Which? urges action to stop scams ‘victim-blaming’ by banks

Which? is calling for urgent action to protect bank transfer fraud victims amid concerns that a culture of blaming people who lose life-changing sums of money to sophisticated scams is the norm for some banks.

Official figures show banks signed up to an industry code on bank transfer fraud hold victims fully or partially responsible for being scammed up to 77 per cent of the time. Victims were held fully responsible for 60 per cent of payments, while 17 per cent of the blame was shared between the customer and either the bank sending or receiving the money, or between the two banks themselves.

The code was designed to ensure that victims of bank transfer scams are reimbursed for their losses when they are not at fault. However, the overall reimbursement rate is low and varies significantly between individual banks. Which? believes this is because firms are acting unfairly by regularly pointing the finger of blame at customers to avoid returning their money, even though many of the crimes are highly sophisticated.

Customers in need of support when trying to recoup their losses often face a grilling over their actions from banks, compounding the devastating emotional impact of their ordeal.

Cases handled by the Financial Ombudsman Service (FOS), as well as those investigated by Which?, show banks are often getting these decisions wrong – meaning they needlessly put victims through many months of distress as they fight against reimbursing them.

Which? believes the complete lack of transparency in how individual banks are treating victims of bank transfer scams is leading to unfair and inconsistent decisions, and means that firms can easily wriggle out of their responsibility to reimburse them.

As a result, the consumer champion is calling for the regulator to require all banks to publish data, including their reimbursement rates, to show how well they are doing at preventing the harm caused by bank transfer fraud, as well as make changes to the payment system so that firms are obligated to reimburse losses to this crime.

In one case upheld by the FOS, a Nationwide customer lost £1,146 after receiving a call from a spoofed number that appeared to be from the building society, but was actually being controlled by a fraudster, who then tricked her into transfering money to a “safe account”.

A transcript of her call to Nationwide when the scam was uncovered includes comments from a staff member that it will be “very, very, very” difficult to get the losses reimbursed, and told her that “you didn’t listen” to the warning information provided – the same reason that the firm subsequently used to deny reimbursement.

However, the FOS said Nationwide’s warnings before the payments were made were not strong enough to “break the spell” of the scam. The level of social engineering involved meant that she was “utterly convinced” she was talking to the building society, to the point that she became “concerned about who to trust” even when speaking to legitimate staff members. It upheld the customer’s complaint and required Nationwide to reimburse her losses.

An HSBC customer lost almost £2,000 after payments he thought he was sending to HMRC were actually going to scammers impersonating the government agency.

According to the FOS, HSBC argued that it was “inconceivable” that the customer, described as a professional person, could miss “red flags” before making the payments involved in the scam – despite the customer stating that the criminals knew information about his tax arrangements during the call.

The FOS pointed out that his professional background didn’t make him “an expert in the UK tax system”. It told the bank to fully refund the customer, doubling the partial reimbursement the bank initially offered, and said that it needs to be more realistic when understanding the level of checks and diligence customers take when involved in a scam.

Which? member Robert lost £65,000 to fraudsters claiming to represent investment firm TD Global Finance after making some online enquiries.

He later discovered that the very convincing website – tdglobalfinance.co.uk – was a clone after an FCA warning about the site appeared shortly after transferring the money in batches, both over the telephone and at his local branch.

Halifax returned £30,000 but refused to reimburse the rest stating that Robert had “failed to make sufficient checks” before investing.

When Which? stepped in to point out that the bank hadn’t asked Robert what checks he had made, and had also been convinced by a scam invoice, it reviewed the case and refunded the rest.

These cases are just three examples that highlight the unfair decisions banks are making despite having signed up to the industry’s voluntary code on bank transfer scams.

Which? is concerned that given the very high proportion of instances where customers were deemed to be at fault, many more people are being wrongfully denied reimbursement. Recent figures from UK Finance show that just 47 per cent of losses in 2020 were returned.

This is also based on the fact that, aside from the FOS decisions and cases challenged by consumer advocates, there is no transparent information about how individual banks deal with victims of this type of scam.

Data from the Lending Standards Board, which oversees the code, shows that for two firms signed up to the code, victims were held fully responsible for more than nine in 10 payments made to scammers. However, this information is anonymised so there is no way to identify the banks involved.

It also shows that, across all decisions made by banks signed up to the code, around two-thirds (67%) of payments to investment scammers, where someone is conned into investing in schemes or products that are worthless or may not even exist, found the customer to blame.

