Is Fraud Undermining the Direct Debit Scheme?
The direct debit (DD) scheme is a phenomenal success story. Since 1995 the number of DD transactions has increased by 200%. In the same period, the number of cheque transactions for regular payments has decreased by 59%.1 Over 48% of the UK bill-paying population declares the direct debit as their preferred payment method with 74% of users agreeing that the DD makes life easier and 80% of users believing it saves time.2
Apart from convenience, the DD offers users a guarantee that protects both the user and their money.3 Money should not be deducted from an account without the customer knowing the collection amount and date in advance and a DD is as easy to cancel as it is to set up.
DDs are so commercially beneficial for business that many organisations offer customers a discount for paying by DD or levy a charge for not doing so. So effective are DDs at reducing the cost of collecting payments, paying by DD can, in effect, provide the customer with an interest-free loan. Compared with cash, cheques, credit and debit card transactions, the DD is a safe, easy and convenient way to make multiple payments.
The direct credit (DC) scheme is similarly successful. Over 150,000 organisations use it for one-off or repeat payments such as wages and salary payments, pensions, employee expenses, insurance settlements, dividends and refunds. Over 90% of the UK workforce is paid using DC.4 Since 1997 the volume of DCs for regular payments has increased by over 1000% and for spontaneous payments by 885%.5
The advantages are numerous:
To summarise, the DD and DC schemes offer greater flexibility and, in the case of DDs, more security than most alternatives – particularly cheque payments. Furthermore, there is plenty of scope for the continued growth of both DDs and DCs. DDs are expected to grow by a further 125% over the next eight years and DCs by over 200%.6
But is it all good news? With the introduction of Chip and PIN, and the increased security it provides, there is evidence that fraudulent activity has switched from debit and credit cards to DD and DC payments. Does this issue have the potential to jeopardise the growth in popularity of DD and DCs?
The existence of DD and DC fraud is rarely acknowledged by either banks or originating organisations. In the FAQ section of the BACS website, the scheme guarantee is used to deflect questions about fraud:
“It’s very unlikely that this will ever occur because organisations using the Direct Debit Scheme go through a careful vetting process before they’re authorised, and are closely monitored by the banking industry. But if money were to be drawn from your account fraudulently you’d be protected by the Direct Debit Guarantee, and would be entitled to an immediate refund from your bank or building society.”7
This statement is revealing in that it highlights a widespread misunderstanding about the nature of DD fraud. That is, that a DD fraudster will pose as a legitimate DD originator. The reality is that DD fraudsters are much more likely to pose as legitimate customers either by stealing someone else’s details or by using a fictitious account that passes modulus checks but doesn’t belong to anyone.8 The fraudster will exploit the weaknesses of the scheme to obtain money, goods or services through pretending to be legitimate consumers, not legitimate businesses. This has given rise to the perception that problems relating to the DD and DC schemes are not fraud at all, but simply payment processing errors. This perception is exacerbated by the lack of data on DD and DC fraud. The only relevant data that is collected relates to the volume of indemnity claims made by banks against originators. However, these claims – made each time a customer is refunded because of a DD error – include genuine mistakes as well as frauds, and, of course, do not include DCs.
The classic DD fraud is illustrated by the following example.
When purchasing a mobile phone, the customer is required to take out a DD to cover the cost of the contract and additional billing charges. The fraudster simply provides either invalid personal and account details or another person’s correct details. As long as the details provided pass the retailer’s basic modulus checks, the customer is able to leave the store with the phone.
A similar scam is known to be used to obtain insurance cover notes, purchase goods bought on ‘buy now, pay later’ schemes, and acquire services such as satellite TV, TV licences and utility services.
Similarly, DC is subject to fraud. Fraud is possible as the fraudster is able to make multiple applications in multiple names but provide another name and account for the receipt of funds. This means that it can be impossible to distinguish a legitimate from an illegitimate beneficiary.
Much DD and DC fraud is only identified when the originating organisation or the customer’s bank receives a complaint either because the payment has not been made or received, or because an unauthorised payment has been made or received.
Although much fraud is believed to go unnoticed as fraudsters focus on high volumes of low payments (and individuals receiving misapplied payments are unlikely to draw attention to them), large unauthorised withdraws have been recorded, including one for £75,000.9
DD and DC fraud is possible because the systems in place to check on the accuracy of customer-supplied personal and bank information are currently limited to checking the format validity of bank account data.
To prevent DD and DC fraud, two new initiatives are needed:
Action in both these areas would result in a significant reduction in crime relating to DDs and DCs. In turn, both schemes would grow in popularity and rightly acquire the status of the safest and most secure transaction method available in the UK.
For both banks and corporates, increasing the potential take up of DDs and DCs has numerous benefits, as these are the most cost efficient payment and receipt mechanisms in existence. At the same time, reducing the failure rate of DDs and DCs can only be good news for banks and corporates concerned to maintain customer confidence.
1 Payment Market Review 2007, APACS.
2 APACS website.
3 BACS website.
4 BACS website.
5 Payment Market Review 2007, APACS.
6 Payment Market Review 2007, APACS.
7 BACS website.
8 This misunderstanding was repeated in the Observer when the journalist, Margaret Dibben, wrote recently in reply to a customer (June 17 2007): “Banks know the numbers of accounts where direct debit payments end up, so anyone who thinks this scam worth the effort will easily be traced. Also the banks impose a responsibility on companies taking money under direct debits to be certain that the person who organised the direct debit owns the bank account. If BT let a fraudster slip through, it would have to refund the bank, which would reimburse you. Under the direct debit guarantee, banks immediately refund customers with any money wrongly taken.”
9 Ebay UK fraud alert.