Banks introduce new compensation measures for scam victims

The announcement follows sustained pressure from the government, advocacy groups and Consumer NZ, with reimbursement a key feature of our June 2024 campaign to stamp out scams. Over 13,000 people have signed our petition so far.

The new scam compensation scheme is undoubtedly a step in the right direction.

From December 2025, when the scheme will come into force, more scam victims than ever before will be eligible for reimbursement from their banks.

Consumer welcomes this development. But we are concerned by many of the details in the new scheme, especially the fact that it is voluntary. We believe the scam reimbursement scheme should be mandatory, with a regulator and penalties – to ensure compliance.

This doesn’t just apply to banks. We believe all fraud-enabling sectors should take responsibility for reimbursing scam losses. Plus, we believe these sectors should not be allowed to dictate the terms of scam reimbursement. The government needs to step up and take the lead on New Zealand’s scam response.

Keep reading to find out what the new scam reimbursement scheme covers, how it works and why we believe it falls short of the level of protection that New Zealanders deserve.

How does the new scheme improve reimbursement?

When it comes to scams involving our bank accounts, there are two ways scammers can get to our money.

1. Unauthorised access scams are where a criminal gains access to our internet banking or debit or credit card and transfers money from our bank accounts or uses our card details to spend our money.
   These scams have traditionally been reimbursed – subject to certain conditions – through the New Zealand Banking Association’s (NZBA’s) code of banking practice.

2. Authorised push payment (APP) scams are the other way money can be taken from our bank accounts. This is where the victim is tricked into making a payment to another individual. Examples include romance or investment scams or scams where a fraudster pretends to be a victim’s family member and asks for money.

At present, banks have no obligation to reimburse victims of APP scams, but from December 2025, victims of these scams may be eligible for reimbursement.

How does the new scheme work?

The reimbursement scheme is part of a new section of the NZBA’s code of banking practice.

The NZBA has outlined five specific scam commitments from the NZBA’s 13 retail member banks as part of the scheme. If your bank, or a bank that receives funds in a fraudulent transaction, doesn’t meet these scam commitments, you may be entitled to compensation for your loss. The scam commitments are:

• pre-transaction warnings sent to customers for certain payments

• confirmation of payee

• identification of and response to high-risk transactions

• a 24/7 reporting channel for customers who think they’ve been scammed that can respond to protect accounts

• sharing scammer account information with other banks to help prevent the spread of criminal activity.

At present, the measures behind these commitments are not yet in place. The final rollout of protective measures will take place between now and the end of November. After that, the reimbursement scheme will come into force.

Where does the scheme fall short?

In a February 2024 letter to the NZBA, former minister of commerce and consumer affairs Andew Bayly told the banks to:

• introduce a confirmation of payee system – this has now been rolled out in New Zealand

• update the code of banking practice

• investigate a voluntary reimbursement scheme in line with international best practice.

The United Kingdom has the best reimbursement policy for APPs. We believe the NZBA’s new scam compensation scheme falls significantly short of international best practice in a few key areas. We discuss these below.

Threshold for compensation

In the United Kingdom, consumers are reimbursed for their losses from APP scams unless their bank can demonstrate that the victim displayed gross negligence in dealing with the scam.

In line with the United Kingdom legislation, in our campaign to stamp out scams, we called for a scam reimbursement scheme that would compensate consumers unless they had been grossly negligent.

Instead, our country’s new code of banking practice uses ‘reasonable care’ as the threshold for whether a victim will be compensated, and to what extent.

The new code of banking practice says, “if you’re eligible, whether we will compensate all or some of your loss will depend on whether you took reasonable care when deciding to make or making a payment.”

This might feel like an insignificant detail, but it’s an important legal distinction, according to our legal expert Aneleise Gawn.

“A failure to take reasonable care is a much lower bar than gross negligence. It would be much easier for a bank to prove someone failed to take reasonable care than it would for them to prove someone had been grossly negligent.

“This works in the banks’ favour and is likely to see fewer victims reimbursed than if gross negligence were the threshold,” Gawn said.

It is up to the banks to decide whether a customer acted with reasonable care. If a customer is unhappy with their bank’s compensation decision, they can take their complaint to the Banking Ombudsman.

Speed of resolution

In the United Kingdom, most victims of authorised push payment fraud receive a reimbursement decision and necessary reimbursement within five business days. There is a provision that allows banks to ‘stop the clock’ for more complex cases. In these cases, reimbursement can take an absolute maximum of 35 business days.

In the NZBA’s new scam compensation scheme, the banks have pledged to pay any compensation needed to eligible victims within 30 business days – from the point when your bank has gathered all the information required to understand what happened. It’s unclear how long the process preceding the 30 business day limit could take.

The average APP scam victim in New Zealand could be forced to wait more than six times longer for reimbursement than the equivalent victim in the United Kingdom.

Exceptions mean victims could fall through the cracks

There are a number of caveats that could make victims of APP scams ineligible for reimbursement.

We think some of these are valid, for example, you won’t be eligible for reimbursement if:

• you act fraudulently or dishonestly

• you’re using a third-party service to make a payment (meaning your bank cannot cover the payment using confirmation of payee)

• you do not report the scam to the police and to your bank within three months of discovery and 12 months of the last payment.

But there is one important exception that we are concerned about.

Victims won’t be eligible for reimbursement if the scam involved the purchase of goods or services from social media or from online marketplaces like Trade Me.

This exception does not exist in the United Kingdom’s scam reimbursement policy.

We are concerned that this exception could mean that, in instances where a NZBA member bank has played a role in facilitating a scam by hosting mule accounts – and should have some level of responsibility – the use of an online marketplace absolves that bank of any liability.

In the case of a scam orchestrated using Trade Me, for example, if a bank failed to prevent one of their accounts being used to commit a crime, why can’t they provide a partial reimbursement proportionate to the role they played in the incident?

Government must take control of the scam response

The new scam reimbursement scheme is a positive development for New Zealanders. However, we believe it is a good example of why sectors cannot be allowed to regulate themselves when it comes to scams.

Government told the banks to investigate a voluntary scam reimbursement scheme that would align with international best practice. We do not think that the new scheme does that. It is a far less consumer-friendly scam reimbursement scheme than what is offered to consumers in the United Kingdom.

The new bank code of practice is designed by banks and is bank friendly as a result. Participation is voluntary, and there are no penalties if members do not fully comply (though the Ombudsman can instruct banks to reimburse victims if they believe a bank has breached the code).

We believe the voluntary scam reimbursement scheme is a step in the right direction. We also believe the government should closely observe how the scheme is operating, with a view to developing a mandatory code or regulations and appointing a regulator to enforce compliance.

This goes beyond the banks

Scams are not the banking industry’s problem to solve alone. Many scams leverage the services of multiple businesses across different sectors. Yet scrutiny for reimbursement falls far more heavily on the banks than it does on the telecommunications businesses, social media platforms or online marketplaces used to initiate scams.

Since our campaign launched in 2024, banks have taken more responsibility for protecting consumers from scams than other fraud-enabling sectors or the government.

However, the banks can only get their own houses in order. They can’t make other fraud-enabling sectors participate in cross-sectoral initiatives, improve their ability to prevent scams from taking place or share the responsibility for scam reimbursement. Only the government can do that.

It’s time for the government to step up on scams.