The contingent reimbursement model is a voluntary agreement where participating banks agree to reimburse APP scam victims for losses unless it is evident the customer was grossly negligent.
According to UK Finance, banks on average returned 69 per cent of scam losses to victims under the model in the first half of 2023. This represents positive strides forward from 2020 where only 45 per cent of losses were reimbursed.
In October 2024, the PSR will enforce a new policy essentially superseding the contingent reimbursement model, mandating that all victims of APP scams be reimbursed, with the liability equally divided between the sending and receiving banks.
Forcing the receiving bank to share the burden is an interesting concept and one that is unusual in the fraud world. Historically it has always been the sending bank that is liable for fraud, as that is where the compromise occurred.
However in a world where victims are authorising transactions themselves, focus is shifting to the receiving account. In order for a scam to be successful, the fraudster must have control of the account where the funds land. If they do not, the whole attempt becomes futile.
These receiving accounts are known as mule accounts, and are herded by fraudsters in many ways.
They range from accounts opened through impersonation, where the sole purpose of that account is to be a mule, more recently though, as the demand for mule accounts increases, fraudsters are luring legitimate account holders to funnel the money for them, in exchange for a fee.
Banks will be forced to clamp down on this behaviour as liability exposure grows.
There are concerns however about the UK’s approach. A 100 per cent liability policy could create a heightened risk of user complacency. It could also open the door for policy abuse and collusion between consumers to extort funds from banks.
Finally, it could create a risk of under-banking, as new customers are seen as liability risks, rather than prosperous opportunities.
Australia is also less bullish about the UK approach, and plans to take a less forgiving stance to reimbursement. The Australian Banking Association argued that the UK approach creates a “honeypot for organised crime”.
Rather than reimbursing victims, there are plans in Australia to reduce the immediacy of payments, giving customers extra time to consider if they would allow a transaction to be fulfilled.
The delay and cooling-off approach in a payment journey provides customers and banks more time to identify red flags and be more responsible. The downside however is that this could be frustrating for users in the event of a false positive.
