Fraud aimed at businesses

Draft resolution: the Business Fraud Standard

The Founders Assembly,

Recalling the Founders Charter and the Rules of Procedure of the Founders Assembly (RC/A/2026/2), and the Assembly’s agreed process for considering reported problems, testing patterns, consulting on proposed remedies, and adopting standards by ballot,

Recalling the call for evidence for agenda item FP-001 (RC/FP/2026/1), the Council’s interim pattern review on payment-diversion and invoice fraud (RC/FP/2026/N.1), and the Council’s certification that FP-001 satisfied the five-part pattern test (RC/FP/2026/N.2),

Noting the Council’s letters concerning changed invoices, payment-fraud reimbursement and recall times, including RC/FP/2026/20, RC/FP/2026/21, RC/FP/2026/22, RC/FP/2026/23 and RC/FP/2026/24,

Noting that, as at 29 September 2026, the Fair Play Council comprised 199 members from 42 countries and had received 606 reports from 47 countries; that the median amount at stake in those reports was approximately US$4,540; and that the reports described situations of fraud, with members representing businesses of different sizes, including sole operators and small teams,

Concerned that payment-diversion and invoice fraud can cause a small business to lose funds needed for wages, suppliers, tax and continued operation, and that the burden of discovering, reporting and pursuing a fraudulent transfer can fall on the business even when payment-system participants are better placed to verify account information and coordinate a rapid response,

Recognizing that the United Kingdom’s Payment Systems Regulator reimbursement protections for qualifying authorised push payment fraud claims took effect on 7 October 2024, provide for reimbursement of up to £85,000 per claim, and allocate the cost equally between sending and receiving payment service providers, while excluding international payments; and noting the published first-year evaluation reporting a 21 per cent decline in APP fraud and an increase in reimbursement from 54 per cent to 65 per cent,^[1][2]

Recognizing also that the European Union Instant Payments Regulation provides for verification of payee, with that requirement applying from October 2025, while noting that the sources cited do not establish comparable scheme details for every jurisdiction considered,

Affirming that a standard for business fraud should address the payment journey as a whole: prevention before execution, prompt action after a suspected fraud is reported, and a fair route to reimbursement where a qualifying business has been deceived into authorising a payment,

Emphasizing that the Standard is a proposed common baseline for adoption by banks and payment providers, and does not purport to displace applicable law, supervisory requirements or stronger protections already available to a business,

Resolves:

1. Adopts, subject to the Assembly’s ballot, the Business Fraud Standard set out in the annex to the present resolution;

2. Calls upon banks and payment providers serving business customers to implement the Standard through clear, accessible procedures for payee verification, fraud reporting, payment recall and reimbursement;

3. Calls upon payment providers participating in a payment to cooperate promptly with one another when a business reports suspected payment-diversion, invoice fraud, authorised push payment fraud or business email compromise;

4. Encourages providers to make the protections in the Standard available for domestic and cross-border business payments, subject to the allocation of responsibilities and practical arrangements set out in the annex;

5. Requests the Secretariat, following the Assembly’s decision, to transmit the adopted Standard to the chief executives whose seats are recorded by the Assembly and to report the status of each seat in accordance with the Assembly’s established tracking categories;

6. Invites banks, payment providers, business associations, public authorities and other interested parties to use the consultation process to identify operational, legal and cross-border issues requiring clarification before adoption;

7. Requests that implementation experience, including reported outcomes and material gaps in coverage, be considered in the review provided for in the annex.

Annex

Business Fraud Standard

Draft text for consideration with RC/FP/2026/L.1.

I. Purpose and application

1. The purpose of this Standard is to establish a clear minimum set of protections for small businesses that make payments through banks or other payment providers and are affected by payment-diversion or invoice fraud, authorised push payment fraud, or business email compromise.

2. The Standard is directed to banks and payment providers that provide an account, payment initiation, payment execution, receipt or related payment service to a business. It applies to the provider’s own role in a payment and requires cooperation with other providers involved in the transaction.

3. The Standard covers domestic and cross-border payments. A provider should not exclude a claim solely because the receiving account or another provider is located in a different country. Where a provider cannot itself determine or pay the full amount because another jurisdiction or provider is involved, it should explain the reason, pursue the available recovery and coordination steps, and identify any portion for which it remains responsible under applicable law or the Standard.

