SUP 16 Annex 27F Notes on completing REP017 Payments Fraud Report

2These notes contain guidance for payment service providers that are required to complete the Payments Fraud Report in accordance with Regulation 109(4) of the Payment Services Regulations 20173 and SUP 16.13.7D. The notes also build on the 3 EBA Guidelines on fraud reporting under the Payment Services Directive 23 (PSD2) (EBA/GL/2018/05)3 (“the EBA Guidelines”).

The following completion notes should be read in conjunction with the EBA Guidelines.

Question A1 – reporting period

As per SUP16.13.8, small payment institutions, registered account information service providers and small electronic money institutions must report once per year. All other PSPs must report every six months.

Those PSPs required to report annually are required to provide separate Payment Fraud Reports in respect of the two halves of the reporting year. These PSPs should use question 1 in the Payments Fraud Report to select the period the data in their return covers, e.g. “H1” for the period covering 1 January to 30 June, and “H2” for the period covering 1 July to 31 December.

Table 1 - Payment transactions and fraudulent payment transactions for payment services

The form provides the means for PSPs to provide the FCA with statistical data on fraud related to different means of payment. 3

As outlined in Guideline 1 of the EBA Guidelines, PSPs will be required to collect and submit data on the volume and value of all payment transactions, as well as the volume and value of fraudulent transactions.

Data on volume and value need to be broken down further by payment type, fraud type, method of authentication and geographical location. The detailed breakdown of data to be reported generally pertains only to the volume and value of fraudulent transactions (as opposed to all payment transactions). The EBA Guidelines explain these in detail. The following completion notes should be read as complementary to the Guidelines.

Table 2 - Fraud relating to account information services

PSPs that provide account information services (AISPs) should have regard to Table 2 in the fraud report (and the guidance in table 2 below). Registered account information service providers (i.e. PSPs that do not provide any other type of payment service) do not need to answer the questions in Table 1 of the fraud report.

Adjustments

The date to be considered by PSPs for recording payment transactions and fraudulent payment transactions for the purpose of this statistical reporting is the day the transaction has been executed in accordance with PSD2.

However, payment service users are entitled to redress for unauthorised transactions as long as they have notified their PSP no later than 13 months after the debit date, on becoming aware of any unauthorised payment transactions. This means PSPs may need to adjust reports which they have already submitted, on becoming aware of fraudulent transactions executed in previous reporting periods.

Furthermore, the payment service provider should report all fraudulent payment transactions from the time fraud has been detected (i.e. because it has been reported to the PSP such as through a customer complaint or otherwise discovered independently by the PSP), regardless of whether or not the case related to the fraudulent payment transaction has been closed by the time the data are reported. This means PSPs may need to adjust reports which they have already submitted, should investigation of open fraud cases conclude that a transaction was not fraudulent.

PSPs should report adjustments during the next reporting window after the information necessitating the adjustment is discovered.

PSPs should make use of the resubmission facility made available via the electronic means for submitting REP017.

Table 1 - What is a fraudulent transaction?

For the purposes of table 1 a fraudulent transaction is any payment transaction that the PSP has:

1. • executed;

2. • acquired; or

3. • in the case of a payment initiation service provider (PISP), initiated;

and that the PSP deems to fall into either of the following categories:

1. • unauthorised payment transactions made, including as a result of the loss, theft or misappropriation of sensitive payment data or a payment instrument, whether detectable or not to the payer prior to a payment and whether or not caused by gross negligence of the payer or executed in the absence of consent by the payer (‘unauthorised payment transactions’); and

2. • payment transactions made as a result of the payer being manipulated by the fraudster to issue a payment order, or to give the instruction to do so to the payment service provider, in good faith, to a payment account it believes belongs to a legitimate payee (‘manipulation of the payer’).

If a payment transaction meets the conditions above it should be recorded as a fraudulent transaction for the purposes of this report irrespective of whether:

1. • the PSP had primary liability to the user; or

2. • the fraudulent transaction would be reported as such by another PSP in the same payment chain.

As a general rule, for all types of payment services, the payer’s PSP has to report, except for direct debit transactions, which are reported by the payee’s PSP. In addition, card payments are reported both by the payer’s PSP (the issuer) and the payee’s PSP (the acquirer).

Fraud committed by the payment service user (known as first party fraud) should not be reported.

The payment service provider should not report data on payment transactions that, however linked to any of the circumstances referred to in the definition of fraudulent transaction (EBA Guideline 1.1), have not been executed and have not resulted in a transfer of funds in accordance with the provisions in the Payment Services Regulations3.

The category of ‘payment transactions made as a result of the payer being manipulated by the fraudster to issue a payment order’ covers a broader range of payment types than what is known in the UK as ‘authorised push payment fraud’. The latter is restricted to credit transfers authorised by the payer to a fraudster.

