A question for the chair: what kind of protection are we asking banks to provide?

Dear Chair,

I am writing from Hamburg with a question about our strategy. I oppose a standard that would require banks and payment providers to reimburse every small business for an authorised push payment fraud, including cross-border cases, without a clear limit or a careful account of what the business and the providers could reasonably have done. I support faster recalls, better warnings and a real route to review. But I am not persuaded that one broad reimbursement rule is the right centre of our work.

On 12 February this year, I received what appeared to be a corrected invoice in an existing email conversation. The original invoice was for €2,460. The replacement showed a different IBAN and asked for payment by the same date. I checked the sender’s address, but not by calling a number I already had. I made the SEPA transfer from my business account. The money went to an account outside Germany.

The next morning, I called my bank and asked it to stop or recall the transfer. I supplied the invoice and the email thread, and made a report to the Hamburg police. I also contacted the intended supplier using an old telephone number. The supplier confirmed that its bank details had not changed. My bank submitted a recall request, but the money was not returned. I do not blame one bank for the fraud. I am describing what happened after I had already made the mistake.

There is a difficult distinction here. I entered and confirmed the payment myself, though I did so because the invoice had been diverted. That is not the same as a payment taken from my account without my consent. Under German payment-services rules, a customer’s right to have an unauthorised transaction corrected does not simply turn an authorised transfer into an unauthorised one because fraud deceived the payer. A payment order is generally no longer revocable once it has reached the payment provider; after that point, a recall is a request, not a promise

that the funds can be recovered. In practice, that leaves a business like mine with an urgent need for assistance and no assurance of an effective remedy.

What would the proposed fix change?

The Fair Play proposal asks for payee-name verification, quick recalls and reimbursement for small businesses affected by authorised push payment and business email compromise fraud, including across borders. Each part addresses a real weakness. A check that compares the name with the IBAN can give a payer useful information before sending money. A recall process measured in hours rather than days may matter when funds are moved quickly. And a clear complaint route is better than being passed between providers.

But those measures are not interchangeable. A payee check can warn me about a mismatch; it cannot establish whether an apparently correct invoice email is genuine. A recall can be prompt and still fail if the funds have already moved. Reimbursement can relieve a serious loss, but a rule that makes a provider pay whenever a business authorises a transfer may shift the whole cost onto a party that did not send the invoice and may have had little chance to detect the deception. I worry that, if the standard does not say how responsibility is assessed, small businesses will be left with disputes over exclusions, evidence and deadlines rather than the dependable protection we intend.

Europe has already moved toward verification of payees for euro credit transfers under the Instant Payments Regulation. That is a useful baseline, not a complete answer to invoice diversion. We should ask what the name check actually tells a small business, how a “close match” is explained, and what happens when a business proceeds after seeing a warning. We should also distinguish payments within a provider’s immediate reach from cross-border transfers, where recovery may involve more than one jurisdiction and more than one institution. A promise of reimbursement without a workable process for these cases may sound strong on paper and prove difficult to use.

My question to the chair

Are we trying to secure a remedy for every business that has been deceived, or to make the payment chain respond quickly and fairly when fraud is reported? Those are related aims, but they are not the same promise. I ask the Council to make the first demand a time-bound recall procedure: a simple reporting channel, immediate contact between the sending and receiving providers, preservation of relevant payment information, and a written explanation when recovery is refused or unsuccessful. For reimbursement, I would support a narrower proposal with stated eligibility, a review of the business’s actions and the providers’ safeguards, and a route to challenge a decision. I oppose automatic, unqualified reimbursement for every authorised business payment.

I know that asking for conditions can weaken a campaign if the conditions become excuses. That is why the conditions must be public, specific and reviewable. A small business should not have to guess whether it called quickly enough, used the right words, or supplied a document that only the bank knows how to obtain. The Council should test these practical details with members before treating a reimbursement promise as the main measure of success.