Letter from the table: Authorisation is not consent to fraud

RC/FP/2026/T.24 · 3 September 2026

To the Fair Play Council,

I support the work on FP-001. I ask the Council to change one proposed clause before it becomes part of the Business Fraud Standard: the exclusion that says, in effect, that a payment is not eligible for reimbursement if the customer authorised it. If that wording is intended to exclude authorised push-payment fraud, it excludes the very case the standard must address.

This is not an argument that every mistaken transfer should be reimbursed. It is an argument that pressing the authorise button is not the same as freely choosing to pay a fraudster. A person can authorise a transfer because the information used to make the decision has been deliberately falsified.

What happened

On 8 June 2026, I received an email in an existing invoice conversation. It appeared to be part of the same correspondence. The message said that the payment details had changed and supplied a new IBAN. The invoice amount was €4,860. I had no reason at that point to believe the message was fraudulent.

On 11 June, I made a standard SEPA credit transfer from my business account. I entered the new details and approved the payment through my bank’s usual process. The money left my account. Later that day, when I checked the payment details using a telephone number I already had, I learned that the intended recipient had not changed its bank account and had not sent the message.

At 12:18, I contacted my bank and asked it to stop or recall the transfer. I supplied the payment details and explained that the account information had been changed through the email conversation. The bank initiated a recall request. I understand that a recall is a

request, not a power to guarantee the return of money already credited to another account. I also made a police report and preserved the email chain and the invoice.

I did the things a small business can reasonably do after discovering the fraud. But none of them changed the central fact for the proposed clause: I had authorised the payment. If that fact alone disqualifies me, the fraudster’s method becomes the reason I lose protection.

The German position

In Germany, section 675u of the German Civil Code concerns the payment service provider’s responsibility for unauthorised payment transactions. Where a customer personally approves a transfer after being deceived, that route is not the same as a remedy for an unauthorised payment. I am not asking the Council to misstate German law or to promise that every such transfer must be returned under existing law. I am asking for a standard that recognises the gap.

Euro-area payment providers have been required to offer verification of payee for euro credit transfers since October 2025. That is useful, but it should not be treated as a complete answer to invoice fraud. A name check may help a payer notice a mismatch; it does not establish how a fraudulent change entered an otherwise trusted conversation, and it cannot by itself recover funds after a transfer has been made. Nor should a payer’s use of a transfer process that displayed no effective warning automatically end the inquiry.

In the days after the transfer, I wanted three things: a prompt attempt to reach the receiving provider, a clear explanation of what had been done and when, and a decision that considered the deception rather than stopping at the word “authorised.” I could ask my bank to act quickly; I could not make the receiving account holder return the money. That imbalance is why a shared standard matters.

Suggested replacement

I ask the Council to replace the proposed exclusion with wording along these lines:

“A payment is not ineligible for reimbursement solely because the customer authorised it. Where a customer was deceived into making a payment, the payment service providers shall assess the reported fraud promptly, take reasonable and documented steps to seek recall, and determine reimbursement under the applicable allocation of responsibility. An exclusion based on the customer’s conduct shall require an individual assessment and shall not be based on authorisation alone.”

This wording does not promise reimbursement in every case. It does require the providers to look at the circumstances and to act. If an exclusion is needed for a customer who knowingly participated in fraud, or who deliberately helped the fraudster, it should say so narrowly and require evidence. It should not rely on an undefined test such as whether the customer took “reasonable care.” That phrase can move the whole burden onto a small business after the event, when the relevant warning may not have been visible at the time.

A payment provider is better placed than an individual business to contact another provider, preserve transaction records and identify whether the receiving account can still be restricted. A common standard can set expectations for speed and explain what information a claimant must provide. It can also make clear that reporting promptly matters without turning a short delay, or the fact of authorisation, into an automatic refusal.