APP fraud: UK PSR consults on gross negligence and reimbursement limit for reimbursement requirement

Consumer standard of caution (gross negligence)

In June’s policy statement (see our Engage article), the PSR set out two exceptions to the general reimbursement requirement for victims of APP fraud:

• Where the consumer seeking reimbursement has acted fraudulently (‘first-party fraud’); and
• Where the consumer has acted with gross negligence (the ‘consumer standard of caution’).

The consultation (CP23/7) explains the policy approach that the PSR proposes to take to the consumer standard of caution, to be contained in a policy document (Annex 1), and the draft guidance for payment service providers (PSPs) that it intends to produce alongside it (Annex 2). It follows a series of engagement sessions with industry trade bodies, PSPs, consumer groups and other interested parties on the PSR’s approach to producing guidance on the consumer standard of caution.

Three elements to the consumer standard

The PSR proposes three elements to the consumer standard of caution:   

• A requirement for consumers to have regard to consumer, scam and transaction-specific warnings given by their bank, which must occur before an APP is executed and make clear that the intended recipient of the payment is likely to be a fraudster.
  • It will be up to providers to develop their own operational approaches and identify effective best practice, but this should not include adoption of ‘boilerplate’ warnings.
  • A consumer proceeding with a transaction despite these warnings should not automatically be deemed to have been grossly negligent. Factors that will be relevant to the degree of negligence include the complexity of the scam and whether the PSP can reasonably be expected to have paused or otherwise prevented an APP from being executed.
  • Where a consumer is subject to repeated APP scams of a similar kind, PSPs should consider that this may be indicative of vulnerability. They should take care to ensure they do not mistakenly categorise vulnerability as gross negligence in such circumstances.
• A prompt notification requirement where consumers who are, or suspect they are, a victim of an APP scam should notify their bank promptly and, in any event, not more than 13 months after the last fraudulent payment was made. 
  • The PSR states that what constitutes a prompt notification will depend on the circumstances of each individual case.
  • PSPs should provide accessible, non-discriminatory means for consumers to notify them of suspected APP scams and should not rely on any delay introduced or caused by their own reporting systems when assessing whether a consumer has notified them promptly.
  • The PSR proposes that PSPs should make reasonable allowances for consumers who have taken time to report a suspected scam to the police before notifying the provider (see further below ‘Other standards of care: reporting to the police’).
• An information sharing requirement where consumers should respond to any reasonable and proportionate requests for information made by their bank to help them assess a reimbursement claim, or to determine if a consumer is vulnerable. This includes requests made under the ‘stop the clock’ provisions of the PSR’s June 2023 policy statement.
  • Only in circumstances where a consumer has not, through gross negligence, responded or adequately responded to such requests may a PSP refuse a reimbursement claim.
  • Additional information requests by the PSP, made after a reimbursement claim has been initiated, would be by exception and would need to be strictly limited to essential information needed for the PSP to establish either whether the consumer has been subjected to an APP scam, or for the purposes permitted under the ‘stop the clock’ provisions. The PSR states that all such requests would need to be proportionate to the value and complexity of the claim, and the claims history of the consumer.
  • PSPs would need to consider whether an inability or unwillingness to respond, or respond adequately, to an information request may be indicative of a consumer’s vulnerability. As in relation to warnings (above), the PSR emphasises that PSPs should take care to ensure that they do not mistakenly categorise vulnerability as gross negligence in such circumstances.
  • The PSR accepts that there would be ‘some operational challenges’ for PSPs in implementing this proposal but points out that consumers are not the only source of information, and information can also be gathered by PSPs from both the payment information associated with a particular transaction, and from the receiving PSP. It notes that a consumer who is, through lack of sufficient supporting evidence, wrongly refused reimbursement has a right to appeal to the FOS.

Burden of proof on PSPs

Each reimbursement claim will need to be assessed on its merits to determine whether the consumer is eligible for reimbursement or has breached the consumer standard of caution.

The burden of proof – which will be one of the balance of probabilities - will rest on the PSP to demonstrate that a consumer has not, through gross negligence, met one or more of these standards. If this is found to be the case, the PSP will not be required to reimburse the consumer.

Ts&Cs cannot be used to change or circumvent the standard of caution or burden of proof

The PSR makes it clear that PSPs should not use their existing contractual terms and conditions to alter or qualify the three requirements or to introduce any additional standards that have the object or effect of altering the consumer’s access to reimbursement. Likewise for the burden of proof: PSPs should not introduce any terms and conditions that shift it onto the consumer, nor require the consumer to disprove that they were grossly negligent.

