ECC0095

Written evidence submitted by TSB Bank plc

Further to our recent conversation and TSB’s submission earlier this year to the Treasury Committee, I am writing to share details of the findings from TSB’s research into the impact of fraud across the UK. Also, as requested, I’ve set out more detail on the challenge created by faster digital payments and how appropriate levels of ‘grit’ can be adopted into the system.

Fraud research findings

TSB worked with ComRes to ask 2,000 people across the UK about their views on fraud – how it affects them and what they think should be done to tackle it. This was what they told us:

•          61% of people in the UK are worried about the financial impact that being the victim of fraud would have on them

•          82% of people in the UK think that social media companies and search engines have a duty to protect users from online fraud on their platform

•          79% of people in the UK would support government steps to ensure tech companies identify and take down scams from their platforms quickly

•          32% of people in the UK would struggle to afford food for themselves and/or their family for more than one week if they lost up to £500

•          22% of people in the UK would not be able to afford their rent or mortgage if they lost up to £500

•          28% of people in the UK said their mental health would be affected if they lost up to £500

As we discussed, TSB’s customers are protected by our Fraud Refund Guarantee – and we remain the only bank in the UK to offer this level of protection, although the Payment System Regulator (PSR) has recently made recommendations for other banks to follow our lead. As well as investing in our own systems to prevent fraud occurring in the first place, we joint fund, with industry, a specialist police unit - the Dedicated Card and Payment Crime Unit (DCPCU). We are also members of Stop Scams UK - a collaboration between banks, telcos and a small subset of technology firms.

But while TSB is playing its part, I am clear that much more concerted action is needed across sectors. The scale of fraud is at crisis levels and most consumers do not have the same protections as TSB customers. Citizens Advice report that two thirds of adults have been targeted by a scammer since the start of this year alone. And UK Finance figures show that over £2m is being stolen through fraud every day – a 30% increase from last year.

You will be aware that most fraud goes unreported, but almost all fraud now starts online. In the year 2020/21, Action Fraud received almost 900,000 reports of fraud – of which it estimates that 80% were cyber-enabled. UK Finance analysis shows that 70% of scams originate on an online platform. A key part of this challenge stems from search engines and social media companies hosting adverts on their marketplaces for goods that do not exist and which allow organised criminals to recruit “money mules” who allow their bank accounts to be used to receive the proceeds. We are also aware of fraud “kits” that are sold on online platforms to enable anyone to become a fraudster from the comfort of their own home.

Recommendations for fixing the UK’s broken approach to fraud

In reply to questions raised on our call and in our subsequent engagement with the Treasury Committee Clerk, I have set out TSB’s views on a range of tactics (by no means comprehensive) which I hope will be of assistance to your considerations as a Committee:

Online Safety Bill

Banks provide robust protections for their customers against fraud. However, fraudsters use technology and social engineering to trick people into ignoring warnings and sending payments. Fraudsters target people through romance scams, investment scams, fake purchase scams etc are all examples of fraud enabled by internet and social media firms. It is vital that these companies are properly regulated through the Online Safety Bill.

TSB has provided specific recommendations to the related DCMS Select Committee’s Sub-Committee inquiry into the Online Safety Bill (view here) and the Draft Online Safety Bill Joint-Committee considering the Bill (view here) on how the Bill might be made fit for purpose regarding fraud. At high level, our two key recommendations are as follows:

1. Define fraud: The Online Safety Bill should explicitly define fraudulent content as illegal and amend the Bill to include a new schedule on fraud that specifies the types of fraud offences that will be captured by the Bill and this must include fraud committed through paid-for advertisements and cloned websites.

2. Recognise financial impacts: Harmful content provisions should be expanded to include financial impacts on individuals in any assessment of harmful content, alongside psychological and physical impacts on individuals, which are already included in the draft Bill’s harmful content provisions.

Further detail is set out in the submission we made to your Committee’s inquiry in January 2021.

Payment Systems Regulator (PSR) APP Fraud consultation response

The PSR’s announcement last week on its plans to improve consumer protections for fraud victims was welcome news which should be implemented at speed – though it is not a silver bullet.

All customers should be able to see how their bank stacks up on fraud, this information is crucial for any customer who wants to be confident that their money will be protected. TSB has been doing this since April 2019 and remains the only bank to do so. We therefore welcome the Payment Systems Regulator’s decision to require all banks to disclose their fraud refund rates and strengthen reimbursement. Consumers now need tech companies to show a similar level of responsibility, investment and protection so that together we can win the fight against fraud.

