Letter from the table: An objection to the “gross negligence” exclusion

RC/FP/2026/T.16 — Letter from the table

To the Fair Play Council,

I oppose the draft’s proposed exclusion from reimbursement where a business is said to have acted with “gross negligence”. I ask the Council to remove that exclusion and replace it with the wording at the end of this letter. I support a standard that requires payee-name checks, rapid efforts to recall fraud payments and reimbursement for small businesses harmed by authorised push-payment fraud. My objection is to a phrase that could turn the fact that a payment was authorised into a reason to refuse help.

I write from Barranquilla, and I write from experience. On 14 March 2025, I received a message in an email conversation that had previously been used for legitimate business correspondence. It said that payment details had changed. The message looked connected to the conversation, and the information appeared plausible. On 17 March, I sent COP 8,740,000 to the account stated in that message. On 18 March, I sent a second payment of COP 3,280,000, believing it related to the same outstanding obligation.

I will not pretend that I did not approve the transfers. I did. That is precisely why the word “authorised” cannot be treated as the end of the inquiry. I authorised payments because I was deceived about who would receive them. When I later checked the details through a separate channel, I found that the account information had been changed without my knowledge. The payments had gone to an account that was not the intended recipient’s.

On 19 March, I contacted my financial institution and reported the transfers as fraud. I asked for an urgent recall and supplied the dates, amounts and account information available to me. I also gathered the email correspondence and payment records. I made a complaint through the institution’s customer-service process, sought guidance from the Defensor del Consumidor Financiero, and reported the matter to the Fiscalía General de la Nación. I understood that these steps could document what had happened and put the relevant institutions on notice. I did not understand them to guarantee that the money would be recovered.

There was a period when every hour seemed to matter. I was trying to keep ordinary obligations moving while asking whether the transfers could be stopped or traced. I had to repeat the same account of events and organise records that were spread across messages and payment confirmations. I am not including this detail to say that any one institution caused the fraud. I am saying that a business facing a payment diversion has to act quickly, often without knowing which action will make a difference. A rule that later judges whether the business was sufficiently careful, using the result as the starting point, risks judging the victim with knowledge the victim did not have at the time.

The phrase “gross negligence” sounds narrow, but without a clear definition it can become a wide door. A bank or payment provider might treat failure to call a known contact, a hurried payment, or reliance on a familiar-looking email chain as enough to deny reimbursement. Those facts may be relevant when investigating how a fraud happened. They should not, by themselves, establish that a small business loses protection. Fraudsters deliberately exploit ordinary working practices and the pressure to keep payments on schedule. A business that is deceived is not the same as a business that knowingly assists a fraud.

I ask the Council to replace the proposed exclusion with this wording:

“A payment provider shall not refuse reimbursement solely because a payment was authorised by the business, because the business did not identify the deception before sending it, or because the business is alleged to have been negligent. Reimbursement may be refused only where the provider establishes, on the balance of evidence, that a person authorised to act for the business knowingly participated in the fraud. A provider must explain any refusal in writing, identify the evidence relied upon, and show the steps taken promptly to verify the payee and seek recall of the payment.”

This wording does not ask providers to reimburse every disputed payment without review. It allows investigation and gives a clear, serious ground for refusal: knowing participation. It also places responsibility on the provider to explain its decision and to show that it took the steps the standard requires. In a case involving an altered payment instruction, the provider may be better placed than a small business to verify account information, contact the receiving provider, and act quickly once notified.

A fair standard should not require a business to be perfect in order to be protected. It should ask what happened, whether the business was deceived, what the providers did to prevent or contain the loss, and whether there is evidence of deliberate participation. Those are difficult questions, but they are more honest than using an undefined label to decide that a victim should bear the whole loss.