Certification of the Pattern Test for FP‑001: Business Fraud

Subject: Certification of the pattern test for FP-001

1. Purpose and conclusion

1.This note records the method and findings used to certify whether the Fair Play Council’s FP-001 issue—business fraud involving payment diversion and invoice fraud—passes the five-part pattern test. It is based on Reseated data recorded as of 8 September 2026, and on the external material identified in the sources. It is a pattern-screening note, not an audit of individual reports, a determination of liability, or a finding about any named bank, payment provider or business.

2.The conclusion is that FP-001 meets all five screening tests: Volume, Frequency, Consistency, Spread and Corroboration. The conclusion is sufficient to proceed with drafting and consultation under the Assembly’s process. It does not establish that every report is accurate, that every report describes the same mechanism, or that any proposed intervention will be effective in every jurisdiction.

3.The Council’s records show 509 Fair Play reports from 47 countries. The median amount at stake is approximately US$4,402. There were 117 reports in the 30 days preceding the data cut-off. The records classify all 509 reports under the broad situation label “fraud”. That is a strong signal of a recurring area of harm, but the records do not provide a complete breakdown by fraud subtype, calendar month or region. Those limits are material and are stated below.

2. Method and threshold design

4.The five-part test is used to distinguish a recurring, sufficiently evidenced practice problem from an isolated report or a claim that remains too unclear to take forward. The tests are applied to the issue at the level supported by the records. For this note, the issue is business fraud in payment and invoice activity,

considered broadly; it is not a claim that all reported cases share a single transaction path.

5.No numerical thresholds for the five tests are specified in the Secretariat record. The thresholds below are therefore explicit operational screening thresholds adopted for this note. They make the judgment reviewable and reproducible against the figures in the Council’s records. They are not represented as a previously adopted Assembly rule, a statistical test of significance, or a universal standard for all future issues. The Assembly may revise or supersede them through its procedures.

6.The unit counted is a filed report. The Council’s aggregate records do not establish that each report concerns a unique incident, business, payer, recipient or payment provider. Reports are treated as evidence of reported experience, rather than verified findings. Percentages are calculated from the figures in the Council’s records and rounded where appropriate.

2.1 Volume

7.Threshold: at least 100 reports classified within the issue being assessed. The threshold is intended to require a material body of reports while remaining a screening threshold rather than a claim of population prevalence.

8.Finding: 509 Fair Play reports are recorded, and the situation count in the Council’s records assigns 509 reports to fraud. The reported median amount at stake is approximately US$4,402.

9.Result: Met. The total is more than five times the stated threshold. The result is based on the report count and broad situation label; it does not imply that the 509 reports all involve the same fraud method or that the amount at stake is a verified loss in each case.

2.2 Frequency

10.Threshold: either at least 10 per cent of the issue’s accumulated reports are filed in a recent rolling 30-day period, or evidence establishes recurrence across at least three calendar months. The first route tests current reporting activity; the

second allows a longer time series to establish recurrence where a rolling window is not sufficient.

11.Finding: 117 reports were filed in the 30 days preceding 8 September 2026, out of 509 total reports. This is approximately 23 per cent of the total. The Council’s records do not include a complete calendar-month series.

12.Result: Met under the rolling-window route. The recent-window count is above the 10 per cent threshold. This finding concerns the timing of reports received, not necessarily the timing of the underlying incidents. It also does not establish whether reporting activity was evenly distributed across those 30 days.

2.3 Consistency

13.Threshold: at least 80 per cent of reports must fall within the same recorded broad issue category. This test is deliberately applied to the broad classification in the Council’s records; it cannot certify consistency of a more detailed mechanism unless those details are coded and reported.

14.Finding: the situation data in the Council’s records list 509 fraud reports out of 509 Fair Play reports. On that classification, 100 per cent fall within the same broad category. Earlier Fair Play work has described the agenda item as payment-diversion and invoice fraud, but the aggregate in the Council’s records does not state how many of the 509 reports fall into each of those subtypes.