What is meant by ‘gross negligence’ in this context?

The PSR describes gross negligence as a ‘very high bar which will critically depend on the individual circumstances of each case’. It interprets it to be a higher standard than the standard of negligence under common law, with the consumer having to have shown a ‘very significant degree of carelessness’.

The PSR only expects gross negligence to apply in a ‘small minority’ of cases.

What about vulnerable consumers?

The PSR is clear that gross negligence will never apply where a victim's vulnerability is a factor in them being defrauded.  

Other standards of care: reporting to the police

As part of its engagement sessions, the PSR considered other standards of care that could be introduced. These included whether to introduce a positive standard for consumers to report a suspected scam to the police, as a precondition of seeking reimbursement from their PSP. The PSR states that it may consider adding this to its standard of care in the future. It welcomes any evidence on the advantages and disadvantages of such an approach. Notwithstanding the current lack of a formal requirement, the PSR expects PSPs to encourage consumers to report APP scams to the police as this will be a ‘critical step to the identification and successful prosecution of fraudsters’.

Monitoring the effectiveness of the consumer standard of caution

As part of its monitoring of the effectiveness of the new reimbursement requirement once in force, the PSR will assess overall reimbursement rates, paying particular attention to refusals where the sending PSP claims that the consumer has not met the standard of caution. It will also monitor the speed of reimbursement and whether excessive delays are being introduced by investigations under the ‘stop the clock’ provisions.

Maximum level of reimbursement and claim excess consultation 

In June’s policy statement, the PSR confirmed that sending banks will have the option to apply a claim excess under the new reimbursement requirement, except in cases where the consumer is vulnerable. The PSR stipulated there will be no minimum threshold for claims, but there will be a maximum limit. 

Its current consultation (CP23/6) covers the values of the excess and maximum reimbursement level for Faster Payments, as well as including some questions on a maximum reimbursement level for CHAPS on behalf of the Bank of England (the Bank) following its announcement of its intention to create comparable consumer protections for retail CHAPS payments. Where possible, the PSR would like respondents to provide evidence and data to support their views on the values of the excess and maximum reimbursement level.

The PSR will take initial responsibility for defining the excess and the maximum level of reimbursement under the new reimbursement requirement. In the future, when Pay.UK has built sufficient capability and capacity, the PSR will explore transferring these roles to Pay.UK.

Claim excess proposals

How should the claim excess be structured?

The PSR previously consulted on the excess in September 2022, and has subsequently engaged with PSPs, industry groups, consumer groups and the Bank as the operator of CHAPS, to help inform its policy thinking. For more on the September 2022 consultation, see our Engage article ‘APP fraud: PSR proposals mean that mandatory reimbursement for scam victims is on the way’.

The PSR is now seeking views on the most appropriate way of structuring a claim excess.

The PSR considers that a single claim excess, set at the appropriate level, will clearly communicate to customers the need to exercise proper caution (thereby addressing the moral hazard risk) and will also be easier for PSPs to administer. It has identified three options on which it is consulting:

• Fixed excess: Any reimbursement claims under this amount would not receive any funds, and PSPs could deduct this amount from any valid reimbursement claims above it.
• Percentage excess: The excess would be a percentage of the reimbursement claim amount. All valid claims would receive some funds, but PSPs could deduct the excess percentage amount from the reimbursement. Victims with smaller reimbursement claims would pay a smaller excess than victims with larger claims.
• Percentage excess with a cap: The excess would work as a percentage excess up to a certain financial limit. The excess could be no more than this limit, regardless of the value of the reimbursement claim.

The PSR’s stakeholder engagement to date suggests that the fixed excess option would be the easiest for PSPs to implement, reducing the administration cost for PSPs as they wouldn’t have to process very small claims. Stakeholder feedback also suggests that this would be the easiest option for customers to understand.

The PSR asks for views on the above options, including the amounts for the fixed excess, the percentage and the cap. It’s also keen to know if stakeholders think the excess should remain static, increase with inflation, or employ some other metric (or not increase at all).

Claim excess will not apply to vulnerable customers

The PSR confirmed in its June 2023 policy statement that the excess will not be applied to vulnerable customers. It recognises the impact of the current cost of living crisis on consumers, and expects PSPs to ensure that any excess does not impose undue financial strain. In assessing vulnerability, PSPs should consider both the circumstances giving rise to the fraud, and the financial impact on the victim. With reference to the FCA’s vulnerable customers guidance, the PSR states that it also expects PSPs to apply the vulnerability exemption if the excess would cause a victim financial difficulty.