Decisions on payments made as part of purchase and advance fee scams, two forms of fraud which can involve people being tricked into paying for goods and services that aren’t real, each held the customer responsible 65 per cent of the time. For romance scams the figure stood at six in 10 (61%).

In a response to the Payment Systems Regulator’s consultation on the future of the code, the consumer champion supports the regulator’s proposal to require banks to publish data to show how well they are preventing the harm caused by APP fraud.

It is also pressing for the regulator to require changes to be made to the rules of the Faster Payment Scheme, which facilitates bank transfers, so that it includes an obligation for payment providers to reimburse victims of what are often sophisticated types of fraud.

Which? believes that under no circumstances should the regulator consider changes that would enable banks to rewrite the rules of the code, given the unfair and inconsistent approach that some firms signed up to the code have taken to reimbursement since its introduction.

Gareth Shaw, Head of Money at Which? said:

“This latest damning evidence suggests victim-blaming is simply the norm for some banks when it comes to scams.

“It’s clear that a voluntary code is not enough to protect victims who can lose life-changing sums of money and the current system lets banks benefit from a cloak of anonymity when they report their reimbursement rates.

“This cannot be allowed to continue. The regulator must work with the government to establish mandatory standards of consumer protection for all banks and payment providers, with strong enforcement to ensure that people are treated fairly and consistently.

“It must also urgently order banks to regularly publish reimbursement rates, so consumers can clearly see how their bank chooses to treat victims of crime and how well they are tackling bank transfer fraud.”

Case study

Which? member Robert lost £65,000 to fraudsters claiming to represent investment firm TD Global Finance after making some online enquiries.

He said: “A man phoned and said he was from TD Global. He rattled off a shortlist of familiar-sounding firms and offered to send me an email and prospectus. He said he’d call again in a week, which put me at ease as scammers try to rush you. The email linked to a professional website. I checked the FCA register and saw TD Global is regulated.”

Once he agreed to invest, Robert was sent an invoice with bank details for what he was told was their solicitor’s office. Robert ended up transferring the money in batches, both over the telephone and at his local branch.

He later discovered that the very convincing website – tdglobalfinance.co.uk – was a clone after an FCA warning about the site appeared shortly after the final transfer to the fraudster.

Halifax returned £30,000 but refused to reimburse the rest stating that Robert had “failed to make sufficient checks” before investing.

When Which? stepped in to point out that the bank hadn’t asked Robert what checks he had made, and had also been convinced by a scam invoice, it reviewed the case and refunded the rest.

Halifax said keeping its customers’ money safe is its priority and that it has a great deal of sympathy for the customer.

It stated: “We have reviewed the circumstances of his case and having taken into consideration new information which has since been provided, we have refunded the remaining £35,000.”

Notes

• Data analysis from the Lending Standards Board: https://www.lendingstandardsboard.org.uk/wp-content/uploads/2021/01/LSB-CRM-Code-review-Data-Analysis-January-2021.pdf – Data covers 28 May 2019 – 1 July 2020

• A Nationwide spokesperson said they were unable to comment on the specific case but provided this statement: “The security of our members’ money is paramount. We take all types of fraud extremely seriously and employ round-the-clock defences involving a range of checks over suspicious or unusual transactions. Alongside making a Confirmation of Payee check, we also show our members making payments to new payees a tailored scam warning based on what they tell us the payment is for. We keep those warnings under regular review and, in doing so, we take into account learnings from each scam case.”

• HSBC said it was unable to comment on the individual case but provided this statement: “Protecting customers from fraud is an absolute priority for us and we work hard to deliver on our commitments under the CRM Code. We independently review every scam case in line with the guidance set out in the code to determine whether a customer has done enough to protect themselves from being a victim. We act with empathy and understanding when investigating a case and aim to ensure fair and reasonable outcomes for all customers.”

• Fraud victims face a lottery to get their money back

• Which? calls for urgent government action over devastating emotional toll of online scams

• Which? is the UK’s consumer champion, here to make life simpler, fairer and safer for everyone. Our research gets to the heart of consumer issues, our advice is impartial, and our rigorous product tests lead to expert recommendations. We’re the independent consumer voice that influences politicians and lawmakers, investigates, holds businesses to account and makes change happen. As an organisation we’re not for profit and all for making consumers more powerful.

• The information in this press release is for editorial use by journalists and media outlets only. Any business seeking to reproduce information in this release should contact the Which? Endorsement Scheme team at endorsementscheme@which.co.uk.

Press Release