On the specific recommendations of the PSR, I make two key observations:

1. Victims must not be blamed for the actions of criminals: A key reason why TSB has declined to join the Contingent Reimbursement Model (CRM) Code to date is that it is built on the principle that fraud victims are sometimes to blame. There is no other crime in modern Britain where this is case. Such an approach creates a sense of shame and means many fraud victims don’t even tell their loved ones that they have been a victim of fraud – let alone the authorities or their bank. If the PSR requires banks to join or comply with the Code in the future, it is critical that this interpretation is corrected. It is not entirely clear from the PSR’s announcement exactly how this will be treated under their proposals. It is stated that customers who “exercise sufficient caution” should be reimbursed but it is not clear if this will include cases where ‘boiler plate’ or ‘tick box’ warnings are shown by banks during the course of payments being made. At TSB we recognise that these are highly sophisticated scams and so offer our comprehensive fraud refund guarantee rather than refusing reimbursement on grounds that a “warning message” was shown.

2. Social media, telecoms and internet-related services must do more: I was encouraged that the PSR has joined calls that more must be done by these sectors to address fraud. It is right that banks act as a point of reimbursement to consumers – and that we should bear responsibility, and the cost, for safeguarding our customers where this falls under our remit. However, it is irrational and a very substantial cost burden that we are also left to, in effect, subsidise the consumer harm being done by other sectors – while they have no economic or regulatory incentive to address this situation. I reiterate: 70% of fraud is taking place on social media platforms. All banks, like TSB, should be taking responsibility to refund fraud victims, but this does not imply that the full cost should always sit with us and a mechanism needs to be found for us to cross-charge a portion of the bill to the platform that enabled the scam in the first place.

TSB will continue to campaign for a better approach to fraud. In the meantime, we urge regulators and legislators to recognise that TSB’s Fraud Refund Guarantee - which refuses to blame innocent victims, including businesses, is both essential to improving consumer outcomes and commercially viable.

Faster Payments

Faster Payments has been a brilliant development in helping consumers move their money more quickly. However, there is a case for reintroducing elements of friction into the system in those specific areas where fraud is most likely – without delaying the benefits of Faster Payments in most cases. This could be achieved in the following ways:

1. Ensuring a risk-based approach to payments

Currently the PSR allows banks until the next working day to process a payment. As an industry, this is something we should be using more - and the length of delay permitted by the PSR could be extended for certain cases. But to avoid undermining the benefits that Faster Payments has brought to consumers, any delay to payment should be determined by level of risk – building on the strong risk assessment technology which banks already have in place. A risk-based approach with an associated range of checks may be one route to achieving this.

2. Sharing known bank account details for standard payments

There are several sectors where payments are being made at large by the population to a limited number of accounts, for example to pay taxes to HMRC or to registered conveyancers for house moves, or to regulated investment companies. If these account details were shared with banks by the receivers, it would enable banks at a simple glance to be able to rule out many payments being made to fraudulent accounts. This is a simple idea with the potential to be highly effective. Yet despite it being under discussion for a long time, these examples have yet to agree to share a complete set of such ‘safe lists’.

3. Install financial incentives for social media and search engine companies to act

It is right that consumers are refunded if they are the innocent victim of fraud, as is the case for TSB customers. Where this fraud is proven to have originated on a social media platform or search engine, that company should be required to contribute to the reimbursement as an incentive to act and prevent such scenarios. Customers can straightforwardly prove where this is the case, for example by sharing a screenshot of the offending website page. This approach could also be extended to telcos for lax security in the message headers of SMS messages. In many cases this infrastructure is antiquated and an economic incentive to upgrade it would help bring about much needed action.

Indeed, creating such a scheme could be tied to an obligation for banks to offer a fraud refund guarantee, like TSB’s. Banks which promise to refund all innocent victims up-front would then be able to recoup half of that cost from the online platform which enabled the scam to start. We anticipate this would require an arbitration scheme to be introduced alongside regulation extending the remit of the PSR.

As our research shows, even relatively small amounts of money lost to fraud can have a significant effect on physical and mental wellbeing. However, not every consumer can rely on the fraud refund guarantee which TSB offers to protect customers. So, I am also attaching TSB’s guide on the most common types of online fraud and how people can avoid online scams to help with any relevant constituent cases you may have.

Thank you again for taking the time to speak with me. Please do let me know if I can be of any further support to your work. In the meantime, TSB’s Director of Fraud would be happy to provide your Committee’s clerks with further briefing, if this would be helpful.

Yours sincerely,

Debbie Crosbie

Chief Executive, TSB Bank plc

November 2021

   4