WORRYING gaps in online banking security systems that could help criminals to scam customers, have been exposed in a new investigation.

And the consumer organisation Which? says it reinforces why banks must do more to protect their customers and says reimbursement of bank transfer scam victims must be made mandatory. 

READ MORE: Serious failings' - TSB reported to regulator as Scots banks come under fire for online account security issues

Concerns have been raised with the Financial Conduct Authority (FCA) about Edinburgh-based TSB bank's online banking login processes as it joined Edinburgh-based Tesco Bank as the worst in the UK in their probe into flaws in online banking security that could help criminals to scam customers.

Gareth Shaw, Head of Money at Which? says in a new commentary for The Herald  that some banks are unfairly denying reimbursement and that there has to be changes.

"In recent years the marketing campaigns of financial firms have focused on projecting themselves as caring and sentimental businesses, a theme that has only become more commonplace in recent months.  

"But what happens when you fall victim to a bank transfer scam? 

 "Nowadays, fraudsters use hideously sophisticated tactics that any of us could fall for - criminals hacking your builder or solicitor and requesting money from you at exactly the time you were expecting to make a bank transfer. Or, using readily available software, they can insert a bogus message into a series of legitimate texts from your bank.

 "Most banks and building societies are signed up to a voluntary code which pledges to reimburse customers who have fallen victim to this type of fraud, implemented following a Which? super-complaint in 2016, when we took action to ensure better protection for customers. 

 "However, some of these supposed guardians of our money are now reportedly considering watering down the voluntary code’s standards on reimbursement, by proposing to remove entire categories of fraud. 

 "With our research today showing that lax security measures from some banks and building societies could be granting criminals the tools to carry out this type of crime, attempting to reduce fraud protections is exactly the opposite of what banks should be doing. 

The Herald:

 "The voluntary code was initially based on the assumption that the victim should be reimbursed, and only in a limited number of circumstances should banks reject a customer. 

"However, some banks are unfairly denying reimbursement. In some cases that we’ve analysed, they are putting the blame on the customer for missing often inadequate warnings on their websites. And it’s not just us that believes this is too harsh - the organisation that oversees the code, the Lending Standards Board, thinks some banks and building societies aren’t following the rules they agreed to. 

"This fundamentally undermines the protection offered to consumers that should ensure they get their money back.

" In fact, figures from the UK Finance show that of the £126.5 million that was lost to authorised push payment (APP) fraud in cases assessed under the code in the first half of 2020, just 38 per cent of the total was returned to customers, while research from the Payments Systems Regulator found that one bank was fully reimbursing customers just 1 per cent of the time.  

" The reimbursement rates for all the major banks signed up to the code are known to the industry and the payments watchdog, the Payment Systems Regulator, but neither will reveal them.  We don't know their reason for this but from the outside the lack of transparency makes it look like the banks are standing by each other, rather than with their customers.

 "The only bank prepared to break from the pack on fraud is TSB. It is not signed up to the voluntary code, but instead has its own guarantee to refund customers who fall victim to fraud. As a result, it’s reimbursement rate is close to 100 per cent. 

"The voluntary code that can let a bank pick and choose which rules it wants to apply with impunity doesn’t work, and an urgent overhaul is needed. 

 "Far greater transparency is required. The industry must publish how much money each bank returns to customers who have fallen victim to this type of scam, so consumers can establish which banks are treating their customers fairly and consistently, and which ones abandon them - a move that would almost certainly drive up standards across the board.

 "The government should also work with regulators to make reimbursement for  APP fraud mandatory. In the meantime, banks should continue to protect customers from all bank transfer scams.

 "Without taking these steps, there’ll be no end to the lottery that thousands of consumers face to get their money returned, and it’s possible that even greater odds will be stacked against them at a time when they most need support."