4. The Standard sets a common baseline. It does not limit a business’s rights under applicable legislation, regulation, contract or a more protective provider policy. Where those protections differ, the business should receive the protection that is legally applicable and more favourable to it.

5. Providers should apply the protections in a manner proportionate to the size and resources of the customer. A business should not be required to maintain a specialist fraud team, employ technical staff, or obtain legal representation in order to use the verification, reporting, recall or reimbursement process.

II. Definitions

1. Business customer means a person or entity using a payment service for a trade, profession or business activity, including a micro-enterprise or other small business. The term includes a business operated by one person.

2. Bank or payment provider means a bank, payment service provider, electronic money institution, payment initiation provider or other regulated or commercially operating provider that enables, executes, receives or facilitates a payment for a business customer.

3. Authorised push payment fraud means a payment initiated or approved by a customer who was deceived by a fraudster into sending money to an account controlled by, or for the benefit of, the fraudster. The fact that a customer technically approved the payment does not, by itself, establish that the customer knowingly intended to pay the fraudster.

4. Business email compromise means fraud in which an attacker impersonates, takes control of, or otherwise abuses a business or personal communications channel to induce a business to make or alter a payment. The fraudulent instruction may appear to come from a supplier, customer, employee, business owner or other trusted party.

5. Payment-diversion or invoice fraud means deception that causes a business to send funds to an account different from the account to which the business intended to pay, including through a false invoice, an altered invoice, a substituted bank account, or a fraudulent request to change payment details.

6. Payee verification means a service that checks the name or other identifying information supplied for a recipient against information associated with the account to which the payment is to be made, and returns a clear result before the payer authorises or completes the payment.

7. Recall means a request by the sending provider to stop, return or recover a payment after a customer reports suspected fraud. A recall request is not a guarantee that the receiving provider can recover funds already withdrawn or transferred onward.

8. Small business means a business that is a micro-enterprise or otherwise has limited staff and administrative capacity relative to larger commercial customers. For this Standard, the provider should assess eligibility using a simple, published process and should not require a business to prove a more demanding status than is necessary to apply the relevant protection.

III. Core obligations

1. Provide payee verification before payment. A provider that enables a business customer to initiate a payment should offer payee verification before the customer authorises the payment, where the provider has access to the information needed to perform the check. The service should compare the payee information entered by the customer with the account information available to the provider or through an interoperable verification service.

   The result should be presented in plain language and should distinguish, at minimum, a match, a close or partial match, and a failure to match or inability to verify. The provider should not present an inconclusive result as confirmation that the payee is safe. Where verification is unavailable, the provider should say so before the payment is made and should not imply that the payee has been independently verified.

2. Make verification usable for business payments. Payee verification should be available through the channels commonly used by the provider’s business customers, including online and mobile payment services where those services are offered. Providers should avoid design choices that make the warning difficult to notice, understand or act upon. A customer should be able to review the result and correct an entry before proceeding.

   Providers should not treat a customer’s decision to proceed after a warning, without further inquiry, as an automatic waiver of the protections in this Standard. The result of the verification and the customer’s decision may be considered as evidence, but a reimbursement decision must take account of the full circumstances of the fraud and the provider’s own performance of its obligations.

3. Maintain accessible fraud reporting. Each provider should give business customers a clear means to report a suspected fraudulent payment at any time when the provider’s payment service is available. The reporting route should be easy to find, should not depend solely on a telephone line that is open only during ordinary business hours, and should permit a customer to report a suspected fraud before all supporting documents are assembled.

   On receiving a report, the provider should promptly acknowledge it, record the time of receipt, give the customer a case reference, and explain the next steps and the information that may be needed. A provider should not delay an urgent recall request while waiting for a complete claim form or documents that are not reasonably available at that time.

4. Act promptly to recall and contain funds. When a provider receives a report that gives reasonable grounds to suspect payment fraud, it should promptly initiate a recall or equivalent request to the receiving provider and take any other available steps to prevent further movement of the funds. The sending provider should transmit the information necessary to identify the payment and explain that fraud is suspected.

   The provider should record when the report was received, when the recall request was sent, what response was received, and what further action was taken. It should keep the customer informed of material progress. Where funds have been recovered in whole or in part, the provider should return the recovered amount to the customer without avoidable delay and should explain any remaining shortfall.

5. Cooperate across providers and borders. A provider receiving a fraud alert or recall request should acknowledge it promptly, assess the request without avoidable delay, and take reasonable steps available to preserve funds and relevant transaction information. The sending and receiving providers should maintain a practical channel for urgent case communication, including outside ordinary local business hours where their payment services continue to operate.

