A possible way to stop most push payment fraud

theoldmiser

Just a little idea I had while listening to a radio programme about push payment fraud, where the people on the program had had tens of thousands of pounds stolen.

As soon as an owner of a personal bank account tries to send more than £1,000 (for example, although maybe each individual customer could set their own maximum spend limit), the payment does NOT go through immediately. Instead, the bank will call the customer within a few hours, in order to ask them if they actually wanted to send that money to whoever it was supposed to be sent to, and ask them if they have had a phone call that is allegedly from the bank asking them to send the money. If the customer is NOT being defrauded, obviously they will say they are happy for the payment to go through, and the bank then releases the payment. If they customer IS being defrauded, they will say "Yeah, I had a phone call from you an hour ago, saying my account was compromised, and 'you' told me that I had to move this money into a different account." Then the bank cancels the payment, and the customer will hopefully never fall for it again.

How many of us make payments of more than £1,000 from our personal accounts more than once every few years, if that? (Or pick a suitable amount of money that YOU would never normally send.) How often would banks have to phone customers about legitimate payments? Not very often. And just like you now have to wait a few seconds to receive a code via text message when you log into your bank account, or often when you pay online on a website, in this case you would have to wait a few hours (tops) for a phone call from the bank, if you want to send more than £1,000 to somebody.

What do you all think about this idea? Sounds simple to me, and I think it would stop a lot of push payment fraud.

eskbanker

Doesn't sound viable to me - I think you massively underestimate the frequency of significant transfers and the cost of banks having to resource phone calls for every such occasion.

The increasing prevalence of Confirmation of Payee (not perfect but workable for most) and the voluntary code under which the banks are on the hook for 'genuine' APP scams (i.e. where the customer hasn't been reckless or negligent) seem to me to be a sensible compromise between security, convenience and cost....

Zanderman

I do £1000+ transfers regularly, between my own accounts, several times a month. I would be mightily annoyed if the bank rang me every time. Banks would be phoning people al the time - £1000 transfers are not unusual at all.

I very much doubt banks haven't already thought through your scenario and dismissed it.  The key need is for the customer not to fall for the scam in the first place.  To take your example; banks don't ring to say your account is compromised, and even if they did why oh why would they not be able to merely freeze the account?  The bank have full control of the account at all times. Only a fraudster would tell you the account must be emptied!

theoldmiser

eskbanker said:

Doesn't sound viable to me - I think you massively underestimate the frequency of significant transfers and the cost of banks having to resource phone calls for every such occasion.

The increasing prevalence of Confirmation of Payee (not perfect but workable for most) and the voluntary code under which the banks are on the hook for 'genuine' APP scams (i.e. where the customer hasn't been reckless or negligent) seem to me to be a sensible compromise between security, convenience and cost....

As I said... you could set your OWN MAXIMUM SPEND LIMIT.

You don't think that it costs banks a huge amount of staff time to deal with push payment fraud AFTER it has occurred?

How much are staff who phone up customers paid per hour? £12? Each phone call would take, say, five minutes (to be generous), and would therefore cost the bank £1 per call.

So if everybody was given a default maximum spend limit now, generated by a computer, based on their previous years' transactions, obviously there would not be a large number of such transfers.

Say I never spend more than £1,000 (I don't) on anything more than once a year. So my maximum spend limit would be £1,000.

The current system isn't working, therefore it isn't a sensible compromise between security, convenience and cost.

£1 per call is too much? Most people would only get a call once a year - THEY could easily change their maximum spend limit themselves (but obviously there would have to be a maximum to THAT limit, in case a fraudster phoned them and got them to 'up' their limit to make it easier for them to defraud them.)

theoldmiser

Zanderman said:

I do £1000+ transfers regularly, between my own accounts, several times a month. I would be mightily annoyed if the bank rang me every time. Banks would be phoning people al the time - £1000 transfers are not unusual at all.

I very much doubt banks haven't already thought through your scenario and dismissed it.  The key need is for the customer not to fall for the scam in the first place.  To take your example; banks don't ring to say your account is compromised, and even if they did why oh why would they not be able to merely freeze the account?  The bank have full control of the account at all times. Only a fraudster would tell you the account must be emptied!

Again - you could set your own maximum spend limit. Therefore you can set whatever amount you like.

And transfers between YOUR OWN ACCOUNTS are obviously not included in my proposal, because push payment fraudsters need to get the money out of your account and into theirs.

How often do you transfer £1,000 to OTHER PEOPLE, which is what I was talking about in the first place?

"The key need is for the customer not to fall for the scam in the first place."

But in reality, that isn't what is happening, thousands of people ARE falling for the scams in the first place, and my solution would easily stop most of this fraud.

I don't understand your final part. Is that a quote from me? If so, it helps if you put it in quotes.

I believe my solution would fix the problem. Whether you think the banks have thought through my scenario and dismissed it is irrelevant, because it's baseless conjecture, can you explain WHY they would have dismissed it? Then we are onto something.

eskbanker

theoldmiser said:
The current system isn't working, therefore it isn't a sensible compromise between security, convenience and cost.

