Concurring Opinion on the Business Fraud Standard

Who I am and what happened

To the members of the Fair Play Council,

I am Rebecca Foster, vice chair of the Fair Play Council, writing from Leeds in the United Kingdom. I submit this opinion in support of FP-001, the draft Business Fraud Standard. I concur with its direction, and I add a reason that I believe deserves particular weight: a fair remedy is also a way to make prevention and accountability work. A standard that makes the responsibilities of payment providers clear can help businesses know what to check, help providers identify where a payment process failed, and give both sides a more reliable basis for responding when fraud occurs.

I will not name a business or present a private case as if it were evidence before the Council. The pattern considered here is familiar in the reports: a small business receives an apparently credible request to change payment details, or a message is diverted or impersonated; the business makes a payment it believes is legitimate; and the fraud becomes clear only after the funds have moved. The payment may have been authorised in the technical sense that a person at the business approved it. That fact does not mean the business knowingly chose to pay a fraudster, or that it had a realistic way to recover the money once the deception was discovered.

In a small operation, the person approving an invoice may also be the person managing staff, serving customers, and keeping cash available for wages and suppliers. Fraud does not need to target a large company to cause serious harm. A single diverted payment can consume time, working capital, and trust. The business may then face a second problem: trying to establish what happened across institutions whose processes, response times, and reimbursement rules are not the same.

My support is therefore not based on the idea that every disputed payment should automatically be reimbursed, regardless of the facts. It is based on a narrower and more defensible principle: where a small business has been deceived into sending a

payment, the institutions that operate the payment system should have clear duties to verify, act quickly, and provide a fair remedy under stated rules.

What the evidence shows

The figures available to the Council on 16 October are substantial enough to support a standard, while also requiring care in how they are interpreted. Reseated had 1,726 members in 49 countries and had received 5,301 reports from 50 countries. Reports by council were: Platform, 1,961; Cashflow, 1,342; Fair Play, 679; Trade, 511; Resilience, 343; Red Tape, 296; and Team, 169. These are reports submitted to Reseated, not a global estimate of fraud prevalence and not a claim that every reported case has been independently adjudicated.

Within Fair Play, 208 members came from 42 countries, and the Council had received 679 reports from 49 countries. The median amount at stake was approximately US$4,540. There were 132 reports in the preceding 30 days. The distribution across business sizes is important: 41% of reporting members described themselves as “Just me,” 39% had teams of 2–9, 14% had teams of 10–49, and 6% had teams of 50–249.

Those figures do not describe a single kind of business or a single national system. The reports came from 49 countries. By country of report, the largest counts were the United Kingdom, 98; the United States, 90; Nigeria, 38; Canada, 35; India, 33; South Africa, 31; Kenya, 30; and Brazil, 21. The range matters. A business may be dealing with its local bank, a payment provider, and a counterparty or account in another country. A standard that assumes every loss can be handled within one domestic process would miss a material part of the problem the Council has been asked to address.

These numbers should be read with the limits of member reporting in view. The median amount is not the total cost of fraud; a report count is not a count of every incident in the world; and the distribution of reports is not a ranking of national risk. But the evidence has the value required for this policy question: it shows repeated reports across a wide range of countries, different business sizes, and amounts that can be consequential for small operators. The five-part pattern review and the public consultation are the appropriate places to test the pattern and refine the remedy. They are not reasons to treat recurring harm as an isolated inconvenience.

The Council’s work has proceeded through those stages. FP-001 passed the pattern test on 8 September. The draft was open for consultation from 13 October to 12 November. As of the date of this opinion, that consultation is still open. The Council should not present consultation as completed or suggest that its results are already known. I ask members to consider the evidence now available, and to use the remaining consultation period to identify precise improvements rather than to delay a response to the underlying pattern.

How the law in my country and elsewhere handles it

In the United Kingdom, the Payment Systems Regulator’s APP reimbursement protections took effect on 7 October 2024. They provide for reimbursement of up to £85,000 per claim and cover consumers, micro-enterprises, and charities. The cost is split equally between the sending and receiving payment service providers. International payments are excluded.¹ This is a meaningful change: reimbursement is no longer solely a matter of whether an individual customer can persuade a provider to make an exception. But the stated coverage and the international exclusion also show why an agreed business standard can be useful. A cross-border loss may not fit within this domestic protection.

The first-year evaluation cited in the dossier reported that APP fraud was down 21% and that the reimbursement rate rose from 54% to 65%.² Those figures do not prove that reimbursement alone caused the change, and they should not be treated as a forecast for every country or payment system. They do show that a defined reimbursement framework can operate alongside measurable movement in fraud and reimbursement outcomes. That experience is relevant to the Council’s proposal, but it does not remove the need to design the standard carefully.

Elsewhere, the EU Instant Payments Regulation requires verification of payee from October 2025.³ That is a different element of protection from reimbursement after a loss. Considered together, the cases in the dossier point to complementary measures: checking whether the payee name matches the intended recipient before funds are sent, and having a prompt, workable process for recall and reimbursement when a fraudulent payment has nevertheless occurred.

The Council should be precise about what these cases establish. The UK rules do not cover every business or every payment, and international payments are excluded. The EU verification requirement is not itself a universal reimbursement rule. Neither case establishes that every false payment can be prevented or every loss recovered. The case for FP-001 is instead that a common baseline can address the gap between prevention and remedy, while leaving room for applicable law to provide stronger protections.

