The scenario is depressingly familiar: an individual or company intends to make payment to a genuine payee, but is tricked – often by someone hacking their email – into authorising a payment to an account in fact controlled by a scammer. The industry name given to such diverted payment frauds is Authorised Push Payment Scams.
From 28 May 2019, certain victims have the protection of the catchily named Contingent Reimbursement Model Code for Authorised Push Payment Scams. The good news is that for those qualifying under the Code, full reimbursement will be paid. However, the Code has relatively limited application.
Who has the benefit of the Code? Only:
- a consumer, that is an individual who is acting for purposes other than a trade, business or profession;
- a micro-enterprise, an enterprise which employs fewer than 10 persons and whose annual turnover and or annual balance sheet total does not exceed €2 million;
- a charity with an annual income of less than £1 million.
It follows that the protection does not extend to (i) any individual acting in the course of a trade, business or profession or (ii) to any business which employs 10 or more people or whose annual turnover or balance sheet exceeds €2 million.
What type of payments does the Code apply to?
The Code only applies to transactions between GBP denominated UK domiciled accounts and only to the point of the first reception of funds.
The Code does not therefore apply to payments to or from non-UK accounts or to any non-GBP denominated accounts. Likewise, if the victim authorised a payment from a UK domiciled account to a US account and the scammer then transferred the money from the US account back to the UK, the Code would not protect the victim.
Which banks are signed up to the Code?
8 banks covering 17 brands: Barclays, HSBC (including First Direct and M&S Bank), Lloyds (including Halifax, Bank of Scotland and Intelligent Finance), Metro Bank, Nationwide, RBS (including NatWest and Ulster Bank), Santander (including Cahoot and Cater Allen) and Starling Bank. There are some notable absentees from that list.
Is reimbursement automatic?
Not if the bank can establish a number of defences, including if its customer has been grossly negligent or ignored effective warnings from the bank.
Conclusion The Code may help. If it does not, then there are other routes worth exploring and, to have the best chance of success, it is important to move as fast as possible after discovery of the fraud.
Gibson & Co.
October 2019