15.Result: Met at the broad-category level. The finding is not a claim that the incidents are operationally identical. The current evidence does not permit a quantitative consistency finding about changed-invoice requests, business email compromise, authorised push payment, impersonation, the point of payment, or the recovery process separately. Coding and publication of those subcategories should be part of the next evidence step.

2.4 Spread

16.Threshold: reports must come from at least 10 countries. This geographic threshold tests whether the issue is reported beyond a single national setting. It does not by itself prove

regional representativeness or that the same legal and payment arrangements apply in each country.

17.Finding: Fair Play reports came from 47 countries. The eight countries with the largest reported counts are listed in table 1. The remaining 228 reports are from the other 39 countries, in aggregate; individual counts for those countries are not recorded in the Secretariat’s records.

18.Result: Met. The total of 47 countries exceeds the threshold. A regional distribution cannot be calculated from the country data in the Secretariat’s records, so the finding is country spread only and should not be read as a region-by-region comparison.

2.5 Corroboration

19.Threshold: at least two independent external evidence streams must support the existence or materiality of the broad issue, with at least one documenting a relevant institutional response or rule and another providing an evaluation or outcome measure. External evidence is used to corroborate the policy relevance of the issue class, not to verify individual member reports.

20.Finding: the UK Payment Systems Regulator’s published information describes reimbursement protections for certain authorised push payment fraud claims. Since 7 October 2024, the scheme provides for reimbursement of eligible claims up to £85,000; its scope includes consumers, micro-enterprises and charities, and the cost is split equally between sending and receiving payment service providers. International payments are excluded.[1] A first-year evaluation reported that APP fraud fell by 21 per cent and reimbursement increased from 54 per cent to 65 per cent.[2]

21.Result: Met for the broad proposition that APP fraud is a material policy issue for which institutional rules and measured outcomes exist. These external sources do not corroborate the accuracy of Reseated’s 509 reports, establish the prevalence of business email compromise, or resolve the treatment of cross-border business payments. The stated limits of the UK scheme make the cross-border question a continuing policy gap, not a finding that the same protection applies internationally.

3. Data tables

22.Tables 1 to 5 reproduce the disaggregations recorded in the Secretariat’s records as of the cut-off. The country residual is calculated by subtracting the eight recorded country counts from the total. The residual is not a distribution among the 39 countries.

Table 1. Reports by country

Table 2. Reports by region

Table 3. Reports by situation

Table 4. Reports by team size

Table 5. Reports by month or reporting window

4. Interpretation and limitations

23.The evidence supports taking FP-001 forward because the reports are numerous, recent reporting is substantial, the broad situation classification is consistent, the reports span many countries, and external policy material confirms that APP fraud and reimbursement are established matters of institutional concern. In combination, these findings satisfy the stated screening thresholds. They do not establish a global rate of business fraud or allow comparison of risk between countries.

24.The Fair Play Council had 183 members from 42 countries. The 509 reports came from 47 countries. These are different measures: members are people seated in the Council, while reports record submissions. The report count should not be described as 509 members, 509 businesses, or 509 confirmed incidents. The Secretariat’s records do not allow a reliable count of unique affected businesses or a calculation of the share of all small businesses affected.

25.The median amount at stake, approximately US$4,402, is a useful indicator of the scale reported by members, but its interpretation is limited. The Secretariat’s records do not specify whether amounts are claimed losses, attempted payments, funds temporarily unavailable, amounts recovered, or a mixture. The median is not an average, and it does not describe the distribution or maximum amount. Future reporting should define the amount field and distinguish attempted, transferred, recovered and unrecovered funds where members can safely provide those details.

26.The situation label “fraud” is broad. It cannot establish that every report concerns a payment that the payer authorised under deception, that every case involves business email compromise, or that a changed invoice was the mechanism. Nor can it distinguish a fraudulent instruction from a dispute over performance, a mistaken payment or another event without more detailed review. The consistency test is therefore satisfied only at the recorded broad-category level. The next coding round should preserve that qualification in any public summary.

