Perspectives on Fraud and the Payments Services Directive
At a recent payments conference for corporates hosted by Experian, Gareth Lodge from the TowerGroup asked the 350 attendees how many knew something about the Payment Services Directive (PSD). Less than 10% put up their hands. Worse, only a few had actually been approached by their bank to discuss the PSD’s implications, unaware that the PSD is set to change the fundamental legal basis on which payments are made and received amongst the 27 members states of the European Union (EU) when it comes into force on 1 November 2009.
To date, much media attention has focussed on the implications of harmonisation, better regulation and standardisation of the relationship between payment providers and payment users. However, there has been relatively little discussion about how the PSD influences other industry topics, such as payment fraud and risk.
It is also a common misconception that the PSD will have an impact only on banks and those organisations proposing to become payment institutions. Businesses, too, will need to make changes to benefit from the clearer terms and standardisation embodied in the directive.
Banks and businesses alike need to consider the implications of the ‘new legal framework for payments’ on their operations and specifically focus on the points in the business processes where fraud may occur.
The PSD comes into force on 1 November 2009 across the EU, the European Economic Area (EEA) and Switzerland. By this date, corporates are encouraged to assess the implications it has on them. This is not as easy as it sounds because, although there is a harmonised core of legislation, each member state is offered a number of derogations or options on how it will transpose the PSD terms into national law. That means that a corporate must assess the impact of the PSD in each of the countries as the implications in France, for example, may be different from those in the UK. So, instead of a single, new, legal framework for payments, we are almost certain to end up with variations on a theme. As a result, banks will almost certainly require corporate customers to sign replacement or additional contracts to remain PSD compliant.
The PSD will have other implications too. Changes to the direct debit refund period, provided in the UK under the Direct Debit Guarantee, will mean that in some countries, consumers will have longer to dispute direct debit transactions. This will potentially end the unlimited guarantee currently in existence in the UK. Whether we achieve harmonisation across the EU for this is a moot point as it is likely that each country will choose its own criteria for its own customers.
Corporates will also need to think about the implications of unique identifiers. The PSD did not go so far as to mandate a single unique identifier, such as an International Bank Account Number (IBAN), and therefore individual countries may use different data standards. The UK, for example, may choose to simply use sort code and account number.
Finally, as clearing speeds up across Europe with D+1 clearing by 2012, corporates will need to assess the change to their business processes.
It is clear that these changes will impact significantly on the business processes of both the corporates and banks. Many corporates currently have business processes in place that are tuned for a set of local environments and optimised for the payment systems currently in operation. Any change to the underlying assumptions on how those payments are made, for example changing the destination account to the IBAN format, will impose a number of changes on those business systems. With domestic bank account data, the business may well check the bank code against a reference list and check the validity of the account number against the rules for accounts at that bank branch, commonly referred to as modulus checking. However, many businesses are being encouraged to check just the envelope of the IBAN and skim over the information inside.
Corporates therefore need to consider how they can operate effectively in a pan-European and harmonised manner. For many organisations this will be a case of identifying and breaking many long-held assumptions.
From the UK’s experience of Chip and PIN, it seems clear that when the PSD tightens up on fraud in one area, fraudsters attempt to exploit perceived weaknesses in other areas. So, fraud will be both positively and negatively impacted. However, there are two main considerations. First of all, there is the safety of the payment institutions and secondly, the security of payment mechanisms.
First, the PSD now regulates payment institutions in addition to banks, so some payment service providers who managed to avoid the regulator will now be caught. Of course this may mean that they register in jurisdictions for which the regulation is perceived to be light and then ‘passport’ their payment services to other PSD countries. However, the PSD goes a long way to establishing regulation over what constitutes a payment account and the idea of a credit account, normally maintained by a bank. Perversely, this may force some payment services providers (PSP) to become banks. One thing is certain, if the regulation works, there is more certainty for the funds of the consumer and a clearer agreement between the payment institutions and their customers.
Second, the PSD will change the terms of the direct debit refund period. This is span of time during which a consumer can request a refund for a direct debit transaction on their account. Some countries will see an improvement for their customers. Germans, for example, will now get at least eight weeks to identify misapplied, erroneous or fraudulent transactions and request refunds from their bank. Other countries have more favourable terms for their consumers with the UK, for example, having an unlimited refund period. This means that there may be an impact on how fraudulent transactions may be handled, differing country-by-country across the PSD area.
The concern is that fraud will increase because of the pan-European nature of SEPA Direct Debits and that some countries with more lax regulatory regimes may host the fraudsters, at least in the short-term.
Banks and payment associations have historically focussed on fraud in the cards industry but EMV has not only forced fraud out from the cardholder-present transaction to the cardholder-not-present (CNP) and foreign, non-EMV areas, but also moved it to different payment instruments such as direct debit. Unfortunately, companies, banks and the industry in general have not yet focused on direct debit fraud as much as they have been focusing on card fraud. Typically, direct debit fraud is mostly treated as theft1 or given an industry-specific term, such as subscription fraud used in the mobile telecoms sector.
We must ensure, therefore, that card fraud is increasingly prevented and that criminal activity does not spill over into our more trusted, volume payments.
Despite confidence in the financial services industry being undermined by the credit crunch, banks are still the trusted advisors to their corporate customers. It is therefore up to the banks to educate their customers on the implications of the PSD in each of the territories that the corporate operates.
At the same time, businesses must assess their processes to identify where fraud could occur. This must be throughout the process of acquiring or changing customer payment information, from initial application to customer service. Preventing fraud is like repairing a burst pipe – only when all the holes have been plugged will there be no leakage. Businesses must therefore look at their current processes for authentication of individuals, how they capture their payments data, what they can do to ensure that the individual concerned is associated with the bank account and how they can detect payments or business processes which are likely to be fraudulent.
For example, if an insurance company receives a letter from a customer requesting them to close their account and pay into a new account number, what must they do to check that that request is valid? Certainly contacting the customer is important but what if they are not able to reach them in a reasonable timeframe? Validating the new account information against the customer’s name should also be performed wherever possible. Anecdotal evidence suggests that whilst authentication and know-your-customer is at the front of corporate minds when signing a customer up, it is seen as less important and, in some cases, an unnecessary impediment to good customer service.
The PSD changes the environment for fraud and we can be certain that when the payment environment changes, the type of fraud attempted changes. It will be difficult to foresee the types of frauds perpetrated, but the increased regulatory regime must help to detect and eradicate it. With the opening up of the payments area alongside the PSD, however, it is clear that the opportunity for domestic payment fraud using the schemes which process the most value domestically, such as credit transfers and direct debits, can only increase. If we as an industry are to avoid a situation where we create homes for fraud within the EU in the way that Nigeria became a home for phishing in the last decade, we must detect and prosecute perpetrators robustly in addition to taking up prevention mechanisms.
Only by looking at end-to-end processes from the fraudster’s viewpoint and identifying potential weaknesses can business processes be made more robust. Connecting the individual’s identity to their bank account and address is one solution. It is only by linking these three pieces of information, the payments’ trinity, that corporates can really be sure of their customer information and, more importantly, the source or destination of their customer’s funds.
The PSD will clarify a number of key points, including the unique identifier for a customer’s account, but it is only by challenging assumptions and actively looking for holes in business processes that it can really help to improve a corporate’s fraud and risk position.
1Experian Payments’ research on Fraud in the UK, April 2008.