How to Inoculate the World Against a Payment Fraud Pandemic

Unlock Editor’s Digest for free

FT editor Roula Khalaf selects her favorite stories in this weekly newsletter.

When Jason*, a young executive at an events business in Hong Kong, recently received a WhatsApp from his friend and colleague Janet*, he thought little of it. She was asking him to transfer HK$5,000 (US$641) to pay for the equipment for their last concert. After checking exactly what he needed it for, he logged into his bank account and made the transfer.

But like millions of people around the world, Jason had been duped. Janet’s WhatsApp account had been compromised when she clicked on a rogue ID verification message and a fraudster impersonated her.

Worldwide, billions of dollars are now lost to online payment fraud every year, much of it perpetrated by international organized crime, experts say, and most of it initiated by WhatsApps, Facebook ads, texts and other digital triggers.

A global hotspot is the UK, where new rules from the Payments Regulator come into effect next month, forcing banks to compensate defrauded customers in many circumstances – something the biggest lenders already do under a scheme voluntary. Of the £1.2 billion stolen in the UK in 3 million cases of fraud last year, around 40% was the result of this type of “authorized push payment” scam, according to banking lobby group UK Finance. And more than 60% of those losses have been repaid.

Some bankers welcome the new rules – they will introduce a new deductible of £100 payable by the victim as an extra incentive to be more careful; and will spread responsibility across a wider range of financial institutions than those that have adhered to the voluntary code. The maximum amount covered has also been reduced.

In truth, however, Britain’s new regulatory approach is a missed opportunity to deal head-on with a new type of crime.

The most fundamental problem is that the police devote shockingly few resources to fighting fraud. According to the UK Home Office, it is now the largest category of crime in England and Wales, accounting for 41% of the total. And yet only 1% of the police workforce is dedicated to fraud. Bizarrely, much of the funding for the little policing that takes place is contributed by the banking sector. Little is being done to break up international criminal networks because individual thefts are usually small-scale, putting them under the radar for cross-border investigations or collaboration.

The UK, meanwhile, is an outlier both in terms of the scale of the problem and the central role banks play in compensating victims. A report to be published this month by the Social Market Foundation for Santander UK, found that British victims of fraud were twice as likely to be fully compensated by their bank than those in other leading economies. Of the 28,000 people surveyed, two-thirds of Britons were partially or fully compensated, the highest proportion of the 15 countries surveyed. (The US rate is 53 percent; Japan 31 percent; and Germany 28 percent.)

The incidence of fraud in the UK is higher for a cocktail of reasons: so-called Faster Payments, which make instant bank transfers easy, ubiquitous digital communication and the likelihood that international fraudsters speak better English than, say, Portuguese. The relatively light offer of compensation was the result of Britain’s long-standing culture of consumer protection, but also the pragmatism of banks, keen to regain confidence after the financial crisis and a series of mis-selling scandals.

Other scam intermediaries, on the contrary, get out for free. Telecom companies and the technology sector shrug off responsibility for compensation. Lobby group TechUK has signed up to a new “fraud charter” but insists it would be “neither proportionate nor effective” to pick up part of the tab.

Online fraud and consumer claims are likely to grow from here as digitization and instant payments accelerate and AI gives fraudsters another tool. Policy makers and everyone connected to fraud chains must work together for prevention. And the police must devote serious resources to this crime pandemic.

But individuals should also take responsibility — learning about the risks and how to avoid them, reporting scams, and accepting at least some losses if they’re guilty of taking them. Jason certainly learned an expensive lesson. After demanding a refund from his bank and reporting the crime to the police – both to no avail – he vowed to be hypervigilant in the future.

*not their real names

[email protected]