Table 1 - structure of the return

In summary, REP017 requires the PSP to report the following fraud types, divided into sections for different payment and e-money services:

for credit transfers (including those initiated by PISP):

1. • issuance of a payment order by the fraudster;

2. • modification of a payment order by the fraudster;

3. • manipulation of the payer by the fraudster to issue a payment order;

for direct debits where consent is given via an electronic mandate or separately where consent is given in another form:

1. • unauthorised payment transactions;

2. • manipulation of the payer by the fraudster to consent to a direct debit;

debit card transactions and separately for credit card transactions:

1. • issuance of a payment order by a fraudster, broken down into:

   1. o lost or stolen card;

   2. o card not received;

   3. o counterfeit card;

   4. o card details theft;

   5. o other;

2. • modification of a payment order by the fraudster;

3. • manipulation of the payer to make a card payment;

cash withdrawals:

1. • issuance of a payment order by the fraudster refers to the following types of unauthorised card payment transactions, broken down into:

   1. o lost or stolen card;

   2. o card not received;

   3. o counterfeit card;

   4. o other; and

2. • manipulation of the payer to make a cash withdrawal.

for e-money transactions – to be reported by e-money issuers:

1. • issuance of a payment order by the fraudster;

2. • modification of a payment order by the fraudster;

3. • manipulation of the payer by the fraudster to issue a payment order;

for money remittance:

1. • fraudulent payment transactions.

Table 1 - fraud types

Below we provide guidance on the fraud types referred to in REP017. We give examples of these fraud types in relation to each payment or e-money service. PSPs should use their discretion when determining the appropriate fraud type for each fraudulent transaction and should choose the fraud type that most closely matches the circumstances of the fraud.

Credit transfers

Issuance of a payment order by the fraudster

This covers unauthorised payment transactions in which the fraudster uses stolen personalised security credentials in order to issue a payment order, either through contacting the victim’s bank or accessing the victim’s online banking service. For example, where a victim’s online banking has been accessed using stolen personal identity details and credit transfers have been made from the victim’s account to beneficiaries chosen by the fraudster.

Modification of a payment order by the fraudster

This covers unauthorised payment transactions where the fraudster has gained unauthorised access to the victim’s account in order to change the details of existing payment orders or payment instructions. For example, where a victim’s account has been accessed using stolen personalised security credentials in order to modify the beneficiary of the victim’s existing standing orders. A victim’s account could be accessed by a fraudster in order to modify a batch of payment details so that when payments are executed by the victim’s PSP, the funds are unintentionally transferred to a beneficiary or beneficiaries chosen by the fraudster rather than the intended beneficiary. (See CIFAS paper, Table 2 Unlawful obtaining or disclosure of personal data: https://www2.cipd.co.uk/NR/rdonlyres/710B0AB0-ED44-4BD7-A527-B9AC29B28343/0/empfraud.pdf)

Manipulation of the payer by the fraudster to issue a payment order

This covers fraud where the payer authorises a push payment to an account the payer believes belongs to a legitimate payee, however, the payer was deceived into inputting the sort code and account number (or other unique identifier) of a fraudster, or an account controlled by a fraudster. This is also referred to as ‘malicious misdirection’. For example, a scammer may contact a victim purporting to be from the victim’s bank. The scammer may then convince the victim to transfer money (using a credit transfer) to a different account, purportedly in order to safeguard it. However, that account is in fact controlled by the scammer. (See Payment Systems Regulator response to Which? Super-complaint: https://www.psr.org.uk/psr-publications/news-announcements/which-super-complaint-our-response-Dec-2016).

Direct debits

Unauthorised payment transactions

This covers fraud where a victim’s account details (e.g. sort code and account number) have been used by the fraudster to set up direct debit payments to an organisation, without the victim’s knowledge or consent, resulting in unauthorised direct debit payments being taken from the account of the victim.

Manipulation of the payer by the fraudster to consent to a direct debit

This covers fraud where a payer is convinced by a fraudster to set up a direct debit and consent to payments being made to an intended payee (the legitimate payee), but the fraudster uses the victim’s details and consent to set up direct debit payments to a different (unintended) payee.

