Call for Evidence: Fair Play Council Agenda Item FP‑001

Reseated — Fair Play Council

Document symbol: RC/FP/2026/1
Date: 10 February 2026
Kind: Note
Status: Circulated
Working title: Call for evidence: Fair Play Council agenda item FP-001
Author: Chukwudi Umeh, Chair, Fair Play Council; Lagos, Nigeria
Recipient: —

1. Purpose of this call

1.The Fair Play Council invites small-business owners to report experiences with payment fraud and the steps taken by banks, payment providers and other relevant services before and after a fraudulent payment. The Council is beginning evidence gathering for agenda item FP-001, provisionally concerned with business fraud and the practical protections available to small businesses.

2.The Council seeks evidence from owners in any country, operating in any sector and using any language. A report does not need to show that a provider broke a law. It may describe an attempted fraud, a successful fraud, a disputed transaction, an unsuccessful request for help, or a protection that worked. We are interested in what happened, what the owner could reasonably do, what the provider did, and what changed the outcome.

3.This call is not a finding that fraud is widespread, that a particular provider has acted improperly, or that one response is appropriate in every legal system. Reports will be assessed collectively. The Council will not publish a member’s name or business name unless that member affirmatively chooses a public seat and agrees to the relevant disclosure.

4.The Council’s purpose is practical: to determine whether there is a repeated and sufficiently corroborated problem, identify a change that could address it, and, if warranted, take that proposed change through consultation and an Assembly ballot. Only after an adopted text exists would letters be sent to the leaders of organisations able to implement it. This call does not prejudge that outcome.

2. What FP-001 is examining

5.The initial subject is fraud that causes, or plausibly could cause, a small business to lose money through a payment. The Council is particularly interested in authorised push payment fraud, where a payer is deceived into authorising a transfer, and business email compromise, where a criminal impersonates or takes control of a business or supplier communication channel to divert a payment. These descriptions are practical categories for evidence gathering, not determinations of legal liability.

6.Relevant experiences may include an invoice or bank-detail substitution; impersonation of a supplier, customer, employee or owner; a fraudulent request to change a payee account; a payment made to a lookalike or incorrectly identified recipient; delayed or unsuccessful recall of a transfer; an attempt to obtain reimbursement; or an account or transaction warning that did or did not help. Reports may concern domestic or cross-border transfers, bank transfers, payment accounts, cards or other payment arrangements.

7.The Council is interested in controls at several points in a payment journey. These may include checking whether a payee name corresponds to the account identifier; warning a payer about a mismatch; providing a clear way to pause or query a suspicious payment; enabling rapid contact after a payment; attempting recall without avoidable delay; sharing information between sending and receiving providers where lawful; and deciding reimbursement or other loss allocation in a way that is understandable and reviewable.

8.The Council is not assuming that every control can be applied in the same way to every payment. A transfer may be domestic or international, immediate or scheduled, initiated by a person or through a business system, and governed by

different rules. Reports should therefore state what kind of payment was involved when that information is known. If it is not known, say so; do not guess.

3. Legal reference points in the working dossier

9.The Council will consider reported experiences alongside the legal and operational frameworks that apply to them. The comparison at this stage is limited to the reference points recorded in the working dossier. It is not a complete survey of national law and is not legal advice. A member should not delay reporting because they are unsure which law applies.

10.In the United Kingdom, the Payment Systems Regulator’s authorised push payment reimbursement protections took effect on 7 October 2024. The protections described in the dossier provide for reimbursement of eligible claims up to £85,000, cover consumers, micro-enterprises and charities, and divide the reimbursement cost equally between sending and receiving payment service providers. International payments are excluded from that regime.¹

11.That framework is relevant evidence, but it does not answer every question FP-001 raises. In particular, eligibility boundaries, the handling of cross-border payments, and the practical speed and accessibility of a claim process may matter to owners. The Council asks members to describe what applied in their own case, rather than to infer that the UK approach governs a transaction elsewhere.

12.The dossier also records the EU Instant Payments Regulation as requiring verification of payee from October 2025. Payee verification is a preventive reference point: it concerns checking the relationship between the payee details and the intended recipient. It is distinct from a general promise to reimburse every loss. The Council will seek evidence about the availability, presentation and effect of such checks where relevant, without assuming that a member’s transaction was covered or that a check was offered.

