Australia’s major banks are fighting a push from regulators to force them to refund billions of dollars lost in online scams, arguing requirements to bear the costs of internet fraud could create complacency among consumers and lead to even more losses.
In a tranche of internal documents obtained by The Age and The Sydney Morning Herald under freedom of information laws, the Australian Securities and Investments Commission (ASIC) detailed “strong opposition” from the banks to proposals for new obligations “to prevent scams or reimburse customers for losses”.
ACCC deputy chair Delia Rickard wrote to ASIC in early 2020 calling for scams to be included in its review. Credit:
Financial scams have increased around the world during COVID-19, with consumers spending more money online during lockdowns and criminals exploiting security vulnerabilities. Australians lose about $2 billion annually to scams, according to estimates from the competition regulator, the bulk of which go unreported.
ASIC is currently reviewing the ePayments code, a voluntary code of practice that contains consumer protections for electronic payments, in a process that has been plagued by delays.
The Australian Competition and Consumer Commission (ACCC) in 2020 pushed ASIC to include scam prevention as part of its review, but ASIC ultimately decided against this after fierce pushback from the major banks.
In one document from the tranche, ASIC noted banks claimed accepting liability for “preventing customers from falling victim to scams is problematic, as it raises moral hazard issues (i.e. there is a risk that customers take less care if they know they will always be backed by their ADI).”
The UK regulator recently introduced a raft of new protections for consumers affected by scams, including increased liability on banks to reimburse customers who lose money and a “confirmation of payee” (CoP) mechanism that forces banks to flag payments where the account name does not match the BSB and account number.
Both the ACCC and the Consumers’ Federation of Australia (CFA) supported the introduction of a name-checking tool in Australia, claiming it would address an increasingly prevalent style of scam known as business email compromise, where hackers falsify invoices and request payment to fraudulent accounts using genuine business names.
In another document, in comments that were later deleted by ASIC, the banks claimed to “already help customers in various ways” and said blocking genuine transactions “is a highly sensitive issue that can lead to challenging interactions for frontline staff”.
The Australian Banking Association (ABA) has consistently stressed the need for greater personal responsibility in preventing scam losses, which has led some groups to accuse it of “victim blaming”. In one email to ASIC from September last year, the ABA cited “timing and cost” as the main reason for opposing the CoP mechanism while promoting greater consumer education.
An ABA spokesman said Australia is “world leading” in online payments security and pointed to existing initiatives including PayID, adding the association would continue to work closely with regulators and the government to develop improvements.
In the documents, the banking industry also argued name-checking would increase “friction” and “substantially delay” payments processing and warned of rising customer complaints if new regulations saw banks blocking payments because of minor typographical errors.
The CFA told ASIC there had been “blame shifting” between banks “to reduce liability for scam losses” and criticised the “little or no recourse” for victims, adding it will be increasingly “important to minimise mistaken payments through good system design, rather than relying on moves to get the money back afterwards”.
Britain’s new regulations force banks to reimburse customers for scam losses if certain criteria are met, using a pool of funds contributed by the banking sector. An early draft of ASIC’s review showed support for this approach: “We don’t consider the model too weighted in favour of the consumer, and it likely provides an effective way of incentivising work to reduce scam losses.”
However, ASIC became increasingly concerned members of the voluntary code would withdraw participation if new obligations to prevent scams required “significant investment” in new systems.
Rather than introducing regulations similar to the UK, ASIC sought to enhance existing on-screen warnings that inform customers about risks of entering incorrect details. However, the documents show there was also “resistance to this suggestion from banks” because it will “likely be expensive and resource intensive”. ASIC staffers noted “a warning message is not a panacea” and queried why banks ask for account names in transactions if they are not used.
Overall, ASIC’s interim position has been to allow industry to develop its own policies for preventing scams and to monitor the effectiveness of the UK approach, with the view to enforce new rules if progress is unsatisfactory. The regulator’s final position is set to be released in the first half of this year, three years after it began.
Australia’s major banks offer a system called PayID, where customers can transfer money using a mobile number or email address instead of BSB and account numbers. This system notifies senders if there is an ID mismatch but is only available when transferring smaller sums and accessible through internet banking. ASIC said it would monitor the roll-out, albeit slowly, of this system which would address fraud concerns.
In one memo, titled “OFFICIAL: Sensitive” from April last year, ASIC noted the potential for backlash from some stakeholders, including consumer representatives and the ACCC, who were “unlikely to welcome our approach and may view this as ASIC missing a good opportunity for tackling scams and potentially even being perceived as bowing to ADI pressure to refrain from imposing such measures”.
The Market Recap newsletter is a wrap of the day’s trading. Get it each weekday afternoon.
Most Viewed in Business
From our partners
Source: Read Full Article