News

The Treasurer’s proposed transformation of the regulation of payment systems is an opportunity to embed financial safety, and ensure protections are built in from the outset says Consumer Action’s CEO Gerard Brody in an opinion piece.

Last month Josh Frydenberg foreshadowed sweeping changes to Australia’s payment systems, including a proposal to regulate cryptocurrency exchanges. To promote community trust and confidence in payments, there needs to be a greater focus on better protecting Australians from ballooning scam losses.

Payment systems – the pipes of the finance system that allow us to transfer money electronically at a click of a button – represent the closest thing to a public utility in the finance system. That’s why safety should be a core principle underlying those systems.

Unfortunately, while payment systems have innovated over the last 20 years, most recently into digital currencies such as crypto, so have scams and financial crimes. The ACCC reported scam losses of more than $850m in 2020, and in September last year it reported an 89 per cent increase in reported scam losses. The ACCC says these losses “are a fraction of the total losses suffered by Australians’’. Losses are likely to exceed $1bn this year. This not only affects individuals and families who sustain losses but represents a huge restraint on the economy.

The Treasurer’s proposed transformation of the regulation of payment systems is an opportunity to embed financial safety, and ensure protections are built in from the outset.

The common policy response to the risk of scam losses is consumer education. However, education is unlikely to reduce scam losses because scammers are sophisticated and exploit consumer trust.

In romance or investment scams, for example, the scammer often grooms the consumer over a long period. In investment scams such as those involving crypto, sometimes there are some initial small returns before the scammer takes all your savings. A relationship of trust develops, and the scammer exploits that trust. In these circumstances, the consumer is acting under the undue influence of the scammer. At law, it is recognised that undue influence deprives people of their free will, and people cannot protect themselves.

Other scams, like invoice-hacking or remote access scams where fraudsters take over your computer, are opportunistic, with scammers taking advantage of weaknesses in processes or a moment of panic. It is hard for people to protect themselves – our decision-making capacity contracts in times of stress or panic.

So – if education is not sufficient – what can be done?

We need to look at the role of banks and firms operating in the payment system. This is because fraudsters behind scams hold or control bank accounts. The proposal to regulate crypto exchanges more akin to banks also represents an opportunity. After all, banks and the operators of crypto exchanges are better placed than individuals to identify scams and take steps to protect against losses.

For some sorts of scams and frauds, the banks are already liable. Where a scammer directly accesses a bank customer’s account or card to initiate transactions – think counterfeit/skimming fraud, fraud on lost and stolen cards, and “card not present” fraud – consumers do not bear the losses.

Given banks bear liability, they have an incentive to reduce losses. AusPayNet, a banking industry body, says bank fraud reduction initiatives have been successful in these areas, with card fraud rates dropping from 73c per $1000 spent in 2018 to 58c in 2021.

However, for scams where a customer authorises a payment to another account that turns out to be fraudulent, the consumer is unlikely to obtain reimbursement. This is the case even if the consumer has taken steps to protect themselves.

While banks do take steps to try to recover funds when consumers report such scam losses, systematic bank fraud prevention efforts appear to be focused on guarding against unauthorised access to accounts, where banks do face liability.

If banks had greater liability for scam losses, would things change? I think they would, as banks would have a strong incentive to detect and prevent such losses. And given their systems and technology, banks are in a much better position to do this than individuals.

In a similar vein, we should be embedding the principle of financial safety in the regulation of crypto exchanges. While new innovations in payments offer opportunities, to the extent that represent an on-ramp to scams and financial crimes, we should be concerned.

Overseas, reforms are occurring to better protect people from scam losses. In the UK, the Contingent Reimbursement Code sets standards for signatory banks. These include commitments to protect customers with procedures to detect, prevent and respond to “authorised push payment” fraud (where someone tricks you into sending them money from their account). Fundamentally, the code provides that blameless people should be reimbursed for any losses through bank transfer fraud, provided the victim did not engage in “gross negligence”.

A recent review of these arrangement found that they were successful in contributing to people being reimbursed for scam losses. The UK Lending Standards Board reported that pre-Code, reimbursement rates were as low as 19 per cent by value. This increased to 47 per cent during 2020, for signatory banks, following the introduction of the code.

In light of this positive impact, the UK Payment Systems Regulator is proposing to strengthen and mandate the code for all banks. Once enacted, this will give greater confidence to users of payment systems that they will be compensated if they suffer scam losses through no fault of their own.

We need to embed similar arrangement in payment system reforms in Australia, covering both banks and innovations like crypto exchanges. Absent such reforms, consumers have little means of raising a complaint and pursuing redress against a bank that has been recalcitrant in preventing scams, or that has failed to take reasonable steps to recover scam losses.

People who are scammed through no fault of their own should be entitled to a refund.

ENDS