13.A first-year evaluation of the UK reimbursement requirement reported that APP fraud fell by 21% and the reimbursement rate rose from 54% to 65%.² Those figures provide context for examining whether reimbursement arrangements

can affect outcomes. They do not establish the cause of any individual member’s loss, and they should not be treated as a prediction for other countries, payment types or periods.

14.Members may describe other national rules, codes, contractual terms or provider policies that affected their experience. Please identify the country and, if known, the name or type of the rule. The Council will distinguish a member’s account of what they were told from a verified statement about the law. Do not include confidential legal advice or documents you are not entitled to share.

4. Questions for business owners

15.Reports can be brief or detailed. The questions below are prompts, not a compulsory form. A member may answer only the questions they can answer safely and accurately. “I do not know” is useful information where a process was unclear.

A. The business and payment context

1. In which country did the business operate at the time, and where was the payment account or provider located, if known?
2. Was the business a sole trader, partnership, company, cooperative or another form? What was its approximate size, such as the number of people working in it? Do not identify the business.
3. What type of payment was involved, and was it domestic or cross-border?
4. Was the payment made by the owner, an employee, an accountant or another authorised person?
5. Was the payment connected to an invoice, purchase, payroll, supplier relationship, customer refund or another business activity?

B. The event and the warning signs

1. What happened, in sequence, from the first suspicious contact or instruction to the discovery of the fraud?

2. How did the instruction reach the business: email, messaging service, telephone, platform, paper document or another route?

3. Did a person appear to be impersonating a known contact, or was an existing account or communication channel compromised?

4. Were bank details or other payment instructions changed? If so, how was the change presented and checked?

5. Did a provider show a payee-name check, warning, confirmation screen or other intervention? What did it say, and at what point in the process?

6. Was there a suspicious mismatch, unusual request, urgency or other warning sign? What information was available to the person who authorised the payment?

C. Contact, recall and outcome

1. When did the business first contact its bank or payment provider after suspecting fraud? How did it make contact?
2. Was the payment recalled, blocked, frozen, traced or otherwise acted upon? If so, when and with what result, to the extent known?
3. Did the provider explain what it would do, what information it needed, and how long the next step might take?
4. Did the business seek reimbursement or another form of redress? What was the response, and how long did it take?
5. What was the amount at stake, and what amount, if any, was recovered or reimbursed? A range is acceptable. Do not provide account numbers or transaction references.
6. Did the outcome affect the business’s ability to pay wages, suppliers, rent, tax or other obligations? Describe the effect without identifying individuals unnecessarily.

D. What would have helped

1. What could have prevented the payment, or made the business more likely to notice the fraud?

2. Which action by a bank, payment provider, receiving provider, business platform or other service would have made the most difference?

3. Was any support effective? Please identify the useful step as well as any failure or delay.

4. What should a fair and workable process do for a small business after a suspected fraudulent payment?

5. Would the proposed improvement work in your country and payment system? What practical or legal limitation should the Council examine?

5. What counts as evidence

16.Evidence includes a first-hand account, a dated record, a document, a process description, or a careful explanation of how the member knows what happened. A report can be considered even if no document is available. Small businesses may not retain every message or receive a detailed explanation from a provider. Lack of paperwork does not automatically make an account irrelevant.

17.Where safe and lawful, useful supporting material may include a redacted payment confirmation, a provider’s written explanation, a complaint or recall timeline, a redacted invoice, a screenshot of a payee warning, or a dated sequence of events prepared by the owner. Please remove names, addresses, account identifiers, card numbers, passwords, authentication codes, security answers, private keys, and any information that could enable access to an account.

18.Please distinguish what you directly saw or did from what another person told you, what you infer, and what remains uncertain. For instance, a member may know the date a payment was sent but may not know whether the receiving account was frozen. That distinction helps the Council assess corroboration without discounting useful detail.