Debit and credit cards:

Issuance of a payment order by a fraudster

Refers to the following types of unauthorised card payment transactions:

Lost or stolen card fraud

This covers any payment fraud committed as a result of a lost or stolen card (except where ‘card not received fraud’ has occurred). (See FFAUK Fraud Facts 2016 https://www.financialfraudaction.org.uk/fraudfacts16/assets/fraud_the_facts.pdf)

Card not received fraud

This covers fraud where a payment card is stolen (with or without the details of the PIN also being intercepted) whilst in transit – after the card company sends it out and before the genuine cardholder receives it. The payment card is then used by the fraudster to make transactions. (See FFAUK Fraud Facts 2016 https://www.financialfraudaction.org.uk/fraudfacts16/assets/fraud_the_facts.pdf)

Counterfeit card fraud

This covers fraud where the fraudster uses a card which has been printed, embossed or encoded so as to purport to be a legitimate card but which is not genuine because the issuer did not authorise the printing, embossing or encoding. (See https://www.financialfraudaction.org.uk/wp-content/uploads/2016/07/Fraud-the-Facts-A5-final.pdf)

Card details theft

This covers fraud where card details have been fraudulently obtained through methods such as unsolicited emails or telephone calls, digital attacks such as malware and data hacks, or card details being taken down from the physical card by a fraudster. The card details are then used to undertake fraudulent purchases over the internet, by phone or by mail order. It is also known as ‘card-not-present’ (CNP) fraud. (See https://www.financialfraudaction.org.uk/fraudfacts16/)

Other

Unauthorised transactions relating to other types of fraud should be recorded under ‘other’.

Modification of a payment order by the fraudster (debit and credit card payments)

This is a type of unauthorised transaction and refers to a situation where the fraudster intercepts and modifies a legitimate payment order at some point during the electronic communication between the payer’s device (e.g. payment card) and the payment service provider (for instance through malware or attacks allowing attackers to eavesdrop on the communication between two legitimately communicating hosts (man in the middle attacks)) or modifies the payment instruction in the payment service provider’s system before the payment order is cleared and settled.

Manipulation of the payer to make a card payment

This would cover card payments that have been authorised by the payer, i.e. using chip and pin, or authenticated online card payments. The customer believes they are paying a legitimate payee, i.e. a merchant, but the payee that receives the funds is not a merchant, but instead a fraudster.

Cash withdrawals

Issuance of a payment order by the fraudster

This refers to the following types of unauthorised cash withdrawals at ATMs, bank counters and through retailers (‘cash back’) using a card (or using a mobile app in place of a card):

1. • those resulting from a lost or stolen payment card;

2. • those resulting from a payment card being stolen (with or without the details of the PIN also being intercepted) whilst in transit – after the card company sends it out and before the genuine cardholder receives it; and

3. • those where the fraudster uses a card to withdraw money which has been printed, embossed or encoded so as to purport to be a legitimate card but which is not genuine because the issuer did not authorise the printing, embossing or encoding.

Manipulation of the payer to make a cash withdrawal

This refers to reported frauds where a payment service user has withdrawn under duress or through manipulation (using a card, or using a mobile app in place of a card).

E-money transactions

The same fraud types as above for debit and credit cards apply to payment transactions involving e-money.

Money remittance and payment initiation services

Fraudulent transactions

Money remitters and PISPs are required under the EBA Guidelines to report ‘fraudulent transactions’. Money remitters and PISPs should use their discretion when determining what to count as a ‘fraudulent transaction’. Where money remitters or PISPs detect the frauds described above, these should be counted as ‘fraudulent transactions’.

Authentication method

For all credit transfers, card transactions and e-money transactions reported, including those initiated by PISP, the PSP should report whether strong customer authentication has been used or not. Strong customer authentication means authentication based on the use of two or more elements that are independent, in that the breach of one element does not compromise the reliability of any other element, and designed in such a way as to protect the confidentiality of the authentication data, with the elements falling into two or more of the following categories—

1. • something known only by the payment service user (“knowledge”);

2. • something held only by the payment service user (“possession”); or

3. • something inherent to the payment service user (“inherence”).

Where strong customer authentication is not used, the PSP should report under which of the following exemptions the transactions have taken place. These exemptions and their application are determined in the regulatory technical standards for strong customer authentication and common and secure open standards of communication (SCA-RTS). As noted in the FCA Approach Document, “The exemptions are separate and independent from one another. Where a payment transaction may qualify for an exemption under several different categories (e.g. a low-value transaction at an unattended card park terminal) the PSP may choose which, if any, relevant exemption to apply. PSPs should note that for the purpose of reporting fraud under regulation 109 of the PSRs 2017 and the EBA Guidelines on fraud reporting, fraudulent transactions should be assigned to a specific exemption and reported under one exemption only.” (paragraph 20.39).

For the purposes of reporting, the applicable exclusions are:

1. • unattended terminal for transport or parking fares (article 12 SCA-RTS);

2. • trusted beneficiary (article 13 SCA-RTS);

3. • recurring transaction (article 14 SCA-RTS);

4. • low value (article 16 SCA-RTS);

5. • use of secure corporate payment processes or protocols (article 17 SCA-RTS);

6. • transaction Rik Analysis (article 18 SCA-RTS);

Data elements