A consumer watchdog group has highlighted concerns over a “dangerous” fraud scheme where victims are tricked into approving card payments.
Which? warned that criminals are adopting tactics similar to those deployed in authorised push payment (APP) scams, in which individuals are manipulated into carrying out bank transfers.
While standard “authorised” scams typically rely on victims sending money directly from their bank accounts, Which? fears fraudsters are now also cashing in by coercing people into approving card transactions.
‘A critical wake-up call’
The consumer group described it as a “critical wake-up call” after years of security efforts being focused on fighting fraud involving bank transfers.
It said that, while unauthorised card fraud, where spending happens without the cardholder’s authorisation or knowledge, is generally refunded, and victims of APP fraud have the protections of a reimbursement scheme, some people who are manipulated into approving card payments to scammers may face more of a hurdle to get their money back.
If someone authorises a card payment directly to a retailer or trader they later discover is a scammer, they may be able to use methods such as chargeback or Section 75 to get a refund.
But Which? warned that people may struggle to claim for payments they have authorised to a legitimate company, even if the money ultimately ends up in the hands of a criminal.
open image in galleryIt said authorised card fraud victims can end up in a devastating situation, as the company has provided the intended services, albeit as part of a chain of fraud.
Which? said the chargeback and Section 75 refund mechanisms are primarily designed for unauthorised charges or issues such as non-delivery, faulty goods and misrepresentation.
Get a free fractional share worth up to £100.
Capital at risk.
Terms and conditions apply.
ADVERTISEMENT
Get a free fractional share worth up to £100.
Capital at risk.
Terms and conditions apply.
ADVERTISEMENT
What is APP fraud and how are consumers protected?
Meanwhile APP fraud, which has been under the spotlight in recent years, happens when people are tricked into transferring money to criminals for a variety of reasons, such as impersonation fraud, purchase scams, romance scams and investment scams.
In October 2024, mandatory APP fraud reimbursement rules came into force.
The rules mean banks must reimburse APP fraud victims, unless the customer has been grossly negligent.
The protections apply when a transfer is made to and from a UK bank account and a reimbursement limit of £85,000 has been applied under the rules, although banks can choose to go further than this and repay higher amounts.
Which? said that, like APP fraud, authorised card payments can also be a feature of romance scams, investment scams and criminals impersonating banks.
Lisa Webb, a consumer law expert at Which?, said: “This is a particularly dangerous scam since card payments fall outside of the automatic refunds that banks are obliged to provide for authorised push payments.
“Fraudsters typically cold call victims while posing as bank security staff, the police or the financial regulator, claiming the account is under attack and urging them to approve card payments or share one-time codes to ‘block’ or ‘reverse’ the supposed fraud.
“Always raise a claim with your card provider and escalate to the Financial Ombudsman Service if needed, providing full details of how you were manipulated into approving the payments.”
How do the scams take place?
Which? said a typical scenario may start with a cold call from a fraudster pretending to be from a bank’s security team, the police or a regulator.
They tell the victim their account is under attack.
People may be asked to move money to a “safe account” they hold with a different bank if, for example, the criminal believes that provider has weaker controls.
Scammers may have already stolen the victim’s card details and other data through phishing or a data breach.
They may trigger payments and ask the victim to approve them in their app, pretending this will stop fraud attempts.
They may also manipulate the victim into sharing one-time passcodes to add the card to their own digital wallet and go on a spending spree.
open image in galleryWhich? is calling on account providers to step up defences and publish further industry data on card fraud.
A UK Finance spokesperson said: “Fraudsters use a wide range of tactics to trick people, including impersonating banks and well‑known organisations to bypass security checks such as one‑time passcodes.
“Criminals often research their targets in advance, using details harvested from scams, social media and data breaches.
“We urge everyone to stay alert and never share sensitive information – including one‑time passcodes – with anyone other than a service you were expecting to hear from.
“If you receive an unexpected call from someone claiming to be your bank, hang up and call back using the number on the back of your debit or credit card.”
Patrick Hurley, ombudsman director at the Financial Ombudsman Service, said: “Being the victim of a fraud or scam can be deeply distressing, and sadly for many people the financial implications can be life-changing.
“The Financial Ombudsman Service continues to receive hundreds of cases a week from people who have been victims of fraud and scams.
“Anecdotally, we are seeing more cases where people inadvertently use their debit or credit card to pay a fraudster or are persuaded to initially move money to other accounts that are in their name. Those consumers may have less recourse under the rules and regulations.
“If a consumer has been a victim of a scam, they should speak to their bank first. If they don’t feel they’ve been treated fairly by their financial provider, they should get in contact with our free and independent service and we’ll see if we can help.”
A Financial Conduct Authority spokesperson said the regulator is aware of this type of scam and is discussing it with the industry.
They added: “We know the devasting impact that scams can have on individuals, and each case should be considered by firms on its own merits.
“People should be on alert if they’re contacted out of the blue, and particularly if they’re asked to transfer or send money. If you’re concerned, hang up.
“You can also contact us if you’re struggling to establish whether someone calling you is from a genuine financial firm.”