19.The Council does not need a complete forensic investigation. Do not attempt to contact a suspected fraudster, access another person’s account, obtain information unlawfully, or put yourself or another person at risk to strengthen a

report. If an incident is ongoing, use the appropriate emergency, law-enforcement, bank or provider channels in your jurisdiction. Reporting to Reseated is not a substitute for those steps.

20.A report about an attempted fraud can be valuable even where no money was lost. It may show that a warning, staff procedure or provider control prevented a loss. Conversely, an apparently successful control may have imposed a serious delay or burden. The Council invites both kinds of evidence so that the eventual analysis is not limited to cases where money disappeared.

6. Privacy, anonymity and safe handling

21.Members are anonymous unless they choose a public seat. In public documents, the Council will refer to practices and service categories, not identify a member’s business. An account may be described in general terms such as “a small retailer”, “a service business” or “a business owner in West Africa”. Members must not name their own business in a report intended for public use.

22.Do not name a suspected fraudster, a provider employee, a customer, a supplier or another private individual in the narrative unless the Council specifically requests information through a safe channel and explains why it is needed. For public-facing summaries, provider and company names will not be used to accuse a company on the basis of an individual member’s account. The Council examines practices and patterns; it does not turn a single report into a public allegation.

23.If you provide supporting documents, redact information that is not necessary to understand the event. In particular, never send passwords, one-time codes, recovery phrases, full payment-card details or login credentials. Do not forward suspicious links or executable files. If you are uncertain whether a document is safe to share, submit a text description first and ask for guidance.

24.A member may ask that a report be treated without identifying details. The Council will limit its use of identifying information to the work of receiving, checking and analysing the report. Where a detail might make a member identifiable even without a name, it may be omitted or generalised in

summaries. The Council will not promise confidentiality beyond what its actual systems and applicable obligations can support; members should not submit information they cannot safely disclose.

25.The Council may ask a follow-up question to clarify a date, payment type, sequence or outcome. A member may decline to answer. Where a report contains information that appears inconsistent or incomplete, the Council may record that limitation rather than seek further information. No member is required to provide evidence that could compromise personal safety, a live investigation or a legal position.

7. How reports are counted

26.The Council uses a five-part pattern test before deciding whether an issue should move toward a draft fix. The tests are Volume, Frequency, Consistency, Spread and Corroboration. Passing the pattern test means the evidence is substantial enough to justify developing a proposal; it does not mean that every report is independently verified, that a named party is responsible, or that the proposed fix has been adopted.

1. Volume: how many distinct reports describe the issue, and how much evidence is available about the practical consequences?
2. Frequency: how often does the issue occur relative to the relevant activity, time period or reported opportunities for it to occur?
3. Consistency: do separate accounts describe a recognisable common problem, or are the apparent similarities misleading?
4. Spread: does the issue arise across different countries, sectors, business sizes, payment routes or provider types?
5. Corroboration: do independent accounts, records or other reliable material support key parts of the pattern?

27.A report is not counted as a separate incident merely because it contains several documents or is submitted more than once. The Council will seek to identify duplicate submissions and, where possible, distinguish multiple affected

payments from multiple reports about one event. A person who reports on behalf of a business will not automatically be treated as several independent witnesses.

28.The Council records the information available, including the country and the nature of the reported situation, but will not fill missing fields by assumption. Amounts may be recorded as ranges where precise figures are not necessary or safe. Reports with no monetary loss can still contribute to analysis of attempted fraud and effective prevention. A low number of reports is not proof that a problem does not exist; it may reflect barriers to reporting or the limits of this call.

29.Corroboration is assessed in proportion to the claim. A dated provider message may confirm that a request was made, but not necessarily establish the reason for a decision. Several reports from different members may support a recurring account of a process, but do not prove that every provider uses that process. The Council will state uncertainty and gaps rather than convert a reported experience into a general fact.

30.At the start of this call, Reseated has 20 members in 18 countries and has received five reports from five countries across the Assembly. Four reports are recorded under the Platform Council and one under the Cashflow Council. The Fair Play Council has three members from three countries and has received no reports from any country. These are the figures available on 10 February 2026; they are not a finding about the prevalence of fraud. This call begins evidence gathering for FP-001.