   Providers should not refuse to act solely because the payment crossed a border, because the customer has not contacted the receiving provider directly, or because the first report was made to the sending provider. The sending provider should remain the customer’s primary point of contact unless the customer is clearly advised otherwise and given a direct, usable route to the other provider.

6. Provide reimbursement for qualifying fraud. A small business that has made a payment as a result of authorised push payment fraud, business email compromise, payment-diversion or invoice fraud should be eligible to seek reimbursement from its sending provider. A provider should assess the claim on its facts, including the means by which the fraud was carried out, the payee-verification service available at the time, the warnings given, the customer’s actions, the speed and adequacy of the provider’s response, and the possibility of recovery from another provider.

   Reimbursement should not be denied solely because the customer authorised the payment, the fraudster used a genuine or compromised communications account, the customer did not identify the fraud before making the transfer, or the receiving account was outside the customer’s country. Any ground for refusing or reducing reimbursement should be set out in a clear, reasoned decision that identifies the evidence relied upon and the review route available to the customer.

7. Set a fair and workable allocation of responsibility. Providers should establish arrangements to allocate the cost of reimbursement and recovery between the providers involved, taking account of applicable law, the role of each provider, the availability and use of payee verification, and the quality and speed of each provider’s response. Disputes between providers should not suspend the customer’s access to the claim process or be used as the sole reason to delay a decision.

   Where the available evidence does not establish that the customer acted fraudulently or with deliberate intent to obtain reimbursement improperly, a provider should not rely on a presumption that the customer caused the loss. The provider should explain what information it considered and give the customer a reasonable opportunity to correct an error or provide relevant facts.

8. Use a proportionate claims process. Providers should request only information reasonably needed to assess the claim, should accept information through accessible channels, and should allow a customer to explain the circumstances in their own words. A provider should consider evidence already held by it or exchanged with another provider rather than requiring the business to obtain duplicate records from third parties.

   Where an investigation is continuing, the provider should tell the business what remains outstanding and when it will next provide an update. A final decision should state the amount reimbursed, any amount not reimbursed, the reasons for that outcome, the evidence material to the decision and the route for seeking an internal review or other available remedy.

IV. Existing legal measures described in the dossier

The following table records only the jurisdictional information specified in the Council’s evidence as at 29 September 2026. It is a limited comparison, not a complete statement of the law in any jurisdiction and not a finding that the measures listed have identical scope or effect. Where the evidence before the Council does not establish details, the entry is stated as not specified rather than inferred.

V. Continuation

The annex continues in Part 2 with implementation arrangements, a proposed implementation timeline, monitoring and reporting provisions, and the review clause.

1.The provisions below complete the proposed arrangements for applying, monitoring and reviewing the Business Fraud Standard. They are intended to support consistent implementation by banks and payment providers while allowing for differences in payment systems, legal duties and operational capacity.

2.The Standard is a common baseline for action by institutions that endorse or implement it. It does not itself create a statutory duty, amend a contract, displace an applicable law or prevent a competent authority from adopting a stronger protection. Where domestic law provides greater protection, that protection shall continue to apply.

3.Implementation shall be assessed against the substance of the obligations in section III of the Standard, and not solely against the publication of a policy, the creation of a contact point or the execution of an endorsement. A provider may use existing systems and processes where they deliver equivalent or stronger results.

VI. Implementation arrangements

4.Each provider implementing the Standard should identify an accountable senior function with authority to coordinate fraud prevention, payment operations, customer support, complaints and reimbursement decisions. The provider should make an accessible contact route available for a small business reporting a suspected payment-diversion or invoice-fraud incident.

5.The contact route should permit urgent reporting outside ordinary business hours, or provide an alternative means of initiating an urgent recall where the primary route is unavailable. Providers should explain how a report can be made, what information is useful, and how the reporting business can obtain an acknowledgement and case reference. A process that depends exclusively on a business finding and contacting a particular employee should not be treated as an adequate reporting route.

6.A provider should maintain written procedures that enable staff to distinguish among a request to prevent a payment, a request to recall a payment already sent, a reimbursement claim and a complaint about the handling of any of those matters. Procedures should set out how the provider will act where a payment has crossed an institutional or national boundary, including how it will contact the receiving provider and communicate material updates to the reporting business.

