000.

Notes to Editors

Opinium survey on behalf of Which? of 432 members of the public between 26th – 29th May 2021 who had been the victim of fraud or attempted fraud during the past 12 months
The Payment Systems Regulator (PSR) has put forward proposals to strengthen bank transfer scam protection. Which? is urging the regulator to take forward its plan to introduce a requirement on firms using Faster Payments Service to reimburse customers who have acted appropriately. This change in the scheme’s rules would ensure there are industry-wide minimum standards of consumer protection. In order to do this, the regulator will need additional powers, and the consumer champion believes the government should provide these swiftly.
Action Fraud recovery fraud statistics cover April 2020 to March 2021, and the increase is compared to April 2019 – March 2020

Rights of Reply

A HSBC spokesperson said: “We have not been able to look at what has happened with each of these cases, but we apologise if a customer is not happy with how their case was handled. We act with empathy and understanding when investigating a case and we work hard to ensure fair and reasonable outcomes for our customers, including providing them with appropriate information to help prevent future occurrences.

“We continually review our operations and always look for opportunities to better protect customers. We have recently made improvements to how fraud and scams can be reported, which means people can generally report a scam or fraud within minutes.”

A Lloyds Bank spokesperson said: “We have a great deal of sympathy for Mr Wheeler as the victim of a scam. We’ve considered the particular circumstances of the case and have refunded the outstanding amount. Your bank will never ask for your PIN number so see this as an immediate red flag that it’s a scam.

Which? advice for scam victims

Call your bank directly, checking its website for the correct number to ring. If the fraud involved any of your personal information, consider signing up for a Protective Registration with Cifas, which costs £25 for two years.

Change your passwords for any accounts that have been compromised due to fraud – and any that use the same password. Set up two-factor authentication wherever possible to provide another layer of protection.

Being scammed can take a huge toll on mental health. Mind and Victim Support have confidential helplines that provide support to consumers who have been affected.

Make sure you are aware of new or emerging threats by signing up to the free Which? Scam Alerts service

About Which?

Which? is the UK’s consumer champion, here to make life simpler, fairer and safer for everyone. Our research gets to the heart of consumer issues, our advice is impartial, and our rigorous product tests lead to expert recommendations. We’re the independent consumer voice that influences politicians and lawmakers, investigates, holds businesses to account and makes change happen. As an organisation we’re not for profit and all for making consumers more powerful.

The information in this press release is for editorial use by journalists and media outlets only. Any business seeking to reproduce information in this release should contact the Which? Endorsement Scheme team at endorsementscheme@which.co.uk.

Press Release