27.Country spread is clear in the aggregate records, but the country counts are uneven and only the eight largest are itemised. The remaining 228 reports are recorded only as a combined residual across 39 countries. The table does not support ranking those countries, attributing a cause to a national payment system,

or inferring regional prevalence. The absence of regional data also means that geographic reach should not be overstated as balanced representation.

28.The recent 30-day figure demonstrates continued report intake, but there is no complete month-by-month series in the Secretariat’s records. It is not possible to assess seasonality, changes in underlying incident frequency, the effect of public awareness activity, or whether reporting increased after a particular event. A rolling 30-day count can be affected by when members submit reports as well as when incidents occur. It should be used as a frequency signal, not as a trend estimate.

29.External corroboration is similarly bounded. The UK reimbursement framework is jurisdiction-specific, has eligibility conditions and excludes international payments. The first-year evaluation supplies a reported outcome for that framework, not a causal finding about each feature or a forecast for other payment systems. These sources support the relevance of reimbursement and related controls as subjects for policy work. They do not establish that any named provider has failed to act, and this note makes no such allegation.

30.The threshold design also has limits. The numerical cut-offs are transparent screening choices for this certification, not a substitute for substantive review. A threshold can indicate that an issue deserves further consideration; it cannot determine the best policy response. In particular, the broad consistency threshold should not be carried forward to more specific claims unless evidence is coded at the corresponding level of detail.

5. Next steps

31.The Fair Play Council should retain the five findings and their qualifications in the FP-001 evidence record. The certification supports the next procedural stages: draft a proposed standard, publish it for consultation, consider consultation evidence and present the resulting text for Assembly ballot. This note does not itself adopt a standard or authorize a letter to a CEO or public authority.

32.For the next evidence update, the Council should seek a safe, consistent breakdown of reports by mechanism, including payment diversion, changed invoice details, business email compromise and other fraud descriptions where identifiable. Coding should distinguish a member’s description from a verified classification. It should also record whether a payment was attempted or completed, whether it was domestic or cross-border, when the incident occurred, when it was reported, whether a recall was requested, how quickly that request was handled, and whether funds were recovered. These fields should be optional where disclosure could create risk or identify a member.

33.The Secretariat should publish calendar-month counts in future updates, with the cut-off date and any changes in coding stated. A regional table should be prepared only when country-to-region coding has been documented and applied consistently. Country-level publication should continue to respect members’ anonymity and should not expose an individual report or business. Small cell counts should be handled cautiously to reduce the risk of identification.

34.Consultation should test whether the proposed measures address different stages of the payment-diversion problem: checking a payee name before payment; making a rapid recall request possible after a suspected fraudulent transfer; setting clear responsibilities for responding to that request; and considering reimbursement for eligible small businesses, including in cross-border cases. These are the policy questions associated with FP-001, not findings that a single measure will resolve every case.

35.Consultation materials should state clearly that the external UK evidence is a case of a national approach, not a global entitlement. They should invite evidence on legal authority, payment-system design, fraud reporting, cross-border coordination and the practical position of small firms. Responses should be assessed alongside member reports and the limits recorded in this note.

36.On that basis, the Rapporteur certifies that FP-001 passes the five-part pattern test as of 8 September 2026. The certification is limited to the issue class and information described here. It should be revisited when additional evidence materially changes the report base, the coding of incident types, or the understanding of the proposed remedies.

Sources

[1] UK Payment Systems Regulator, information for consumers on APP fraud reimbursement protections.

[2] Grant Thornton, first-year evaluation of the APP fraud reimbursement requirement.

Notes and sources

Sources

1. UK Payment Systems Regulator, APP fraud reimbursement protections
2. Grant Thornton, APP fraud reimbursement requirement: were industry's concerns justified?