How to set up fraud and payment reimbursement controls

Protecting your business and customers from payment fraud

To operate safely, your business must have systems in place to detect and prevent payment fraud, particularly Authorised Push Payment (APP) fraud. This involves creating a clear policy for reimbursing customers who fall victim to scams, in line with new rules from the Payment Systems Regulator (PSR). Getting this right from the start is essential for protecting your customers, your finances, and your business’s reputation.

What is Authorised Push Payment (APP) fraud?

APP fraud is when a customer is tricked into sending money from their account to an account controlled by a fraudster. They authorise the payment, believing they are paying a legitimate person or business.

Example: A fraudster intercepts an email from one of your regular suppliers. They send you a new invoice that looks identical to the real one, but with their bank details on it. You pay the invoice, thinking you're paying your supplier, but the money goes directly to the fraudster.

Why this is crucial for your business

Under new PSR rules introduced in 2024, the responsibility for reimbursing victims of APP fraud is shared 50-50 between the sending bank (the customer's) and the receiving bank (the one the fraudster uses). As a business that receives payments, you have a vital role to play in this system.

• Legal Compliance: You are required to take steps to prevent your business accounts from being used for fraud.
• Financial Protection: Strong controls reduce the risk of your business becoming a target or facing financial liability for reimbursements.
• Customer Trust: Demonstrating that you handle payments securely gives customers the confidence to buy from you.

Your step-by-step guide to compliance

Setting up your controls can be broken down into a few key actions. Follow these steps to build a solid foundation.

1. Understand Your Responsibilities: Familiarise yourself with the PSR’s requirements. The key takeaway is that all payment service providers, including the banks businesses use, must have systems to manage APP fraud. Your bank will expect you to have good practices in place.
2. Implement Fraud Detection Measures: You don’t need a huge security team to be effective. Start with the basics:
   • Confirmation of Payee (CoP): This is a name-checking service that helps ensure payments are sent to the intended person. To enable this for your customers, your business may need to be registered with Pay.UK, the organisation that runs the system. Speak to your business bank about how they can help you get set up.
   • Monitor Transactions: Keep an eye out for unusual activity. This could be unexpectedly large payments, multiple payments to a new account, or last-minute changes to supplier bank details. Always verify changes verbally using a trusted phone number.
   • Train Your Team: If you have staff, make sure they understand common scams like invoice fraud. A well-informed team is your best line of defence.
3. Develop a Clear Reimbursement Policy: Create a simple, internal document that outlines what happens when fraud is reported. It should include:
   • How a customer can report a suspected fraudulent payment.
   • The steps you will take to investigate.
   • Your commitment to cooperating with banks to ensure reimbursement within the PSR’s 5-business-day target.
   • The specific, high-level circumstances where a customer might not be reimbursed (e.g., acting with gross negligence).

Practical tips for getting started

• Use Reputable Payment Processors: Services like Stripe, PayPal, or GoCardless have sophisticated, built-in fraud detection systems that do a lot of the heavy lifting for you when taking customer payments online.
• Secure Your Invoicing: When sending invoices, consider password-protecting the PDF. Include a note that you will never announce a change of bank details solely via email.
• Keep Good Records: Meticulous records of all transactions and communications are invaluable if you ever need to investigate a fraudulent payment.

What to do if you suspect fraud

If you or a customer suspects a fraudulent transaction has occurred, act immediately.

1. Stop: Do not send any more payments.
2. Report: Contact both the sending bank and the receiving bank straight away.
3. Record: Report the incident to Action Fraud (the UK’s national reporting centre for fraud and cybercrime).
4. Review: Follow your internal policy and support the investigation to help the victim get reimbursed quickly.

While it might seem daunting, implementing these controls is a fundamental part of building a resilient and trustworthy modern business. By taking these proactive steps, you are creating a secure environment for your money, your customers, and your future growth.