When Alison Dean received a text from her bank, the Co-operative, asking whether she had just made a £999 purchase, she did what most of us would have done, and dialled the number in the message.
After all, the text was listed on her handset alongside previously sent texts that the PhD student knew had come from the Co-op.
But the text message wasn’t from the Co-op. Somehow, fraudsters had managed to insert the message into the run of authentic texts from the bank.
Believing that she was talking to the bank, she handed over enough personal details – including the card-reader-generated code – to allow the crooks to remove £5,400 from her account. The Co-op refused to refund her, arguing that she had been grossly negligent.
This week the Financial Ombudsman Service put banks such as the Co-op on notice that blanket refusals to refund in such circumstances will no longer be tolerated. Instead, banks will have to take into account the “evolution and sophistication” of fraud.
This long-overdue move by the chief ombudsman, Caroline Wayman, ends the free pass that FOS has inexcusably given the banks, in cases like these.
“It’s not fair to automatically call a customer grossly negligent simply because they’ve fallen for a scam. That’s especially true in light of the sophisticated way criminals exploit banks’ security systems – and convince customers that their money is at risk,” she said this week.
The shift is bad news for two banks particularly, Santander and Metro, which now face having to reimburse fraud victims.
It will also be welcomed by anyone who was denied a refund after fraudsters took over their mobile phone service, and then used it to clear out their bank account. Sim-swap fraud, first highlighted by Guardian Money in 2016, is a sophisticated crime over which victims have little control, yet some banks have refused refunds.
This week’s shift by FOS is due in part to the work of this paper, but also to campaigning by independent fraud expert Richard Emery.
Banking regulations state that the bank must refund any payment that was not “authorised” by the account holder. Account holders whose account has been emptied by a fraudster cannot be said to have “authorised” such payments, therefore they should be refunded.
After Emery sent them a raft of similar cases, FOS has now accepted this, and has signalled to the banks that it will no longer be accepting the grossly negligent stance. To be clear, FOS is not saying that it will force the banks to refund fraud victims who were duped into sending money themselves after receiving an email from their “builder”, but it will be more likely to help victims such as Alison Dean.
p.collinson@theguardian.com