8. From evidence to a possible fix

31.The process for each problem is reports, the five-part pattern test, a draft fix, public consultation, an Assembly ballot, and letters to the chief executives who can adopt the resulting proposal. Each stage has a distinct purpose. Evidence gathering establishes what members report; consultation tests whether a proposed response is workable; the ballot determines whether the Assembly adopts it.

32.If the evidence supports further work, the Council may prepare a draft that identifies the problem, the practices it seeks to change, the organisations that could implement the change, and the expected safeguards or limits. A draft may ask, for instance, whether payee-name verification, rapid recall procedures, accessible claims handling or a reimbursement approach should be considered. These are questions for evidence and deliberation, not decisions made by this call.

33.Public consultation would allow owners, providers, specialists and other interested participants to comment on the proposed text. The Council would consider the substance of those comments and explain revisions. The Assembly would then vote under its procedures. Only an adopted standard would be sent to relevant chief executives for consideration. A letter sent, delivered, replied to or signed is a separate status; no reply or commitment is presumed.

34.The Council has not set a completed draft, consultation period, ballot date or implementation deadline in this note. The next stages depend on evidence and the Assembly’s process. Any timetable will be communicated through Reseated’s official channels. Members should submit evidence because it is useful to the inquiry, not because the Council has promised a particular outcome or deadline.

9. Taking part from any country and language

35.A member may submit a report in the language in which they can describe events most accurately. Do not hold back because English is not your first language or because a document uses unfamiliar payment terminology. If possible, include the original wording of a provider message alongside a plain explanation. The Council may arrange translation or clarification as its capacity permits; it will not silently treat a translation as an exact quotation where the wording is uncertain.

36.Reports may concern a business in any country, including a cross-border transaction involving providers in more than one jurisdiction. State the relevant country or countries if known. If a country, provider location or payment rail is

uncertain, mark it as unknown. The Council will consider whether the same practical issue appears across different legal settings, without assuming that a single rule can be applied worldwide.

37.Owners may report directly or seek help from a trusted person to explain an event. If someone else prepares a report, the account should identify, in general terms, whether the writer experienced the event directly or is assisting the person who did. The affected owner should decide what can be shared wherever that is practicable.

38.The Council welcomes evidence from businesses that suffered a loss, businesses that recovered funds, businesses that stopped a payment, and businesses that received no clear answer. It also welcomes evidence from owners who have not personally experienced fraud but have used a relevant warning or verification process. Please make clear whether the account is a direct experience, an observed procedure, or a general view.

10. Submission checklist

39.Before submitting, consider whether your report explains the event in order, identifies the kind of payment and country where known, distinguishes what you know from what you infer, and describes the response and outcome. Include only documents that are safe and lawful to share. Remove account details, security credentials and unnecessary personal information.

40.Do not name your business. Do not assume that a provider’s explanation establishes the full legal position. Do not make a public accusation based solely on a suspected fraud or an unresolved claim. A report should help the Council understand a practice and its consequences, not expose a member or another person to unnecessary risk.

41.The Council is seeking evidence, not a particular conclusion. A useful report can describe a failure, a successful intervention, a confusing process, a difference between countries, or a practical limit on a proposed safeguard. The more accurately the evidence reflects what happened—including

uncertainty and what worked—the better the Council can assess whether FP-001 warrants a draft fix.

11. Closing

42.Payment fraud can place a small business’s cash, time and ability to meet ordinary obligations at risk. The Council will examine those consequences carefully and will not treat a single story as proof of a general pattern. It will also not dismiss a repeated practical problem merely because each affected business has limited records or operates under different local rules.

43.Owners are invited to contribute what they can, in the language and level of detail that is safe for them. The Fair Play Council will use the reports to test whether the issue is sufficiently voluminous, frequent, consistent, widespread and corroborated to justify a proposed response. The decision to draft, consult and seek an Assembly ballot will follow the evidence and the established process.

Sources

1. Payment Systems Regulator, “APP fraud reimbursement protections.”¹
2. Grant Thornton, “APP fraud reimbursement requirement: were industry’s concerns justified?”²

Notes and sources

Sources

1. Payment Systems Regulator, APP fraud reimbursement protections
2. Grant Thornton, APP fraud reimbursement requirement: were industry’s concerns justified?