Opinion on FP‑001: Make Recall Timely and Cover Mobile‑Money Transfers

RC/FP/2026/OP.5
19 October 2026
Opinion — amendment

To the members of the Fair Play Council

Who I am and what happened

I am Achieng Owuor, Rapporteur of the Fair Play Council, writing from Nairobi, Kenya. I support the purpose of FP-001: a small business should not be left alone to absorb a payment fraud loss simply because it authorised a transfer after being deceived. I submit this opinion as an amendment because the draft should say more clearly what happens after a business reports fraud, how quickly payment providers must act, and which payment channels are covered.

I have seen how a payment instruction can appear ordinary until it is too late. A supplier’s payment details are changed in a message that looks consistent with an existing exchange. A business owner, working under time pressure, sends the payment to the account provided. The recipient is not the intended supplier. By the time the mistake is recognised, the money has moved onward or the receiving institution has not yet been alerted. The business owner calls the sending provider, explains that the payment was induced by deception, and asks for the transfer to be stopped or recalled. The answer depends on who receives the call, what information is available, and whether another institution responds in time.

I do not describe this as a failure of care by the business owner. A person can authorise a payment and still be deceived about its purpose or destination. Nor should the word “authorised” end the inquiry. The important questions are whether the payment was fraudulently induced, whether a prompt report was made, whether the providers took

reasonable steps to trace and recover funds, and whether the loss should be shared or reimbursed under a fair rule.

For a small business, the consequence is not abstract. Funds intended for wages, stock, rent or a supplier may be gone. Owners may spend hours repeating details to different institutions while trying to keep daily work moving. A standard that says providers should act quickly is a useful start, but it does not give a business a dependable measure of what “quickly” means. And if the payment travelled through mobile money, the standard must not leave room for a provider to say that a transfer was outside its scope.

What the evidence shows

The Fair Play evidence record, as of 19 October 2026, contains 686 reports from 49 countries, submitted by 209 Fair Play Council members from 42 countries. The median amount at stake is approximately US$4,498. Reports in the last 30 days numbered 124. These figures describe the evidence submitted to Reseated; they are not an estimate of the prevalence of fraud in any country or the total losses of all small businesses.

The reports come from businesses of different sizes. Of Fair Play members reporting team size, 41% said “Just me,” 39% reported teams of 2–9, 14% reported teams of 10–49, and 6% reported teams of 50–249. The country counts among reports were: United Kingdom 100, United States 91, Nigeria 39, Canada 35, India 33, South Africa 31, Kenya 31 and Brazil 21. The record is international, and the practical systems through which businesses send money are not limited to one type of bank account or one national payment rail.

Across the Assembly, 1,739 members were seated in 49 countries, and 5,331 reports had been filed from 50 countries. The council counts were Platform 1,961; Cashflow 1,347; Fair Play 686; Trade 517; Resilience 350; Red Tape 298; and Team 172. The Fair Play reports therefore sit within a broader record of small-business experiences, while remaining a distinct evidence set about fraud and payment loss.

These numbers support two practical conclusions. First, the reported amount at stake is material to a small enterprise, even though it may not be large by the standards of a financial institution. Second, a standard that is intended to work across countries must

be clear about its operational duties, not simply its aspiration. A firm deadline for the first response and for the key recovery steps gives the sending provider, receiving provider and business a common expectation. Explicit coverage of mobile-money transfers prevents a widely used payment channel from falling into a gap between rules designed for bank transfers and the payment methods businesses actually use.

The Council has already documented payment-diversion and invoice fraud in its interim pattern review, certified the FP-001 pattern test, and opened consultation on the draft Business Fraud Standard. The Council has also written on recall speed, reimbursement for small businesses and international payments, and verification of payee for business payments. I ask that this opinion be considered as part of that continuing record rather than as a separate complaint about one transaction or one provider.

How the law in my country and elsewhere handles it

My proposal is for a common standard that can be used by providers and regulators in different jurisdictions, including where domestic law does not set a clear, enforceable time limit.

The United Kingdom provides a relevant case of a defined reimbursement framework. Since 7 October 2024, the UK Payment Systems Regulator’s APP reimbursement protection has provided for reimbursement of eligible claims up to £85,000. The protection covers consumers, micro-enterprises and charities; the cost is split 50:50 between sending and receiving payment service providers; and international payments are excluded. ¹ The exclusion matters for this proposal: a business can be exposed to a cross-border loss even where a domestic framework offers protection for an eligible domestic payment. FP-001 should state directly that its standard applies to cross-border payments, subject to the conditions in the standard, rather than leaving that question to implication.

The first-year evaluation cited in the Council’s records reported that APP fraud fell by 21% and the reimbursement rate rose from 54% to 65%. ² Those results do not prove that a particular reimbursement design will produce the same effects in every country, nor do they settle the proper allocation of every loss. They do show that a defined framework can be evaluated against measurable outcomes. A standard with a deadline for action and reporting can likewise be assessed: whether providers acknowledged

reports on time, contacted counterpart providers, attempted recovery, and gave businesses a reasoned outcome.

In the European Union, the Instant Payments Regulation requires verification of payee from October 2025. ^[3] Verification before payment and recall after suspected fraud are different safeguards. A name check may help a payer identify a mismatch before sending funds, but it cannot ensure that every deceptive instruction is detected or that money can be recovered after a payment has gone through. The standard should therefore treat verification, prompt reporting, recall and reimbursement as complementary steps, not alternatives.

