Letter from the Table: A Faster Recall, With Care for the Innocent

To the Fair Play Council

I support the direction of FP-001. A small business should not lose its working money simply because a fraudster persuaded it to approve a payment. But I ask the Council to be precise about how a new standard would work. A protection that is too blunt can create a second injury: it can delay legitimate payments, freeze an innocent recipient’s account, or make a business feel that it must prove its innocence before it can continue trading.

On 18 May 2026, I transferred COP 4.860.000 from my business account to pay an invoice. Two days earlier, an email had arrived within an existing correspondence thread. It said the supplier’s account details had changed. The invoice number and amount were familiar. The new account was presented as a routine administrative update, not as an urgent request. I checked the email thread, but I did not independently confirm the change using a previously known contact. That was the opening the fraudster needed.

On the morning of 19 May, the supplier contacted me because the invoice remained unpaid. I then compared the account details in the message with the details I had used before and understood what had happened. I called my bank as soon as I could, asked it to recall the transfer, and made a formal complaint through its channel. I also reported the fraud to the Fiscalía General de la Nación. I sought guidance through the financial-consumer complaint routes, including the Defensor del Consumidor Financiero. I kept the invoice, messages, transfer record and the dates of my calls together, because I understood that the order of events would matter.

In Colombia, Law 1328 of 2009 establishes protections for financial consumers, including consumers who are legal persons. Those protections and a financial institution’s security responsibilities matter. But I had personally authorized the transfer, even though I had been deceived. I found no general rule that automatically refunds an authorized transfer just because the payee was fraudulent. The Superintendencia Financiera de Colombia can receive consumer complaints and supervise financial institutions; it is not, for every case, an instant payment-reversal service. The path from discovering the fraud to seeking help is therefore not the same as getting the money back.

This is why the proposed combination of name verification, rapid recall and reimbursement is important. Before I sent the money, a useful payee check might have shown that the account holder’s name did not correspond to the supplier I meant to pay. After I reported the fraud, a fast and well-defined recall process might have reached the receiving institution while there was still a chance to stop the funds moving onward. And where prevention and recovery fail, reimbursement would recognize that a business can take ordinary care and still be deceived by a convincing change to a familiar invoice.

There is, however, a practical risk in name verification. Colombian businesses may use a trade name in daily dealings while their account is held under a different legal name. A strict exact-match rule could warn against a legitimate payment, especially where the payer knows the supplier by its commercial name and not by the legal name or NIT on the account. The standard should make the warning understandable and useful: show the account name available to the payment provider, explain whether the match is exact, close or absent, and allow a business to pause and confirm. A warning should help a person make a safer decision, not become a reason to block ordinary commerce without explanation.

There is also a risk on the receiving side. A fraudulent payment may land in an account belonging to an innocent small business, perhaps after the fraudster has impersonated a customer or supplier. A rapid recall must be

rapid, but it should not mean that an account is frozen indefinitely on an untested allegation. The standard should require prompt contact between providers, preservation of relevant payment information, clear reasons for any temporary hold, a short review timetable, and a route for the account holder to challenge an error. If reimbursement is owed, it should not be funded by taking money from an innocent recipient without a fair process.

Finally, the standard should not treat every authorized transfer as proof that the payer accepted the risk. Businesses should be encouraged to verify changed payment details, but the test should account for the quality of the deception, the business’s size and capacity, how quickly it reported the incident, and what each payment provider did. A small firm cannot maintain a fraud department or independently investigate every account. Nor should cross-border payments be left outside the protection simply because recovery is more difficult. The difficulty is a reason for providers to coordinate, not a reason to leave the victim alone.

The UK’s APP reimbursement framework is one case that reimbursement can be made part of a payment system’s rules, though its coverage has limits, including the exclusion of international payments.¹ The Council does not need to copy another country’s arrangements. It should use this consultation to establish a standard that fits the realities of small businesses across borders: verify before payment, act promptly after notification, reimburse fairly when deception succeeds, and protect recipients from mistaken or abusive claims.

Notes and sources

1. The UK reimbursement protections for eligible APP fraud claims took effect on 7 October 2024 and provide reimbursement up to £85,000 per claim; international payments are excluded. ↩

Sources

1. UK Payment Systems Regulator: APP fraud reimbursement protections