Dublin, IrelandUse Readable text for larger type, or zoom in on the pages.
Fair Play Council
Letter from the table: A recall is not the same as a remedy
Letter from the table
Dear Chair,
I have a question about our strategy before FP-001 moves from evidence gathering to a draft: are we asking banks and payment providers to do three different things, or treating them as one promise? I think the standard should ask for all three—stronger checks before payment, fast action after a report, and a fair route to reimbursement—but it should say clearly what each duty means. My stance is amend.
On 17 March, an invoice arrived by email for €7,480. I had paid this supplier before. Two days later, a message in the same email conversation said the supplier’s bank details had changed. It was a plausible explanation, presented at the moment I was preparing the transfer. On 19 March I sent the money from my Irish business account to the new IBAN. I had checked the number against the message, not by calling a contact I already knew.
The next morning, the supplier told me it had not changed its account details. The invoice was genuine; the payment instructions were not. I called my bank, asked it to try to recall the transfer, and reported the incident to An Garda Síochána. I also preserved the emails and sent the bank the invoice and the confirmation from the supplier. By 24 April, I had no recovered funds. I am not naming the bank or the supplier. The point is not to assign blame from one account; it is to describe what a small business is left to do when an authorised payment has gone to a fraudster.
At the payment stage, the distinction between an authorised and an unauthorised payment matters. I approved the transfer, although I was deceived about who would receive it. That is not the same as someone taking money from my account without my consent, and the protections for
unauthorised transactions do not automatically answer what should happen here. In the euro area, verification of payee has been required for euro credit transfers since October 2025. That is useful, but a name check cannot by itself undo a convincing invoice fraud or guarantee that a payer understands a warning. If a warning is shown, the process should make it intelligible; it should not turn a warning into a reason to blame the person who was deceived.
After I reported the fraud, the recall mattered urgently. A recall request is not the same as getting the money back: it depends on action across institutions and may not succeed, especially once funds have moved. I do not know what happened to the money after it left my account. I can only say that, from my side, I needed a named route for urgent escalation, confirmation that the recall request had been sent, and a clear explanation of what would happen next. A small business should not have to learn the difference between a report, a recall attempt and a reimbursement claim while the clock is running.
My question to the Council is this: how do we keep the standard ambitious without making it sound as if every fraud has the same cause or every provider controls every step? The UK reimbursement scheme is a useful comparator, but it is not an Irish remedy. It covers eligible UK payments, with its own scope and limits; it should not be presented as a rule that already protects an Irish business making a euro transfer.1 Cross-border cases make the gap especially visible. The sending provider, receiving provider and relevant national rules may not line up neatly, but that complexity should not leave the small business without an answer.
I would amend the draft around three separate duties. First, require proportionate payee verification and clear, usable warnings, with records showing what check was made and what the payer saw. Second, require a rapid, traceable recall process: prompt transmission of the request, a point of contact, and updates that do not imply success before funds are recovered. Third, set out a reimbursement route for eligible business fraud, including authorised push-payment and business-email-compromise cases,
with transparent decisions and a review process. Where providers disagree about responsibility, that dispute should not prevent the customer from receiving a timely decision.
The Council should also specify how its proposal applies to cross-border payments and what evidence a small business can reasonably provide. I could supply the invoice, the altered payment instructions, the transfer record, and the supplier’s confirmation. I could not prove who controlled the receiving account or reconstruct what happened inside the payment chain. A standard that makes reimbursement depend on evidence only institutions can obtain will look fair on paper and fail in practice.
BEC Watch helps members recognise recurring patterns. The next step, in my view, is to turn those patterns into duties that can be tested separately: did the check help before payment, did the recall move quickly, and did the customer receive a reasoned outcome? Please keep the ambition of FP-001, but amend the wording so that prevention, recovery and reimbursement are not blurred into a single promise. That would give the Assembly a standard we can defend across different payment systems—and give a business like mine something more useful than a reminder to be careful.
Samir RahmanMember, Fair Play CouncilDublin, Ireland