Fair Play Council Chair’s Letter — October 2026

Dear members,

October has been a month for turning evidence into decisions. Our consultation on the draft Business Fraud Standard, FP-001, opened on 13 October and remains open until 12 November. On 14 October, we sent the draft to payment regulators for comment. The Trade Council’s TR-001 passed its pattern test on 20 October, and the Cashflow Council’s adoption ballot opened on 26 October. These are different stages of work, but they share one discipline: listen carefully, test what we are hearing, and make the proposed fix clear enough to be judged.

For Fair Play, the central question is practical. When a small business is tricked into authorising a payment, can the receiving institution help identify where the money went, can the sending institution act quickly to recall it, and is there a fair route to reimbursement? FP-001 asks banks and payment providers to verify payee names, move quickly on recalls and provide meaningful protection for small businesses affected by authorised push payment fraud and business email compromise, including across borders. The draft is open for scrutiny; it is not yet an adopted standard.

What the evidence says

As of 27 October, Reseated had 1,786 members in 49 countries and had received 5,436 reports from 50 countries. Fair Play has 214 members in 42 countries and 712 reports from 49 countries. The median amount at stake in Fair Play reports is approximately US$4,540. Members filed 120 Fair Play reports in the last 30 days.

Those figures describe the reports we have received, not independently verified losses or a measure of how often fraud occurs across the whole economy. They do show the reach of the problem in our evidence. The leading reporting countries are the United Kingdom, with 103 reports; the United States, 94; Nigeria, 41; Canada, 38; India, 36; South Africa, 32; Kenya, 31; and Brazil, 22.

The reports come from businesses of very different sizes. Forty-one per cent of Fair Play respondents say they work alone; 39 per cent have teams of two to nine; 14 per cent have teams of 10 to 49; and 6 per cent have teams of 50 to 249. A fraud response designed only around large finance departments will miss how these incidents reach many small firms: one person may be doing the work, checking the invoices and trying to contact the bank at the same time.

One member’s account

One member’s report described a supplier payment that was diverted after a request to change the bank details on an invoice. The member checked the message against the existing correspondence and authorised the transfer. Only afterward did the supplier say that its account details had not changed. The member contacted the payment provider, gathered the invoice and message trail, and asked for the payment to be recalled. The hours spent finding the right contact and assembling the evidence mattered: a fraudster’s head start can become a business’s loss.

This account is presented without identifying details and is not a claim about any particular provider or business. It illustrates why the draft addresses both prevention and what happens after a payment has gone. A name check before payment can give a payer a useful warning. After a fraud, prompt escalation and a fast, coordinated recall process can preserve options that may disappear with time. Neither step makes every fraud preventable, and neither should place the entire burden on a small business that was deceived.

What we have learned

First, prevention and recovery must be treated together. Verification of payee is now required for euro instant credit transfers under the EU Instant Payments Regulation. That is a meaningful step, but a warning is useful only if it is clear, timely and acted on. It also does not settle what should happen when a business has already sent money to a fraudster.

Second, reimbursement rules can change outcomes. In the United Kingdom, the mandatory APP reimbursement regime began on 7 October 2024. It covers eligible consumers, micro-enterprises and charities, with a limit of £85,000 per claim and

costs generally split equally between sending and receiving payment service providers; international payments are excluded. Its first-year evaluation reported a 21 per cent fall in APP fraud and an increase in reimbursement from 54 to 65 per cent.¹² Those results are encouraging, but they also underline the gaps small businesses face, including cross-border payments and firms outside the eligible categories.

Third, a standard needs to be specific enough to be tested. Members have asked for clear responsibilities, workable time expectations for recalls and a route to explain decisions. The consultation is where we must test whether the draft is understandable and usable across different payment systems and countries. We want criticism that improves it, including criticism of provisions that are too vague, too demanding or insufficiently protective.

What comes next

The FP-001 consultation closes on 12 November. Please read the draft and submit evidence or comments before then, especially if you have experience with changed invoice details, payment recalls, cross-border transfers or the way a reimbursement decision was explained. The draft and the consultation are available through the Fair Play Council’s published materials.

The Cashflow Council’s CF-001 adoption ballot closes on 9 November. On 17 November, letters are scheduled to be sent to the proposed Wave 2 platform seats. These dates matter to Fair Play as well: payment fraud does not stop at the boundary between a bank, a platform and a supplier. We will keep our own work focused on payment practices while paying attention to the wider system members have to navigate.

After consultation closes, we will review the submissions and report what changed and why. We will not treat the number of comments as a substitute for the quality of evidence. Our aim is a standard that can be adopted, monitored and improved—not a document that sounds strong but leaves a small business without a usable next step.

Thank you to everyone who filed a report, checked a detail, challenged a draft or helped another member find the right words for what happened. I am especially grateful to Amina in Nairobi, Daniel in Birmingham, Ifeoma in Lagos and Priya in Toronto for the care they have brought to this month’s discussions. Thank you as well to our co-signers: 610 people have put their names behind the call for fairer treatment when a business is defrauded. Your support makes the evidence harder to overlook.

Notes and sources

Sources

1. UK Payment Systems Regulator: APP fraud reimbursement protections
2. Grant Thornton: First-year evaluation of APP fraud reimbursement