7.Providers should give relevant staff role-specific instruction on common forms of business email compromise, payment diversion and invoice fraud; the use of payee verification; urgent recall procedures; and the treatment of claims involving small businesses. Training should be refreshed when material changes are made to the relevant process or when monitoring indicates recurring operational failures.

8.A provider should give a claimant a clear explanation of the information required to assess a claim. Requests for additional information should be limited to information reasonably relevant to the decision and should, where practicable, be consolidated rather than issued serially. The provider should take account of the fact that an incident may disrupt access to records, personnel or ordinary business operations.

9.Any decision to refuse or limit reimbursement should be communicated in writing, in language the claimant can reasonably understand. The explanation should identify the material facts relied upon, the relevant element of the provider’s policy or applicable law, the reasons that element is considered to apply, and any available internal review or external complaint route. A decision should not rely solely on a general description of the incident as “authorised” where the allegation is that the payer was deceived into making the payment.

10.Providers should maintain an internal review route for a claimant who disputes a decision, the amount reimbursed, the handling of a recall or the time taken to decide a claim. Review should be conducted by a person or function with authority to reconsider the evidence and outcome. The review route should not prevent the claimant from using any complaint, dispute-resolution or legal process otherwise available.

11.Providers should establish controls to avoid unnecessary repetition of evidence where more than one provider is involved. A business should not be required to resolve disagreements between sending and receiving providers before its report or claim can be considered. Where responsibility is disputed, the providers concerned should continue to cooperate on recall, evidence handling and communications, without prejudging the claimant’s rights under applicable law or the Standard.

12.Endorsement should be recorded in a manner that identifies the legal entity or entities covered, the relevant services, the effective date and any material limitation in scope. A provider should disclose a limitation in clear terms before an affected business relies on the endorsement. An endorsement should not be presented as applying to a service, territory or payment type that the provider has excluded.

13.Providers should notify the Secretariat of an endorsement, material change in implementation or withdrawal. The Secretariat may record the status as Proposed, Letter sent, Delivered, Replied, Signed or Empty chair, consistently with the Assembly’s seat-tracking practice. A record of correspondence or endorsement shall describe its status accurately and shall not imply that a provider has accepted the Standard where no acceptance is on record.

14.The Secretariat should make available a concise implementation checklist based on the adopted text, together with a reporting template and an explanatory note on the distinction between the Standard and applicable legal requirements. Any checklist or note should be administrative guidance and should not vary the substance of the Standard. A material change to the Standard itself should be referred to the Assembly through the applicable procedure.

VII. Proposed implementation timeline

15.The following timeline is proposed for planning purposes. The periods that run from adoption are relative periods; they do not presume a date for the Assembly ballot or represent a claim that the Standard has been adopted.

16.A provider that cannot meet a proposed period should identify the affected obligation, the reason for delay, the interim protection available to businesses and a dated plan for completion. A delay notice is not an exemption from an applicable law, nor does it establish that the provider has implemented the Standard.

17.The Secretariat may propose adjustments to these periods in light of consultation evidence or operational requirements. Any such proposal should distinguish changes to the implementation schedule from changes to the substantive obligations and should be referred to the appropriate Assembly process before being represented as part of the Standard.

VIII. Monitoring, reporting and transparency

18.Monitoring should establish whether the Standard is being implemented and how cases are handled. It should not treat the number of reports alone as a measure of provider performance or as proof that fraud has increased or decreased. Reports received by the Founders Assembly are evidence of experiences reported to it; they are not, without further verification and appropriate denominators, a complete measure of the incidence of fraud.

19.Providers implementing the Standard should maintain records sufficient to describe, in aggregate, the following matters, insofar as they are available and may lawfully be collected:

1. the number of suspected business-fraud reports received and the payment types and broad fraud categories involved;
2. the number of urgent recall requests initiated, the time between the report and the request, and the time to material response from the receiving provider;
3. the number of reimbursement claims received, decided, accepted in whole or in part, refused, withdrawn or pending;
4. the time from receipt of a sufficiently complete claim to decision, with elapsed time reported in bands as well as, where feasible, a median and a high-percentile measure;
5. the aggregate value claimed and reimbursed, reported in a manner that avoids identifying an individual business or transaction;
6. the number of cases involving a cross-border payment, where that information is available, and the stage at which any delay or unresolved issue arose;
7. the number and broad outcomes of internal reviews, together with the principal reasons for reversal or confirmation of an initial decision; and
8. the availability and use of payee-verification functionality, including the handling of a warning or mismatch where that information can be reported consistently.