Says who?

Zanderman

theoldmiser said:

eskbanker said:

Doesn't sound viable to me - I think you massively underestimate the frequency of significant transfers and the cost of banks having to resource phone calls for every such occasion.

The increasing prevalence of Confirmation of Payee (not perfect but workable for most) and the voluntary code under which the banks are on the hook for 'genuine' APP scams (i.e. where the customer hasn't been reckless or negligent) seem to me to be a sensible compromise between security, convenience and cost....

You don't think that it costs banks a huge amount of staff time to deal with push payment fraud AFTER it has occurred?

You don't think the banks have debated and analysed all sorts of ways of combatting fraud already, and what you're suggesting has been dismissed?

Apart from creating a huge new bureaucracy - actual and virtual - the primary flaw is that every fraudster would, if the default was £1000, set their fraudulent transfer at, say, £900 - and they'd all sail through. Then the limit might be lowered to 900 and they'd change to 800, and so on until the limit was laughably low.  It would, ultimately, be self-defeating as the trigger amounts involved would become trivial.

Mnoee

theoldmiser said:

eskbanker said:

Doesn't sound viable to me - I think you massively underestimate the frequency of significant transfers and the cost of banks having to resource phone calls for every such occasion.

The increasing prevalence of Confirmation of Payee (not perfect but workable for most) and the voluntary code under which the banks are on the hook for 'genuine' APP scams (i.e. where the customer hasn't been reckless or negligent) seem to me to be a sensible compromise between security, convenience and cost....

As I said... you could set your OWN MAXIMUM SPEND LIMIT.

You don't think that it costs banks a huge amount of staff time to deal with push payment fraud AFTER it has occurred?

How much are staff who phone up customers paid per hour? £12? Each phone call would take, say, five minutes (to be generous), and would therefore cost the bank £1 per call.

So if everybody was given a default maximum spend limit now, generated by a computer, based on their previous years' transactions, obviously there would not be a large number of such transfers.

Say I never spend more than £1,000 (I don't) on anything more than once a year. So my maximum spend limit would be £1,000.

The current system isn't working, therefore it isn't a sensible compromise between security, convenience and cost.

£1 per call is too much? Most people would only get a call once a year - THEY could easily change their maximum spend limit themselves (but obviously there would have to be a maximum to THAT limit, in case a fraudster phoned them and got them to 'up' their limit to make it easier for them to defraud them.)

So then the fraudsters start their phone call with 'increase your maximum spend limit to...'? 

theoldmiser

eskbanker said:

theoldmiser said:
The current system isn't working, therefore it isn't a sensible compromise between security, convenience and cost.

Says who?

The thousands of victims of push payment fraud, the police, and the banks who have to deal with all of this. If the current system was working, there would be no push payment fraud, at least, that's what I consider 'working' to mean.

I see you couldn't discuss anything else I wrote in answer to your objections...

Whatever amount you mean by "significant transfers" that are frequent - guess what - the BANKS know how often these amounts are transferred, and can set a limit - £1,000 was just off the top of my head, because most people's bank payments which are not their mortgage, are less than that amount. i.e. you go shopping, you don't spend £1,000 on food. You pay your electricity bill (guess what, this is normally done by direct debit so isn't even going to register in what I'm talking about) and it's less than £1,000. etc.

My idea would stop almost ALL push payment fraud, what exactly do you find wrong with it? Something more specific would be helpful. It could be a £2,000 limit, it would be up to the banks to set the initial maximum amount.

Teapot55

I think your idea sounds like quite good.

My bank’s software always asks me if it’s to someone I’ve paid before and then what sort of reason ie bill, family etc. They’re not asking questions that are too intrusive on my privacy and I think they’ve got the balance about right. 

Zanderman

theoldmiser said:

Zanderman said:

I do £1000+ transfers regularly, between my own accounts, several times a month. I would be mightily annoyed if the bank rang me every time. Banks would be phoning people al the time - £1000 transfers are not unusual at all.

I very much doubt banks haven't already thought through your scenario and dismissed it.  The key need is for the customer not to fall for the scam in the first place.  To take your example; banks don't ring to say your account is compromised, and even if they did why oh why would they not be able to merely freeze the account?  The bank have full control of the account at all times. Only a fraudster would tell you the account must be emptied!

I don't understand your final part. Is that a quote from me? If so, it helps if you put it in quotes.

If it was a quote it would be in quotes!

It was a reference to your example of fraud, where you were referring to fraudsters saying accounts are compromised and money should be moved to another account. 

I was merely pointing out that a bank would, fairly obviously, never say this.

Because if an account is 'compromised' they could freeze it - as they are, er, the bank.

Only a fraudster would suggest money should be moved to another account.

So anyone falling for that scam isn't really thinking it through. Why would a bank not be able to stop an account being used? Why would a bank ask you to move money?  Anyone suggesting that should happen is, obviously, a fraudster.