The strongest argument against my view and my answer

The strongest argument against FP-001 is that reimbursement can weaken care, increase costs for payment providers, and make honest customers or businesses bear the consequences of fraud they did not cause. A provider may also argue that it cannot reliably distinguish a sophisticated deception from a genuine commercial dispute, or that responsibility is too difficult to allocate when a payment crosses borders. This is not a trivial objection. A rule that ignores evidence, treats every allegation as conclusive, or creates an unbounded liability could be unfair and could undermine confidence in the payment system.

My answer is that those concerns call for a disciplined standard, not for leaving small businesses without a predictable route to protection. FP-001 should distinguish a fraud claim from an ordinary disagreement over goods, services, or a debt. It should require timely cooperation and evidence from the parties, set a clear process for tracing and recalling funds, and provide a reasoned decision where reimbursement is disputed. It should not require a provider to pay without considering the circumstances. Nor should the fact that a customer authorised a transfer, after being deceived about its destination, end the inquiry by itself.

There is also a practical reason to make duties explicit. If each provider applies different expectations, a small business may not know whether to contact its bank, the receiving provider, or another institution first, or what information to preserve. Delay can make recovery harder. A clear process gives the business a route to act immediately and gives providers a consistent basis for cooperation. This is not a promise that every payment can be recalled. It is a way to avoid preventable delay and to make responsibility visible.

Finally, reimbursement and prevention need not be opposing goals. If providers must respond to verified reports, cooperate on recalls, and explain how they assess claims, the resulting information can help identify weak points in verification and response. A fair remedy can create pressure to improve the system, rather than simply transferring a loss after the event. That is the distinct reason I add to my concurrence: FP-001 can support learning and accountability across the payment chain, including where the immediate loss cannot be fully recovered.

My position clause by clause

I set out my position by the substantive elements of the draft. I do not assign clause numbers here; the adopted text should use the numbering and language settled through consultation and the Assembly process.

• On verification of payee names, I support requiring banks and payment providers to provide a meaningful name check before a business sends a payment. The result should be understandable to the person making the payment: a match, a mismatch, or a result that cannot be confirmed. The system should not imply certainty where it cannot establish that the named recipient controls the account. The purpose is to give a business useful information at the point when it can still pause and verify a changed instruction.

• On changed payment details, I support clear warnings and a practical route for checking them through a known channel. A warning should not merely shift responsibility to a small business through a general statement that it must be careful. It should help the user act: identify the discrepancy, explain the risk in plain language, and provide a way to confirm the intended payee without relying on contact details supplied in the suspicious request.

• On recall, I support a duty to act quickly once a business reports a suspected fraudulent payment. The provider receiving the report should begin the steps available to trace or recall funds, communicate with relevant providers, and tell the business what information is needed. A prompt process matters even when it cannot guarantee recovery. The standard should encourage immediate action, not require a small business to prove its entire case before any attempt is made to stop further movement of funds.

• On reimbursement, I support a fair route for small businesses harmed by authorised push payment or business email compromise fraud. The decision should take account of whether the payment was made under deception, what safeguards were available, and what the business and providers did after the fraud was suspected. The standard should set out a decision process and reasons, rather than leave a business to depend on an unexplained discretionary outcome. The UK case shows that reimbursement can be bounded by a stated limit and a defined allocation of cost; the Council should use that as evidence of a workable approach, not as a claim that one national design must be copied everywhere.

• On cross-border payments, I support including them in the standard’s scope. The reports span 49 countries, while the UK protections described above exclude international payments. A standard that stops at the border would leave an important category outside its basic protections. The text should recognise that the institutions involved and the applicable legal rules may differ, while still requiring providers to make reasonable efforts to coordinate, recall funds, and give the business a clear account of the process.

• On safeguards and review, I support proportionate evidence requirements, reasoned decisions, and a process for correcting errors. A standard should protect providers against unsupported claims without asking a small business to produce information it could not reasonably obtain. It should also encourage providers to record outcomes in a way that permits review of delays, recall attempts, verification failures, and reimbursement decisions. This makes the standard more credible and gives future revisions a better evidentiary foundation.

Across these elements, I would preserve one drafting principle: do not turn a minimum standard into a checklist that appears protective but cannot be used under pressure. A business facing a suspected diversion needs to know what to do, what the provider must do, and what happens next. Clear timing, accessible contact routes, and understandable explanations are part of substantive fairness, not administrative decoration.

What I ask

I ask members of the Fair Play Council to support FP-001, while using the open consultation to make its procedures precise. In particular, I ask that comments identify whether the text tells a business how to request a recall, whether providers have a clear duty to cooperate promptly, how a reimbursement claim is assessed, and how cross-border cases are handled. If a proposed safeguard is needed, members should state the risk it addresses and how it can be applied without making the protection unusable for a small business.

I also ask members to keep the evidence in proportion. The 679 Fair Play reports, the 132 reports in the last 30 days, and the member and country figures are not a census of all fraud. They are, however, a substantial record of reported experience across countries and business sizes. They warrant a serious standard and a serious consultation. We should neither overstate what the data proves nor use its limits as a reason to ignore the pattern it records.

Notes and sources

1. UK Payment Systems Regulator, APP fraud reimbursement protections; facts stated in the dossier. ↩
2. First-year evaluation of the UK APP reimbursement requirement; facts stated in the dossier. ↩
3. EU Instant Payments Regulation verification-of-payee requirement; fact stated in the dossier. ↩

Sources

1. UK Payment Systems Regulator: APP fraud reimbursement protections
2. Grant Thornton: first-year evaluation of APP fraud reimbursement