These cases are not a claim that one jurisdiction’s rules should be copied word for word everywhere. They show that the questions raised by FP-001 are already being addressed through specific policy choices: who is protected, which payments qualify, how losses are allocated, and what safeguards apply before or after payment. The Council’s standard should be equally explicit about its own scope and operational duties.

The strongest argument against my view and my answer

The strongest argument against binding recall deadlines is that a payment provider cannot guarantee recovery. Funds may be transferred onward before a report is received; institutions may operate in different time zones; records may be incomplete; and a receiving provider may be unable to freeze money without a legal basis. A strict deadline could therefore be said to impose an obligation to achieve an outcome outside the provider’s control. The strongest argument against including mobile-money transfers is that systems differ, and a single rule may not fit every provider or payment arrangement.

Those concerns are serious. They are not reasons to leave the standard without measurable duties. I do not propose a guarantee that every payment will be recovered. I propose a binding timetable for steps that a provider can control: acknowledge the report, make an initial assessment, contact the relevant provider or payment operator, transmit the available transaction information, request that funds be held where legally and operationally possible, and update the business. If a step cannot be completed, the provider should record why and tell the customer what it has done instead.

A duty to act within a stated time is not the same as a promise of success. It makes delay visible and gives the business a basis to understand whether the provider acted. It also makes the standard useful for oversight and review. Without a deadline, “promptly” can mean different things to different institutions, and a business may have no way to distinguish an unavoidable failure to recover funds from a failure to act in time.

Different payment systems do require operational flexibility. That is why the proposed wording distinguishes the provider’s duties from the outcome of recovery and allows for a documented legal or technical barrier. But flexibility should not become an exclusion. If a provider offers or facilitates a mobile-money transfer for a business, the business should not lose the standard’s protections merely because the payment was not made through a conventional bank transfer. The standard can require equivalent prompt action while allowing the precise operational steps to reflect the payment system involved.

Nor should the business carry the burden of coordinating a multi-provider investigation. The sending provider is the institution the payer can contact. It should take responsibility for initiating and tracking the recall process, even when another provider must perform part of it. That does not prejudge liability or require the sending provider to control another institution. It establishes a clear point of accountability for the response.

My position clause by clause

I support the draft’s central purpose: establishing a business fraud standard that asks banks and payment providers to verify payee names, act on reported fraud, seek recovery of payments and provide fair treatment when a small business has been deceived into authorising a payment. I also support coverage of authorised push payment and business email compromise fraud, including cross-border payments.

On scope, I support an express, technology-neutral definition of covered payment services. The text should include mobile-money transfers, whether domestic or cross-border, where a business uses a provider or payment operator to send the payment. The form of the account or wallet should not determine whether the business can seek the protections of the standard.

On prevention, I support verification of payee names as an important safeguard. Verification should be provided in a way that gives the payer useful information before the payment is authorised. It should not be treated as a complete defence to a later fraud claim: a deceptive instruction may exploit a genuine supplier relationship, and a payer may still be misled despite a name check.

On recall, I support the draft’s expectation that providers move quickly, but I ask the Council to replace general language with a binding response timetable. Providers should acknowledge a fraud report within one hour of receipt, begin the recall process without delay and no later than four hours after receipt, and transmit the recall request and available relevant information to the next provider in the payment chain. If the provider receives the report outside its staffed service hours, it should still provide a route for urgent reporting and begin action within the same deadlines. A deadline for action should not be misrepresented as a guarantee that funds will be recovered.

On reimbursement, I support the principle that a small business should not bear the whole loss simply because it authorised the payment after being deceived. The standard should identify the responsibilities of the sending and receiving providers and set out a fair process for deciding claims. I support clear treatment of cross-border payments, but the draft should not imply that a provider can avoid its own duties merely because another jurisdiction or payment system is involved.

On evidence and reasons, I support requiring providers to preserve the report, record the steps taken, and give the business a written explanation of the outcome. The explanation should identify the key facts and applicable standard, without disclosing information that would compromise an investigation or violate a legal restriction. A business should not have to make repeated calls simply to learn whether a recall request was sent.

I therefore propose that the draft’s provisions on recall timing and covered payment channels be replaced with the following wording:

What I ask

I ask the members of the Fair Play Council to adopt this amendment during the FP-001 adoption process. In particular, I ask that the final Business Fraud Standard:

• include mobile-money transfers expressly, alongside bank, payment-service and electronic-money transfers;

• apply to covered domestic and cross-border payments, while stating clearly how the standard interacts with any separate legal limits on reimbursement;

• replace an undefined expectation of speed with binding deadlines for acknowledgement, initiation of the recall process and transmission of the recall request;

• require the sending provider to coordinate the request and keep a record, without making recovery itself an outcome that can be guaranteed;

• require a documented reason and alternative action where legal or technical barriers prevent a step from being completed on time; and

• preserve verification of payee as a preventive safeguard without treating it as a substitute for recall, investigation or fair reimbursement.

Notes and sources

1. UK Payment Systems Regulator, APP fraud reimbursement protections.
   ^[2] Grant Thornton, first-year evaluation of the APP reimbursement requirement.
   ^[3] European Union Instant Payments Regulation, verification of payee requirement as described in the FP-001 records. ↩

Sources

1. UK Payment Systems Regulator — APP fraud reimbursement protections
2. Grant Thornton — APP fraud reimbursement requirement: were industry's concerns justified?