Proposal for PSPs to be free to apply a partial excess, as well as not levy an excess at all

The victim’s PSP (the sending PSP) may apply a claim excess under the new reimbursement requirement. The sending PSP can decide how much the excess will be, up to the maximum level. If the sending PSP chooses to apply the maximum claim excess, the receiving PSP is liable for only 50% of an in-scope claim – minus the maximum claim excess.

The PSR’s position is that PSPs are free to choose not to apply an excess. Some respondents to the September 2022 consultation felt that allowing PSPs to apply a partial excess may create confusion and/or undermine the objectives of an excess if it is not adopted fully. However, the PSR does not want to prevent PSPs from reimbursing more funds to victims if they wish. Sending PSPs that apply a partial excess will not be able to claim any of the waived amount from the receiving PSP.

Maximum level of reimbursement proposals

Proposal to align maximum level for Faster Payments with FOS claims limit

The PSR is proposing that the maximum reimbursement level for Faster Payments should be in line with the prevailing Financial Ombudsman Service (FOS) limit of £415,000 per claim. The PSR describes it as a ‘well understood limit’ which is sufficiently high that around 99.98% of APP fraud would fall within it. In addition, it anticipates that not aligning with the FOS limit would significantly increase appeals.

The PSR would expect customers and PSPs to take extra steps to guard against fraud and would expect this to increase in proportion to the transaction value.

Regarding any increase to the maximum reimbursement level, the PSR asks for views on whether it should use the same metric as the FOS limit which increases every year with inflation, following levels set by the FCA, or some other metric.

Should the maximum level apply to vulnerable consumers?

The PSR is consulting on whether the maximum reimbursement level should apply to vulnerable customers.

Maximum level would not be mandatory

The PSR is not proposing that PSPs must use the maximum reimbursement level it sets. Perhaps rather optimistically, it states that they will be free to increase the level or remove it entirely for their customers.

What about the maximum reimbursement level for CHAPS?

Aligning the Faster Payments and CHAPS maximum reimbursement limit with the FOS limit is the preferred option of the Bank, as the operator of CHAPS, as a consistent limit is easier for customers to understand, for PSP staff to communicate, and for PSPs to operationalise.

As for Faster Payments, the Bank is seeking views views on whether it should use the same metric as the FOS limit which increases every year with inflation, following levels set by the FCA, or some other metric.

Answers to the CHAPS related questions will be sent to the Bank to analyse and will not be analysed by the PSR.

The PSR will consult at a later date on how to ensure consistency and effective implementation in CHAPS.

Next steps

• The consultations both close on 12 September 2023.

• In October 2023, the PSR will consult on the draft General Direction which will be given to all payments firms, requiring reimbursement for APP scams victims.
• By the end of 2023, the PSR will publish the claim excess and maximum level of reimbursement, its final policy and guidance on the consumer standard of caution, and all legal instruments.
• The PSR is also currently consulting on the proposed legal instruments to put its reimbursement requirements in place. The consultation closes on 25 August 2023.  For more on this consultation, take a look at our Engage article: 'APP fraud: UK PSR consults on implementing instruments for mandatory reimbursement requirement'.
• To ensure the new requirements are in place for consumers as soon as possible, in its above consultation on the draft legal instruments the PSR has proposed an implementation, or ‘go live’, date of 2 April 2024. It plans to confirm the implementation date in the autumn, alongside the consultation on the draft General Direction (see above).
• The PSR will publish a comprehensive post-implementation review within two years, which will include consideration of the effectiveness of the consumer standard of caution against the PSR’s objectives as well as using regular data collection to assess the effect of the excess and maximum reimbursement level on customers (and whether any changes are required to ensure a fair and proportionate policy).
• The PSR also plans to align its ongoing evaluation of the new reimbursement requirement with the balanced scorecard of APP fraud data, which it plans to publish for the first time in October 2023. This will include considering whether there are opportunities to streamline its reporting requirements.
• In addition, where necessary the PSR will consult on any changes to Pay.UK’s role in maintaining, refining, monitoring and enforcing compliance with a comprehensive scheme for Faster Payments and implement those changes through appropriate legal instruments.
• The PSR will also review the progress of wider action to fight fraud, including its own efforts such as publishing a balanced scorecard of APP scam data, increasing intelligence sharing across the payments ecosystem and spending on Confirmation of Payee.

If you would like to discuss any aspect of the PSR’s latest APP fraud reimbursement requirement consultations, please get in touch with us.

Authored by Virginia Montgomery.