New Zealand’s scam response: papering over the cracks

Ben, an IT specialist, is a savvy online shopper, so when he saw a phone on Trade Me for an attractive price, he did his due diligence.

“I took reasonable precautions. I reverse image searched the picture of the phone to see if it had just been pulled off the internet.

“I checked the seller’s account age and feedback before proceeding with the purchase, and I received the standard payment instructions via Trade Me.”

Ben’s bank’s new confirmation of payee service (ensuring the name used to make a payment is associated with the account number provided) added extra reassurance.

“The payment details included the payee’s name and a Kiwibank account number. The new payee check within the ASB app came back positive, so I proceeded with the transfer,” Ben told us.

But the following morning, Ben received an email from Trade Me warning him not to pay for the phone and to stop communicating with the seller.

The warning came too late.

Ben’s bank, ASB, confirmed the funds had already been moved from the receiving account and were no longer recoverable.

Ben had taken every reasonable precaution to ensure that a transaction facilitated by three large businesses – ASB, Kiwibank and Trade Me – was safe. This included using the latest in scam prevention technology offered by the banks, and yet he still lost $900.

ASB did what it could, providing confirmation of payee to protect Ben’s transaction.

But because Trade Me and Kiwibank’s services were being used to commit crime, Ben lost his money.

Both Trade Me and Kiwibank have declined to reimburse Ben for his loss.

So, what does this incident tell us about confirmation of payee, and what can it teach us about New Zealand’s scam crisis?

There’s no silver bullet to stop scams

Confirmation of payee is not a silver bullet.

Tom Roberts is threat and incident response team lead at the government’s National Cyber Security Centre.

He describes confirmation of payee as “a helpful tool in a toolbox that we can use collectively to fight scams … but just because you put up a fence, doesn’t mean a criminal isn’t going to try and jump over it or cut through it to get into your property.”

In Ben’s case, the scammers either used their own name and bank account, or more likely, used a mule account to receive the money before sending it overseas.

The individual associated with the mule account might have been complicit with the scammers, or the scammers might have taken control of a legitimate account.

In either case, they were able to give Ben real account details and a real account holder’s name. Confirmation of payee could never have identified the fraudulent transaction.

The banks say they have taken significant steps to crack down on mule accounts. However, as long as compromised accounts exist, they undermine the effectiveness of confirmation of payee.

Reimbursement is an important back-up to confirmation of payee

Even with confirmation of payee, we are never going to completely eradicate scams.

So, we need broad, consumer-friendly reimbursement policies to ensure banks are doing everything they can to prevent consumers being ripped off.

Historically, banks in New Zealand have only reimbursed customers who are the victims of unauthorised access scams. In an unauthorised access scam, criminals gain access to someone’s internet banking or their card to steal their money.

Ben fell victim to an authorised push payment scam. The scammers tricked him into sending funds under false pretences. As a result, his bank has no obligation to reimburse him.

Reimbursement for the victims of authorised push payment scams has been a key pillar of our campaign to stamp out scams.

In February 2024, then minister of commerce and consumer affairs commissioner Andrew Bayly sent an open letter to the banking industry. In the letter, he called for banks to investigate a reimbursement scheme for victims of authorised push payment scams in line with international best practice.

Reimbursement is on the way

The good news is that, in April 2025, the New Zealand Banking Association announced a new reimbursement scheme. This scheme will see authorised push payment scams reimbursed for the first time.

From December 2025, more scam victims will be eligible for reimbursement than today.

The not-so-good news is that the scheme is voluntary.

It has been designed by the banks and is pretty bank friendly as a result.

There are no penalties for non-compliance, and the protections it offers are significantly less consumer friendly than those enjoyed by consumers in the United Kingdom.

In the United Kingdom, victims of authorised push payment scams can expect to be reimbursed for their loss within 5 business days of the scam incident.

