Why the PSR is right: October is the time for new APPF measures

by Dan McLoughlin, Fraud and Security Specialist, Lynx

To loosely paraphrase Steve Jobs, paradigm shifts in payments are never caused by one business, but instead by an entire collective.

The events of the past few weeks have certainly echoed this sentiment. Following Chris Helmsley’s recent departure from his role as managing director of the Payments System Regulator (PSR), the UK Payments Association called for a reconsideration of the new authorised push payment (APP) fraud rules – due to come into force in October – to ensure that the necessary infrastructure and policies are in place. Just two weeks later, the PSR rejected these calls. 

Regardless of your opinion on the timeline, APP fraud is a pressing issue that needs robust action. Over recent years, it has become one of the fastest growing types of scams around. Britons lost a total of £459.7m to APP fraud in 2023, having a devastating impact on both individuals and businesses. It’s not just the sheer amount of money stolen, but the volume of attacks. In the first half of 2023 alone, there were over 116,000 confirmed cases of APP fraud, representing a 22% increase compared to the same period in 2022.

I sympathise with banks. It is undeniable that the sophistication of fraudsters has increased dramatically, and keeping one step ahead requires time and resources. These fraudsters employ advanced social engineering techniques, exploiting human psychology to manipulate victims into transferring money willingly. This is behind the worrying rise of romance scams. But before I share why delays are needless (and even damaging), it’s important to look at what the new rules mean.

What do the new rules mean?

The planned regulations aim to address these challenges head-on. A key feature is the proposed £415,000 maximum reimbursement cap for victims of APP fraud. This cap serves dual purposes: it provides a safety net for consumers who fall victim to such scams, while also incentivising financial institutions to bolster their fraud prevention measures.

The logic behind this cap is clear. By setting a substantial reimbursement limit, regulators are effectively saying to banks: “prevent fraud or be prepared to pay.” This financial motivation should, in theory, drive increased investment in robust fraud detection and prevention systems.

It’s worth noting that many major UK banks already voluntarily comply with similar regulations. The new rules will primarily impact those institutions that haven’t yet implemented such measures, forcing them to catch up quickly or face significant financial repercussions.

The case for immediate implementation

While banks and financial institutions have grappled with the challenge of preventing such fraudulent activities, delays to the APPF regulation are unnecessary. The solutions to combat APP fraud effectively are already available and make compliance achievable without excessive expenditure. Banks are uniquely positioned to prevent APP fraud, and with the right technology, they can stop fraudulent transactions before they occur, negating the need for reimbursement. 

Implementing these new rules promptly is both feasible and necessary. The technology required to comply with these regulations is readily available and can be deployed quickly, even by smaller institutions.

While concerns about technological readiness, staff training, and the impact on smaller financial institutions are valid, they shouldn’t be barriers to implementation. The availability of artificial intelligence (AI) and machine learning (ML) solutions, particularly those offering no-code and low-code options, means that institutions of all sizes can rapidly adapt to the new regulatory framework.

By moving forward with these regulations as planned, we create a strong incentive for all financial institutions to prioritise fraud prevention. This will lead to a more secure banking environment for all consumers, regardless of the size of their bank.

How technology can combat APP

As we look to combat APP fraud more effectively, technology, particularly AI and machine learning, will play a crucial role. These technologies can analyse vast amounts of data in real-time, identifying patterns and anomalies that might indicate fraudulent activity. Because of the vast amounts of transactional data they possess, banks are in a unique position in the fight against APP fraud. This data, coupled with customer behaviour patterns and the ability to intervene in real-time puts them at the forefront of fraud prevention efforts.

For smaller financial institutions, the advent of no-code and low-code AI solutions presents an opportunity to rapidly implement sophisticated fraud prevention measures without the need for extensive in-house development resources. These platforms allow for quick deployment and easy updates, enabling institutions of all sizes to stay ahead of evolving fraud techniques.

There is an incredible amount of potential. AI-driven systems can also help in educating customers, providing real-time warnings about potentially fraudulent transactions and offering guidance on safe online banking practices.

The way forward

Simply reimbursing victims treats the symptom, not the disease. However, with the right technology in place, banks can prevent fraudulent transactions before they occur, eliminating the need for reimbursement in many cases. The fight against APP fraud requires a proactive approach, and the new regulations provide the necessary push for all institutions to adopt this stance.

The PSR’s decision to maintain the October implementation date is commendable. It recognises that the solutions are available, and that further delay would only prolong consumer vulnerability. This approach will drive innovation and improve security across the entire banking sector.

By implementing these regulations now, we can create a payments ecosystem that is not only safer for consumers but also more resilient and innovative. After all, as I noted at the outset, great things in payments are never done by one business alone, but by a collective effort of the entire industry.

Image Source: Freepik