Payment Fraud: Better Consider Victim Remedies

Online credit card payments are becoming more and more secure. Simple authentication with a one-time SMS code has halved fraud in ten years, but it has shown its limits. The advent of strong authentication in 2020 (an advanced security device with different identification modes) has further increased the security of transactions. Thus, the online payment fraud rate decreased from 0.249% of the amount in 2020 to just over 0.10% in the first half of 2022.

However, the imagination of fraudsters is limitless in terms of bypassing the system, and the share of authenticated payments in fraud with payments via Internet cards is 30% in value terms. Their weapon: manipulate cardholders by pretending to be through their bank in order to steal their details, gain access to their accounts, or verify a payment. To do this, they use spoofing, which consists of usurping your bank’s phone number, phishing or smishing, email or SMS options.

13 recommendations made

Thus, in the face of complaints from consumers who are victims of this, represented by banks that delay their refunds, the Observatory for the Security of Payment Methods, which brings together the Banque de France, players in the payment market, representatives of administrations and consumers, issues thirteen recommendations for the better regulation of refund procedures. damage to victims of fraud.

Based on them, the reminder of Julien Lasalle, secretary of the Supervisory Board for the Security of Payment Means: “If strong authentication was carried out at the time of the payment, this does not in itself justify the non-reimbursement of the bank’s share. Because there is no certainty that this strong authentication is fully granted. »

Thus, according to the issued guidelines, when a customer who is the alleged victim of strong authentication fraud declares himself, the bank has one day to conduct an initial analysis of the file. If the establishment fails to demonstrate within this period that the fraud comes from the client himself or that he has committed gross negligence, he must pay damages to the alleged victim. The bank then has 30 days to conduct a more thorough investigation and decide whether to take these funds back.

Banks urged to strengthen security measures

In case of disagreement, the dispute may be referred to the intermediary of the institution or to the court. The Court of Appeal of Versailles also ruled in March in a dispute between BNP Paribas and one of its clients, a victim of spoofing, whom it accused of gross negligence: the institution was ordered to reimburse him 54,000 euros.

In order to minimize disputes as much as possible, banks are also designed to increase security: require strong authentication for any bank account check in front of a new terminal, provide full payment information during the strong authentication process, etc.

The task of scammers should also become more difficult, since with the entry into force of the Naegelen Act aimed at improving the regulation of cold calls, it will become impossible to usurp 10-digit long bank numbers. Until they come up with a new technique of manipulation.