Rising Fraud, Cybersecurity Threats, and APP Reimbursement Burdens
The increasing incidence of fraud is rapidly emerging as one of the key structural constraints in the UK digital payments system, affecting banks' cost structures (both the pay-in and pay-out side), consumer trust and regulatory expectations all at the same time. The Payment Systems Regulator (PSR) has recorded that Authorised Push Payment (APP) fraud is the fastest-growing category of fraud and that APP fraud losses surpass £485m in 2023 as recorded in UK Finance evidence.
A major restraint is that digital payments, particularly instant payments, compress verification time; attackers now have more options to attack consumers across difficult-to-verify areas such as phishing, social engineering, impersonation and mule accounts. In addition, and relevant to this evolution of fraud is the PSR's new reimbursement regime, which will take effect across the UK in 2024-2025, requiring banks to refund victims up to £415,000, further increasing liability on payment providers and leading to significant ongoing conversations in the industry regarding implementation, risk-sharing and feasibility for operational purposes.
This evolution is placing even greater imperative on financial institutions for investment in fraud analytics systems, behavioural biometric identification systems, and AI-based transaction monitoring systems. While this trend toward diligence may yield positive outcomes in the medium- and long-term, there is a substantial immediate cost borne by banks and marketplaces that will fall most heavily on the smaller banks and fintechs with less capital reserves, and less sophisticated fraud monitoring systems that can match those developed by the incumbent banks.
Operational issues will also be felt, as any dispute resolution, verification of a legitimate claim, or detection of an attempt to defraud banks from reimbursing a fraudulent transaction, now raises the stakes for back-office resources to be deployed in ongoing verification and compliance to meet consumer protection regulations.
The digital channels - mobile banking, social media, and messaging apps - represent new forms of fraud; in fact, the National Crime Agency has indicated that over 70% of APP fraud originates outside of the bank (e.g. social media account refunding), which creates a challenge around the onus of shared accountability on cross industry fraud. Even with Strong Customer Authentication (SCA) lowering the fraud rates of card-not-present products, criminals rapidly pivoted to using impersonation.
The cumulative strain is apparent: as the breadth and depth of fraud evolve, and require stricter reimbursement protocols, there are tensions around the economics of real-time, account-to-account (A2A), and open-banking payments; reducing friction in payments is not congruent with protecting the consumer from fraud, nor merchants from increased liability or expectations of compliance, nor friction for merchants onboarding techniques.
This environment could also have an effect of inhibiting innovations in the digital payments infrastructure further while the industry waits for the payment providers to establish standardized fraud prevention tools and resources, and share intelligence on scale, and build a collaborative ecosystem on fraud protection.
Financial Exclusion Risks and Uneven Digital Readiness Across Demographics & Regions
While the UK is relatively advanced in terms of digital payments, it still has a sizeable and sensitive issue of financial exclusion that inhibits full market digital adoption. According to the Financial Conduct Authority (FCA), 1.2 million UK adults remain unbanked and underbanked, and according to the Financial Inclusion Commission over 7 million people experience issues with respect to digital literacy. The disparate demographic levels create a structural barrier; as long as large segments of the population cannot access the internet reliably, have difficulties using smartphones or are simply unsure about their confidence to use mobile banking, digital payments will not be able to scale uniformly. The push towards a digital first economy in the UK, which is extraordinarily ambitious, though well-intentioned, risks unintentionally sidelining vulnerable populations, in particular the elderly, people living in remote areas, lower-income households and persons with disabilities.
Geographical differences in the countryside also create barriers to victims. Ofcom data indicates that 6% of the UK’s rural premises do not have reliable 4G or fibre coverage, which puts the reliability of mobile banking or digital wallet payments at risk. Meanwhile, cash remains a functional necessity for many communities which the Bank of England’s Access to Cash Review identified cash is a necessity for 5 - 6 million people, rather than just comfortably. Furthermore, as banks continue to close branches, almost 5,000 since 2015, concerns about accessing ATMs, cash deposits, and interacting with financial services simply increase.
Digital exclusion also affects merchant adoption, or businesses that merchants run. Micro-businesses, local shops, and rural traders who simply do not have high-quality connectivity, affordable POS, or knowledge of compliance or onboarding already create problems. In addition to some of these barriers, the operating costs of expenditure with card acceptance and awaiting settlement create legitimate friction that slows down the migratory pattern away from cash.
The restraint is systemic as digital readiness gaps create an imbalanced adoption curve, decrease A2A and mobile payment scalability, and slow national-level digital inclusion. The digital payment space moving forward will remain resident by persistent socio-economic divide unless the UK uniquely strengthens digital literacy programs, expands telecom infrastructure outside of major urban and suburban centers, and respects and maintains access to cash.
Fragmented Payments Infrastructure, Legacy System Dependencies, and High Integration Costs
The landscape for digital payments in the UK is constrained by a difficult mix of fragmented infrastructure, outdated banking technologies, and sponsored merchants and payment providers for high cost of integrations and operations. The market is changing and moving towards modern rails, like Faster Payments (FPS), Open Banking, and the future New Payments Architecture (NPA), but still maintains a fragmented technical landscape by having multiple systems, specifically, operating open-banking accounts, Bacs, CHAPS, card schemes, e-wallets, FPS, and hosting their API. HM Treasury’s Future of Payments Review (2023) describes the UK has a "crowded and overlapping" payments ecosystem, making it more difficult for a financial institution to implement any new technology.
While some of this will be resolved through the NPA, legacy banking systems in the largest banks remain a deep constraint. Many of the biggest institutions are operating banking systems based on decades-old infrastructure, making it more difficult and less agile to assess real-time, non-ISO 20022 data flows in and out of their systems—make it too difficult to change to principles of the updates, such as fraud engines utilizing AI and preparing for next generation payment initiation with APIs hosted by banking providers. Modernisation of a legacy core banking platform and API onboarding will require sometimes multi-year investment programs requiring, financial institutions to not only understand the regulatory landscape, but require the coordination across a bank, and all have a very high operational risk. Moving up the size ladder, but especially not the fintects, onboarding with legacy platforms can create delays, inconsistent and unpredictable onboarding time, and an expensive authorisation system to onboard any payment type to be compliant.
Merchants can experience similar friction.
