By Claire Kershaw, Knowledge Lawyer and Kaileigh Hunter, senior Associate, TLT LLP

The Payment Systems Regulator’s (PSR’s) mandatory reimbursement requirement in respect of authorised push payment (APP) fraud came into force on 7 October 2024.  A major concern raised in relation to the rules is that they may, counterintuitively – result in higher levels of fraud, and thereby greater harm as (1) criminals will look to exploit consumers, and/or (2) consumers may exercise less caution when making payments. 

In this blog post we focus on some of the exceptions and limitations to the reimbursement requirement which are intended to mitigate against the latter.  (For further detail of the rules for both the Faster Payments and CHAPS schemes, see the key documents collated by the PSR here).

Exceptions

An (in-scope) APP scam payment is reimbursable where:

• the consumer standard of caution exception does not apply (this cannot be applied to vulnerable customers);

• the victim is not party to the fraud, or claiming fraudulently or dishonestly to have been defrauded; and/or

• the claim was made within the applicable time limit (currently 13 months after the payment was made).

In practice therefore, on receipt of a claim, a PSP will likely look to address these criteria in reverse order, ruling out those which are submitted late and/or fraudulently or dishonestly first, before considering whether the customer is vulnerable and lastly, whether the standard of caution exception applies.

Consumer standard of caution

There are four elements to the consumer standard of caution (the Standard) and if the PSP can show that the consumer has, through ‘gross negligence’, not met one or more of them, then the PSP is not obliged to reimburse (though they may choose to do so).  The onus is on the PSP to prove gross negligence. 

The Standard does not apply to vulnerable customers, i.e. (in line with the FCA’s definition) “someone who, due to their personal circumstances, is especially susceptible to harm – particularly when a firm is not acting with appropriate levels of care”. 

Notably only the first element of the Standard engages the consumer’s conduct before they make the relevant payment; the remaining three concern the consumer’s conduct and co-operation after the event. 

The four elements of the Standard are:

• The requirement to have regard to interventions

The PSR’s Guidance (the Guidance) states: “Consumers should have regard to specific, directed interventions made either by their sending PSP, or by a competent national authority [CNA]. That intervention must offer a clear assessment of the probability that an intended payment is an APP scam payment.” 

As noted above, this is the only element of the Standard which arises before the relevant transaction takes place and is arguably the most salient.  The Guidance emphasises that any relevant intervention(s) must be “bespoke” and “clearly convey the PSP’s, or [CNA’s], assessment of the probability that an intended payment is an APP scam payment”. 

Consumers are only required to “have regard” to such interventions. Where the consumer proceeds with the transaction and this subsequently transpires to have been a scam, the Guidance states that they should not automatically be deemed to have been grossly negligent; this should be assessed against various relevant factors such as the nature and degree of certainty of the intervention, and the complexity of the APP scam.

• The prompt reporting requirement

“Consumers should, upon learning or suspecting that they have fallen victim to an APP scam, report the matter promptly to their PSP and, in any event, not more than 13 months after the last relevant payment was authorised”.

As the above makes clear, the 13-month timeframe is a longstop, tied into the time limit for making a claim.  Although the Guidance provides that “[what] constitutes a prompt notification will depend upon the circumstances of each individual case”, it is difficult to envisage circumstances in which anything other than a very swift notification could properly be described as “prompt”. 

• The information sharing requirement.

“Consumers should respond to any reasonable and proportionate requests for information made by their PSP to help them assess a reimbursement claim. This includes requests under the ‘stop the clock’ rules”.

While the key principle - that PSPs approach information requests in a proportionate manner – may sound straightforward, information and document requests and responses can, unfortunately, very easily become protracted.  An additional layer of complexity for PSP’s to navigate is the potential overlap between a consumer’s ability and/or willingness to respond to a request and their potential vulnerability (and within the relevant time limits under the rules and ‘stop the clock’ rules).

• The police reporting requirement

“Consumers should, after making a reimbursement claim, and upon request by their PSP, consent to the PSP reporting to the police on the consumer’s behalf or request the consumer report directly the details of an APP scam to a competent national authority”. 

The Guidance notes there may be circumstances in which consumers may be less willing to consent to the PSP reporting the matter to the police.  As noted above however there may be cases where factors relevant to the first-party fraud exception and the standard of care exception play into each other.  The final reference in the Guidance to situations where a consumer is “deliberately obstructive” appears to acknowledge this.

Excess

While not an exception per se to the reimbursement requirement, the rules also provide that PSPs “may” apply a maximum £100 excess to each claim (save, again, for where the consumer is vulnerable).  A significant proportion of APP scams concern payments of less than £100 and so may be ruled out for reimbursement, however this will clearly depend the extent to which PSPs actually apply the excess.

In this respect amongst others there will no doubt prove to be some fairly significant variation between the approaches taken by PSPs in implementing the scheme.  Over the coming months all stakeholders will be watching very closely how this new, much-debated, regime works in practice.