Letter from the table: A recall is not the same as a guarantee

To the Fair Play Council

I am replying to Thandi in Gqeberha. I understand her case for a firm promise that a small business will get its money back after an authorised payment is diverted. She is right that a business can do everything it thinks is sensible and still lose money. But I oppose the draft Business Fraud Standard as it stands. A standard should make payment providers act faster and more consistently; it should not promise reimbursement without saying how responsibility is established when the customer pressed “send”.

On 6 July this year, I received an email in an existing conversation with a supplier. It said the supplier’s banking details had changed. The message looked like the thread we had been using, and the invoice amount was R64,800. I checked that the amount matched what was due. I did not phone the supplier using a number I already had. That was my mistake. I made the electronic funds transfer from my business account to the new account details.

At 10:42, when I checked the payment confirmation against the earlier paperwork, I saw the account details were different. I called my bank’s fraud line immediately and asked it to stop or recall the transfer. The bank took the report and said it could send a recall request, but could not promise the money would return. I went to a police station that day to report the fraud and kept the case details. I also sent the bank the invoice, the email trail and the payment confirmation, then followed up through its formal complaints process. As of today, I have not recovered the R64,800.

I am not telling this story to excuse a slow response. The first minutes matter. The sending bank should have a clear route for reporting a suspected diverted payment, should act on a recall request without needless delay, and should tell the customer what it has done. Where the receiving institution can identify and hold funds, the two

institutions should cooperate quickly. A small business should not have to guess which department to call, repeat its account of events to several people, or discover weeks later that a request was never passed on.

South Africa does not have a general statutory scheme that guarantees reimbursement of every business payment made after an authorised electronic transfer. The National Payment System Act provides the framework for the payment system, while the South African Reserve Bank oversees that system. FICA imposes obligations concerning customer identification and related controls; it is not, by itself, a rule that reimburses a customer for a fraudulent transfer. Customers can use their bank’s complaints process and, where appropriate, approach the Ombudsman for Banking Services. Those routes matter, but they are not the same as a guaranteed, uniform reimbursement rule for every case.

That difference matters to me. “Authorised” describes what I did at the payment screen; it does not mean I knowingly intended to send money to a fraudster. But it also cannot settle every question about who should bear the loss. In my case, I relied on a changed instruction in an email thread and failed to verify it through a separate channel. A rule that reimburses every such payment automatically could make the provider responsible even where it followed the applicable process and the customer ignored a clear warning. A rule that always leaves the loss with the customer would be just as wrong. The draft needs to explain the middle ground.

I want the Council to keep the practical requirements in the standard: a reliable way to check payee details, a fast and accessible fraud-reporting channel, prompt recall attempts, cooperation between sending and receiving providers, and a written record of the steps taken. Payee-name checking could have helped if the account name did not match the supplier’s name. It will not catch every deception, and it cannot replace a proper recall process. The standard should also require plain instructions before payment and warnings that do not train people to click through them without reading.

On reimbursement, I ask the Council to revise the draft. It should set out a fair investigation, consider what each party knew and did, and say when a provider’s failure to follow the standard requires reimbursement. It should protect a business that acted reasonably and reported the fraud promptly, while allowing a reasoned decision where the customer’s conduct is relevant. If reimbursement is declined, the provider should

give specific reasons and explain how to challenge the decision. Cross-border payments need clear cooperation and escalation rules too; simply extending a promise across borders does not tell a small business who must act, or how quickly.