HSBC has voiced strong support for tech companies to take on more responsibility for compensating fraud victims. They argue that the incoming compensation rules will not fully address the growing fraud problem in the UK. The new regulations will require banks to reimburse scam victims up to £85,000. Still, HSBC’s head of fraud, David Callington, believes the financial sector should not bear the burden alone.
Banks Alone Can’t Stop Fraud
David Callington highlighted that while the new compensation rules will motivate banks to strengthen their fraud detection systems, they won’t be enough to curb the rise in fraud cases across the UK. Banks like HSBC are doing their part to implement stronger fraud prevention measures. Still, the problem extends beyond the financial sector.
He pointed out that most authorised push payment fraud (APP) cases, where victims are tricked into sending money to fraudsters, originate from fraudulent text messages or fake ads on social media platforms. He argued that these platforms, including Instagram, Google, TikTok, and Facebook, should also be held financially accountable for facilitating fraud.
The Growing Problem of APP Fraud
According to data from UK Finance, APP fraud losses reached £459.7 million in 2023, with over 232,000 cases reported. This increase in cases has led to calls for tech and social media companies to share responsibility for compensating victims. Lobby groups have long argued that banks alone should not bear the costs of fraud when tech platforms are often the starting point for these scams.
Callington emphasised the need for a broader solution, stating, “The wider ecosystem, and key players in that ecosystem, have to be held to account.” He believes that tech companies need to have a financial incentive to improve their fraud prevention efforts and that the current voluntary measures are insufficient.
The Voluntary Online Fraud Charter
So far, the UK government has avoided imposing strict regulations on tech firms. Instead, it has introduced a voluntary online fraud charter. This charter encourages tech companies to take steps to block fraudulent material and protect consumers from fake adverts. However, Callington warned that unless this charter becomes legally binding, APP fraud will continue to rise.
He urged for stricter regulations to hold tech and telecom companies accountable when their platforms are used for fraud. “What we would urge for is a shifting of some of those obligations into regulation, so there is an actual obligation on other sectors to take action and protect our customers,” Callington said.
Banks and Payment Firms
Currently, the focus on fraud prevention has been primarily on banks and payment firms, which are responsible for moving funds from customers’ accounts. The Payment Systems Regulator (PSR) will make it mandatory for banks to reimburse fraud victims up to £85,000 starting from October 7. This follows the failure of many firms to consistently apply a voluntary industry code introduced in 2019.
However, this reimbursement scheme doesn’t address the root cause of many fraud cases—fraudsters operating through tech platforms. Callington and other industry leaders argue that the financial burden of fraud should be shared across the ecosystem.
Tech Firms Push Back
In response, tech firms have expressed reluctance to take on additional financial responsibilities. A spokesperson for techUK, a lobby group representing the tech industry, said that technology companies have already taken significant steps to address online fraud. They pointed to the voluntary charter and the Online Safety Act. Both of which will place new legal obligations on online service providers.
“There is no lack of incentive for action, and the Online Safety Act will place further significant legal obligations on online service providers,” the spokesperson said. They argued that extending responsibility for reimbursement to tech firms would not be effective or fair. Instead, the focus should be on developing technical solutions to disrupt fraud and prosecute fraudsters.
A New Burden for Banks
Next month, the costs of fraud will be shared between banks and payment firms on both sides of a transaction. This means that firms receiving fraudulent payments will also be held responsible. For smaller firms, this could pose a significant financial challenge, especially as the PSR’s data indicates that smaller players like PayrNet, Modulr, Zempler, and Kroo are among the largest recipients of fraudulent funds by volume.
The industry breathed a sigh of relief after the PSR backtracked on its initial plan to impose a maximum reimbursement cap of £415,000. Following pressure from banks, fintech firms, and some politicians, the PSR lowered the cap to £85,000. This move is expected to alleviate some of the pressure on smaller firms while still offering compensation to fraud victims.
The Role of the PSR
The Treasury has left the decision on fraud reimbursement in the hands of the PSR. A Treasury spokesperson commented, “The announcement of a consultation shows the regulator is listening to feedback as it seeks to strike a balance between protecting fraud victims and managing the impact on the industry.”
While banks and payment firms will bear the financial responsibility for compensating victims, the debate over whether tech firms should share this burden continues. With fraud cases on the rise and APP fraud becoming more sophisticated, the need for a comprehensive approach to fraud prevention has never been more apparent.
A Call for Industry-Wide Action
In the past, when banks faced little pressure to provide refunds, they rarely raised concerns about how tech companies operated. Back then, if a customer fell victim to fraud, the burden of proof and the struggle to reclaim lost funds lay entirely with the individual. However, now that banks are being held accountable for reimbursing victims of fraud, their focus has shifted. Banks have successfully lobbied to reduce the mandatory reimbursement cap from £415,000 to £85,000. Now, they’re pushing for tech companies to share the financial responsibility for fraud losses.
It seems somewhat disingenuous for banks to pass the blame to tech firms when fraudsters exploit the very systems banks have implemented. While tech platforms should certainly work to prevent fraud on their sites, it’s ultimately the banks that handle the financial transactions. Asking tech companies to compensate victims feels like an attempt by the banks to deflect responsibility. In the end, customers must be vigilant, but banks—not tech companies—should bear the responsibility for reimbursing victims. The push to involve tech companies in refunds feels like a diversion from the banks’ own obligations.
