Letter from the table: Do not make authorisation a reason to deny reimbursement

To the Fair Play Council

I am writing from Puebla in response to the proposed FP-001 clause that would exclude a business payment from reimbursement whenever the sender, an employee or an agent authenticated and approved it. I oppose that wording. In business email compromise, the person pressing the final button may be doing exactly what their job requires, while acting on a false instruction that looked genuine.

My concern is not theoretical. On 14 January 2026, I received an email in an existing conversation about a payment. It appeared to come from a supplier we had dealt with before and said that the account details for the next transfer had changed. The message was plausible and arrived in the right thread. I did not telephone a separately verified number to confirm the change. That was my mistake. It was not a choice to pay a stranger.

On 15 January, I authorised a transfer of MXN 84,700 through my bank’s online service using SPEI. I checked the amount and entered the beneficiary details supplied in the email. The transfer confirmation showed that the payment had gone through. Later that day, when I reached the supplier through a different contact route, I learned that the account had not changed. The email account or conversation had been compromised. The money had gone to an account controlled by someone else.

I called my bank as soon as I understood what had happened and asked it to trace the transfer and request its return. I provided the email, the transfer details and the information I had about the intended recipient. I also asked the bank to contact the receiving institution. I received a case reference, but I could not reverse the transfer myself. Banco de México’s SPEI records and the CEP help establish the details and status of a payment; they do not give a sender a unilateral cancellation button after

a completed transfer. A request to recover funds is not the same thing as getting them back.

I followed up with a formal complaint to my bank and then sought help through CONDUSEF. I kept copies of the messages and records of each contact. That work took time at the same moment I was trying to manage the loss and keep ordinary obligations moving. I do not want the Council to mistake my having authorised the payment for proof that the loss was fairly mine to bear. Authentication proves that I used the bank’s process. It does not prove that I knowingly chose the fraudster as the recipient, or that the bank and receiving provider had no useful action left to take.

The proposed wording would make a routine feature of business life—the delegated authority to make a payment—an almost automatic escape from responsibility. Many small firms cannot have an owner personally approve every transfer. We use staff, bookkeepers or trusted agents. A convincing false invoice or changed account instruction can deceive the person who is properly authorised. If that person’s approval alone ends the claim, a standard for business fraud will leave out many of the very cases it is supposed to address.

I am not asking the Council to treat every disputed transfer as fraud or to guarantee reimbursement without examining evidence. I am asking it to distinguish an authorised instruction from informed consent to the fraud. Providers should be able to investigate what happened, act quickly to seek recovery, and assess the conduct of both the customer and the payment chain. The fact that a customer authenticated a transfer should not settle the question before that work begins.

I propose replacing the exclusion with this wording:

“A payment is not ineligible for reimbursement solely because the business, or a person authorised to act for it, authenticated or approved the transfer. The payment provider may refuse reimbursement only where, after a documented investigation, it demonstrates that the claimant acted fraudulently or with gross negligence under a clear standard published in advance. The provider must also document the steps taken promptly to trace and seek recovery of the funds. Where a payment crosses borders, providers must explain what recovery steps were available and taken; cross-border status alone must not exclude a claim.”

This alternative leaves room to reject dishonest claims and to consider serious failures by a customer. It does not turn the ordinary act of authorising a payment into a blanket waiver. It also puts urgency where it belongs: once a customer reports suspected fraud, providers should move quickly to contact one another and preserve whatever chance of recovery remains. That is especially important when the recipient account is elsewhere and the small business has no direct route to the receiving institution.