Which? has recently made the first super-complaint to the Payment Systems Regulator (PSR). It argues there are insufficient safeguards for consumers who are tricked into making "push" payments (sending money by bank transfer) to scammers. It says the risk of financial loss in this scenario currently rests solely with consumers, noting there are currently no legal protection s for consumers who lose money this way. Which? compares this situation unfavourably to the legal protections for other means of payment, such as the unauthorised transactions provisions in the Payment Services Regulations 2009 and s.75 of the CCA for credit cards. It suggests this leads to inconsistent outcomes for consumers.
Which? argues that banks are typically better placed than consumers to guard against fraud risks. On this basis, it argues for changes in the law, to incentivise banks to do more to protect consumers, suggesting the PSR will need to carry out a review or market study to ascertain the extent of the problem.
We expect the PSR will now thoroughly investigate the differences between push and pull payments. For example, in a card system, acquirers typically levy additional fees on suppliers that have significant chargeback requests - but merchants are able to switch away from them if this ultimately pushes up their merchant service charges. By contrast, the Which? proposal would ultimately have to be borne by all customers, with more risky customers cross-subsidising less risky ones. This also raises the issue of moral hazard – i.e. would consumers be less careful with their information if they knew that they were indemnified against loss.
The PSR will also need to consider whether any consumer harm it identifies is, in fact, appreciable. Which? says simply "it has not been possible to estimate a figure" – but regulatory intervention would be inappropriate without a well substantiated appreciable effect. Further, if (as Which? suggests) new payments models are going to drive an increased use of push payments, the PSR may be reluctant to intervene too early in the workings of an emerging market.
The scope of the supercomplaint is restricted to authorised push payments made by a consumer via bank transfer, through one or more of BACS, CHAPS or Faster Payments systems to the scammer's account. Which? notes it has "not been able to identify … significant evidence for detriment associated with the authorised debit card chargeback arrangements". However, given the "potential for questions over the effectiveness and consistency of such voluntary arrangements", the PSR considers "these arrangements should be considered for inclusion within the scope of the investigation of the issues raised in this supercomplaint."
We would expect the PSR to consider the extent to which the various "push" systems actually form part of the same market. In particular, the PSR will consider whether it is appropriate to treat the various systems as one, when it comes to assessing the alleged harm. Indeed, they are often used in different ways and for quite different purposes.
The PSR has 90 days to respond to the super-complaint from when it was filed in late September and it can take a number of actions. These include using its competition law powers, launching a market review, referring the complaint to another regulatory agency, taking regulatory action, or taking no action at all.