In New Zealand, the banks say you can expect to be reimbursed within 30 business days. But first, the banks must gather all the information they need to understand what happened.

It’s unclear how long it will take banks to gather the information they need. Thus, there is no set time limit before the 30-business-day limit starts.

In the United Kingdom, consumers are generally reimbursed for their losses from authorised push payment scams. The exception is if the bank can demonstrate the consumer displayed gross negligence in how they dealt with the scam.

In New Zealand, the new reimbursement scheme will use ‘reasonable care’ as the threshold for whether a victim will be compensated, and to what extent.

The difference between ‘reasonable care’ and ‘gross negligence’ might feel minor, but it’s an important legal distinction, according to Consumer NZ’s legal expert Aneleise Gawn.

“A failure to take reasonable care is a much lower bar than gross negligence. It would be much easier for a bank to prove someone failed to take reasonable care than it would for them to prove someone had been grossly negligent.

“This works in the banks’ favour and is likely to see fewer victims reimbursed than if gross negligence was the threshold,” Gawn said.

It is up to the banks to decide whether a customer acted with reasonable care.

If a customer is unhappy with their bank’s reimbursement decision, they can take their complaint to the Banking Ombudsman.

Ben’s case highlights shortcomings of the reimbursement scheme

There is also an important exception in the new reimbursement scheme.

If you’re the victim of an authorised push payment scam that involves an online marketplace, such as Facebook Marketplace or Trade Me, you’re not eligible for reimbursement.

A significant proportion of authorised push payment scams originate on these marketplaces. BNZ reports that “nearly 40%” of these scams start on online marketplaces.

That means that while the banks in New Zealand will now cover authorised push payment scams, they exclude a sizeable minority.

This exception does not exist in the United Kingdom’s reimbursement scheme.

When we asked the New Zealand Banking Association about the reasons for the exception, its chief executive Roger Beaumont said:

“There’s nothing banks can do to prevent online marketplace scams. This is why Trade Me and similar platforms will not be covered by the new authorised payment scam compensation approach that will take effect at the end of November.

“In any given case, it’s important to remember that banks will retain their own discretion to pay compensation beyond the minimum requirements set out in The Code of Banking Practice.

“The new compensation approach recognises shared responsibilities for protecting New Zealanders from scams. Banks are stepping up their customer protections and will be accountable for those measures. However, they cannot take on full liability for scam losses that are beyond their control and may, for example, start with a fake ad or chat on social media or a fake search engine result,” Beaumont said.

We disagree with Beaumont’s assertion that the new approach recognises shared responsibility for protecting New Zealanders.

In a perfect world, the liability for Ben’s loss would be spread across the businesses used to steal his money. Both Trade Me and Kiwibank have failed to protect him from criminals using their services. They should share responsibility for Ben’s loss.

Instead, because an online marketplace was involved in the scam, Kiwibank is absolved of any responsibility, even though its services were used to commit crime.

If the banks truly wish to help protect New Zealanders from scams, a good start would be to take responsibility when their services are compromised by criminals.

Government must take the lead on the scams response

The banks’ reimbursement scheme is a step in the right direction, but there are a couple of lessons we can learn from it.

First, we cannot let fraud-enabling sectors dictate the terms of scam reimbursement. If we did, the result would be business-friendly policies that failed to comprehensively protect scam victims.

Second, reimbursement must go beyond the banks. Telecommunications companies, social media platforms and online marketplaces play a significant role in the current scams crisis. But they are under little pressure to reimburse victims for their losses. Banks can ask these sectors to help prevent scams or to contribute to reimbursing scam victims, but they can’t force them to do either.

So far, the government has been extremely gentle with the sectors it hopes will solve the scams crisis.

However, we are concerned that leaving the scam response to businesses will see the continuation of scams. Industry-designed schemes lead to industry-friendly outcomes.

We need the government to stick up for consumers and ensure New Zealanders have world-leading scam protections.

It’s time for the government to step up on scams.