20.Reporting categories should be defined sufficiently clearly to support comparison over time. Providers should state the period covered, the services and jurisdictions included, relevant exclusions, and any material change in data collection or classification. Where categories or systems change, a provider should explain the change and avoid presenting a discontinuous series as directly comparable without qualification.

21.The Secretariat should publish aggregate findings in a form that does not identify a claimant, a business, an account, a transaction or a natural person. Small cell sizes and combinations of attributes that could permit identification should be suppressed or combined. Information submitted for monitoring should be handled under applicable privacy, confidentiality and data-protection requirements; the Standard does not authorize disclosure that would otherwise be unlawful.

22.Public reporting should distinguish among data supplied by providers, information from member reports, consultation submissions and other evidence. It should state limitations, including missing data, differences in definitions and limits on cross-provider comparability. Where figures are based on a sample or incomplete return, that qualification should be prominent.

23.The Fair Play Council may compare implementation evidence with the pattern-review record in RC/FP/2026/N.1 and the certification of the pattern test in RC/FP/2026/N.2. Such comparison should be analytical and appropriately qualified. It should not imply that a change observed after implementation was caused by the Standard unless the evidence supports that conclusion.

24.As at 29 September 2026, the Fair Play Council’s internal record comprises 199 members from 42 countries and 606 reports from 47 countries; the median amount at stake is approximately US$4,540, and 126 reports were filed in the preceding 30 days. The reports concern fraud. These figures describe the Council’s evidence record and should not be represented as a prevalence estimate for all small businesses, payment providers or countries.

25.The Secretariat should report on implementation through the Assembly’s ordinary reporting arrangements. It should identify the number of providers that have signed, the scope of their stated commitments and the status of any outstanding invitations, while distinguishing a signed commitment from a response, discussion or delivery of a letter. No provider should be described as having replied or signed unless that status is supported by the Secretariat’s record.

IX. Review and amendment

26.The Fair Play Council should conduct an initial review 12 months after adoption, if adoption occurs, and submit its findings to the Assembly. The review should assess the operation of the Standard, not presume its success or failure. It should consider provider implementation, business experience, consultation evidence, available aggregate data, relevant legal developments and the practical treatment of cross-border claims.

27.The review should examine, in particular:

1. whether businesses can identify and use an urgent reporting and recall route;
2. whether payee-verification measures are available and whether warnings are communicated in a usable manner;
3. whether recall requests are made promptly and whether providers cooperate across institutional and national boundaries;
4. whether claim decisions are timely, reasoned and accompanied by an accessible review route;
5. whether reimbursement arrangements are understandable and do not leave a claimant without a route to decision solely because more than one provider is involved;
6. whether the Standard’s application to business email compromise, payment diversion and cross-border cases is sufficiently clear;
7. whether reported outcomes can be compared responsibly, given differences in legal regimes, service coverage and data definitions; and
8. whether any unintended effects, implementation barriers or gaps require clarification or amendment.

28.The Fair Play Council should invite evidence from providers, member businesses, relevant partners and other interested persons. It should protect the anonymity of members who have not chosen a public seat and should not identify a member’s business. Published case descriptions should use general descriptions, such as a large marketplace, a national retail chain or a payment provider, and should not attribute an allegation to a named company unless the information is independently established and publication is authorized.

29.The review should distinguish evidence of implementation from evidence of outcome. It should not infer that a provider has failed to comply solely because a business reports an adverse experience, nor should a provider’s policy statement alone establish that the intended protection is operating in practice. Where evidence is contested or incomplete, the review should state that limitation.

30.The Council may recommend clarification, an implementation tool or a proposed amendment. A material amendment shall be circulated for public consultation and submitted to the Assembly under its Rules of Procedure. Until an amendment is adopted, the existing adopted text, if any, remains the reference version. The Secretariat should maintain a dated record of versions and changes.

31.Nothing in the Standard prevents a provider from offering more protective terms, a public authority from imposing more protective requirements, or a business from pursuing a right or remedy available under applicable law. Nothing in this draft should be read as resolving questions of jurisdiction, liability or legal interpretation that are not determined by the laws applicable to a particular payment or claim.

32.The Assembly is invited to consider the draft following the consultation process and to determine, by the procedures established in RC/A/2026/2, whether to adopt, revise or decline the proposed Business Fraud Standard.