The simple banking process that could stamp out scams

Perhaps the most meaningful of these, and the one consumers are most likely to encounter first-hand, is confirmation of payee (also referred to as CoP). The NZBA has indicated that it will instigate an industry wide CoP service, but has not provided an indication of when this will be implemented.

What is confirmation of payee?

CoP means you can check that the name and account details of the person (or business) you intend to pay, match, before you make a payment.

If you believe you’re making a payment to a woman called Jane Doe, but the bank account you are sending money to is registered to Mr A. Naughtyman, the CoP process will flag the discrepancy before you make the payment.

It’s a simple process, but can have an immediate impact on preventing certain types of scam – notably, authorised push payment scams.

How CoP prevents some scams

An authorised push payment scam is when someone is tricked into sending money to a fraudster posing as a genuine payee, such as in a “Hey mum” scam.

In this scam, a victim receives a text from a new number saying something like “Hey mum, I’ve lost my phone so I’m texting from my friend’s number. Please can you transfer some money to my account (ACC: 12-1234-1234567-123).”

CoP is effective at preventing scams of this nature. If the victim attempts to transfer money to the account number provided using her child’s name, CoP will block the payment, flagging that the name and account details do not match.

Speaking to Consumer NZ in July, Banking Ombudsman Nicola Sladden said, “There are systems and technology that the banks could employ to help protect consumers from some of these fraud risks. An obvious example is the name and account checking functionality which has been adopted in the UK. That has prevented significant sums of money being taken by mistake or by fraud.”

How effective is confirmation of payee in reducing scams?

In markets where CoP has been adopted, the results are very positive and very fast.

In the UK, CoP was first adopted by the country’s six major banks in July 2020. This allowed for comparisons with payment service providers that had not adopted CoP.

In the Netherlands, the adoption of a CoP system led to an 81% decline in the number of fraudulent domestic bank transfers.

CoP’s effectiveness is also shown by how quickly cybercriminals stop using payment services that adopt it.

In the UK, in the quarter after CoP was introduced, banks that were not using CoP saw authorised push payment fraud increase by more than 60%. Analysis by PwC said this exemplified “how quickly fraudsters direct their attention to the weakest link”. Similarly, research conducted in 2022 by the UK’s Lloyds Bank showed that transfers made to firms not using CoP were up to 100 times more likely to be fraudulent.

British consumers have another layer of protection if they become the victim of authorised push payment fraud. Collaboration between banks and consumer groups has led to the adoption of a voluntary code of conduct, which has increased reimbursements to victims of authorised push payment scams.

The code – named the Contingent Reimbursement Model – began operating in 2019, following recognition within the banking industry that there are circumstances where banks should identify that payments, despite being authorised by their customers, may relate to a scam.

Ten payment service providers, accounting for 90% of authorised push payments, have signed up to the code. While it’s not perfect, it has seen the percentage of money returned to victims of authorised push payment scams increase from 23% in 2018 to 66% in 2022.

Why do we need CoP?

While New Zealanders are protected by a provision in the New Zealand Banking Association Code of Practice, this only protects bank customers if they are a “victim of fraud where someone accessed and used your electronic banking or your card without your authority”.

So long as you weren’t dishonest or negligent, took reasonable steps to protect your banking, and complied with your bank’s terms and conditions, you should be reimbursed for this type of scam.

However, the provision is a watering down of the previous iteration of the banking code of practice, which pledged to “continue the practice of reimbursing all customers that are genuine victims of Internet Banking fraud.”

In the UK, victims of authorised push payment fraud are protected first by CoP, and then by the voluntary reimbursement code.

In Aotearoa today, we have neither.

Our view

Consumer NZ welcomes the New Zealand Banking Association’s “instigation” of CoP but is concerned there is no timeframe for its implementation.

Consumer NZ Chief Executive Jon Duffy said, “Banks have finally accepted that name and account matching is necessary to help prevent scams. It’s our view this function should have been implemented before now, and failure to do that means banks have not been adequately protecting their customers.

"We know that the CoP function won’t prevent all types of scams and that scammers will always look for ways to get round preventative measures, but that doesn’t mean banks and other businesses shouldn’t be doing everything they can to prevent harm to their customers.

“We think until banks have introduced this technology, they should reimburse anyone who loses money if that loss could have been prevented by name and account number matching.”