5 ms·

The Payment Services Regulations (2009 & 2017) already encode this liability in UK law. It outlines a very clear set of standards that need to met for payments

The Payment Services Regulations (2009 & 2017) already encode this liability in UK law. It outlines a very clear set of standards that need to met for payments to be “authorised”, and make it clear that banks are 100% liable for any unauthorised payments. Banks of course will do everything in their power to shirk their responsibilities. But reading the legislation, and writing a well worded letter, plus a follow up with the Financial Ombudsman (FOS) is pretty much sure fire way to get your money back. The FCA set clear rules around how banks must deal with complaints, and the FOS makes it easy to escalate complaints when banks refuse to acknowledge they’re responsibilities, and are extremely consumer friendly (I say this as someone who’s dealt with the FOS from the banks perspective)

tpmx 3y ago
Since you seem to have a grasp on those regulations; which are those very clear standards that need be met for payments to be "authorised"? A brief overview would be much appreciated. Please include a link to the actual law text if you're able to.
- avianlyric 3y ago
  Legislation is online and written in some pretty clear English, knock yourself out[0]. But broadly the bank is completely responsible for any transaction the account owner claims is “unauthorised” unless the bank can demonstrate the account owner was “grossly negligent” with their payment credentials, or can demonstrate the account owner is making a fraudulent claim. The standard of “grossly negligent” is something you need to look to case law to understand, but it’s generally very hard to prove gross negligence, and the account owners personal situation must be considered. A relevant example of non-gross negligence, was an older individual who entrusted their debit card and PIN number to their carer so they could buy them groceries. The carer used the card and PIN to steal money from the account holder, and bank claimed that sharing their PIN with a carer was gross negligence, but the FOS and courts disagreed on the grounds the individual needed to provide their card and PIN because their personal situation made buying groceries themselves effectively impossible. But the TL;DR is that law places the burden on banks to prove that any transaction a customer claims is “unauthorised” was actually “authorised” by the customer, that the customer isn’t acting fraudulently, and wasn’t grossly negligent. There is no assumption of fault on the customer part. [0] https://www.legislation.gov.uk/uksi/2017/752/part/7/crossheading/authorisation-of-payment-transactions/made https://www.legislation.gov.uk/uksi/2017/752/part/7/crosshea...
  - deleted 3y ago
    [deleted]
  - tpmx 3y ago
    Thanks! In the Swedish supreme court case I quoted above: Background information: - Sweden has a public personal identification number for every citizen (except for like 10k people with protected identities) - The four main banks in Sweden have collaborated to create something called "Bank Id". It's often used as a secure authentication tool combined with the personal identification number (something you have - the cert in the mobile app, something you know - PIN or face id). Someone convinced an elderly person over the phone to authorize the creation of a new Bank Id on the attacker's phone. This was fairly complicated and required the old person to use their physical RSA SecurID token. The court found that the elderly person had behaved reasonably well and that the attacker was very competent. Still, the supreme court felt that the bank should have been more careful about letting strangers steal their money.
    - avianlyric 3y ago
      In the UK authorised push payment fraud, where customers are tricked into authorising payments to fraudster accounts has a similar smell to Swedish case you mention. Rulings by the regulators and courts have reached basically identical conclusions to the Swedish courts. Fs the customers acted in a reasonable manner, then it’s the banks failure, customers aren’t expected to become security and fraud experts just to access their bank accounts.
  - danmaz74 3y ago
    If you give your card and your PIN to somebody and that somebody steals from you, how can this be the bank's fault?
    - deleted 3y ago
      [deleted]
    - growse 3y ago
      Presumably because the bank thinks that card and pin possession is sufficient to authorise all transactions regardless of personal circumstance. As this case shows, this isn't always true.

tpmx 3y ago

Since you seem to have a grasp on those regulations; which are those very clear standards that need be met for payments to be "authorised"? A brief overview would be much appreciated. Please include a link to the actual law text if you're able to.

avianlyric 3y ago
Legislation is online and written in some pretty clear English, knock yourself out[0]. But broadly the bank is completely responsible for any transaction the account owner claims is “unauthorised” unless the bank can demonstrate the account owner was “grossly negligent” with their payment credentials, or can demonstrate the account owner is making a fraudulent claim. The standard of “grossly negligent” is something you need to look to case law to understand, but it’s generally very hard to prove gross negligence, and the account owners personal situation must be considered. A relevant example of non-gross negligence, was an older individual who entrusted their debit card and PIN number to their carer so they could buy them groceries. The carer used the card and PIN to steal money from the account holder, and bank claimed that sharing their PIN with a carer was gross negligence, but the FOS and courts disagreed on the grounds the individual needed to provide their card and PIN because their personal situation made buying groceries themselves effectively impossible. But the TL;DR is that law places the burden on banks to prove that any transaction a customer claims is “unauthorised” was actually “authorised” by the customer, that the customer isn’t acting fraudulently, and wasn’t grossly negligent. There is no assumption of fault on the customer part. [0] https://www.legislation.gov.uk/uksi/2017/752/part/7/crossheading/authorisation-of-payment-transactions/made https://www.legislation.gov.uk/uksi/2017/752/part/7/crosshea...
- deleted 3y ago
  [deleted]
- tpmx 3y ago
  Thanks! In the Swedish supreme court case I quoted above: Background information: - Sweden has a public personal identification number for every citizen (except for like 10k people with protected identities) - The four main banks in Sweden have collaborated to create something called "Bank Id". It's often used as a secure authentication tool combined with the personal identification number (something you have - the cert in the mobile app, something you know - PIN or face id). Someone convinced an elderly person over the phone to authorize the creation of a new Bank Id on the attacker's phone. This was fairly complicated and required the old person to use their physical RSA SecurID token. The court found that the elderly person had behaved reasonably well and that the attacker was very competent. Still, the supreme court felt that the bank should have been more careful about letting strangers steal their money.
  - avianlyric 3y ago
    In the UK authorised push payment fraud, where customers are tricked into authorising payments to fraudster accounts has a similar smell to Swedish case you mention. Rulings by the regulators and courts have reached basically identical conclusions to the Swedish courts. Fs the customers acted in a reasonable manner, then it’s the banks failure, customers aren’t expected to become security and fraud experts just to access their bank accounts.
- danmaz74 3y ago
  If you give your card and your PIN to somebody and that somebody steals from you, how can this be the bank's fault?
  - deleted 3y ago
    [deleted]
  - growse 3y ago
    Presumably because the bank thinks that card and pin possession is sufficient to authorise all transactions regardless of personal circumstance. As this case shows, this isn't always true.