SMEs are the bedrock of the economy – they need to be part of the APP fraud conversation

The recent decision by the Payment Systems Regulator (PSR) to mandate that banks and payment companies refund victims of Authorised Push Payment (APP) fraud up to £85,000 within five days has created a rift in the financial ecosystem.

While the move was welcomed by some in the consumer protection space, others – particularly SMEs and the FinTechs that support them – are less convinced. This ruling has profound implications for small businesses and the UK’s payments industry, who together form the backbone of the UK economy but often struggle to be heard or taken into account in regulatory debates.

What is APP Fraud and why are PSPs pushing back?

APP fraud occurs when consumers are tricked into authorising payments to scammers. In response to growing public pressure and the alarming rise in scam cases, the PSR introduced new rules designed to protect consumers by making it mandatory for payment service providers (PSPs) to refund victims promptly.

Naturally, this has been met by cries of outrage from PSPs. The original maximum reimbursement amount of over £415,000 has been reduced significantly because of these complaints, and this seems logical, since such large amounts warrant proper investigation rather than being immediately refunded. There is a deeper problem however, and it’s not a popular sentiment: the point of failure in APP fraud doesn’t come from payments companies, it comes from consumers. Try to send a friend a few pounds to cover your half of a bill through your banking app and you will be bombarded with messages telling you to think twice, consider if they are who they say they are and so on. Human beings have an incredible capacity for believing that they can’t be scammed: remember the financial journalist who was persuaded to hand over $50,000 in a shoebox to scammers claiming to be from the CIA? Pop-up messages warning us of likely scams aren’t going to break through the wall of delusional self-belief that powers romance scams and the like.

The communication challenge

At the heart of this issue is a deeper, more systemic problem: regulators and policymakers often struggle to listen to the voices of PSPs and their customers. Large corporations can afford direct access to decision-makers through lobbyists, trade associations, or industry groups. These organisations ensure that the needs and concerns of major players are consistently communicated to government bodies.

This is not to say that regulators deliberately exclude PSPs, but the process of gathering feedback and input is naturally weighted towards larger entities. Regulators need comprehensive input, and the fragmented, diverse needs of PSPs and the small businesses they serve make it difficult for them to find common ground. The voices of FinTech companies and small payment service providers – those tasked with navigating the complex landscape of fraud prevention and financial compliance – are often drowned out by larger, louder institutions.

The knock-on effects for SMEs

SMEs are the lifeblood of the UK economy, 5.6 million small businesses and three-fifths of the employment. They are the drivers of innovation, growth, and local employment. Yet, their significance goes beyond mere numbers. Small businesses are flexible, responsive, and deeply embedded in their communities, offering products and services tailored to local needs.

These SMEs rely on PSPs to process every one of their payments. Each one has to work with a payments partner, and some may have very specific needs that only specialist PSPs can accommodate.

For SMEs, particularly in the financial services sector, innovation is critical. FinTechs and smaller payment providers are the ones who often drive the digital transformation of financial services. Their capacity to provide niche, targeted services that meet the needs of small and medium-sized enterprises ensures that local businesses thrive. However, regulations that are overly burdensome, such as the recent APP fraud rules, risk stifling their ability to serve these very businesses.

Who pays the price for fraud?

While large financial institutions (FIs) may have the resources to absorb the financial risks associated with refunding APP fraud victims, smaller PSPs do not. For a FinTech company or a smaller payment processor, being forced to pay out thousands of pounds in refunds without time for due diligence or investigation could be crippling. The risk of being held liable for consumer mistakes creates an environment of uncertainty. This could lead banks and payment companies to tighten their rules, reduce their risk appetite, and increase the costs for the SMEs they serve.

Moreover, if the cost of complying with APP fraud rules becomes too high, smaller FIs may start withdrawing services from SMEs altogether. For example, stricter criteria for working with smaller businesses, increased fees, and more restrictive service offerings may become the norm. In the long run, this could hurt not only the SMEs directly involved in the payments space but the wider ecosystem of small businesses that rely on affordable and accessible financial services.

It’s important at this point that we consider not only that consumers are being scammed, but which people those are. The victims of this kind of fraud are often society’s most vulnerable, and the new regulation could well mean we end up penalising those that are already struggling with financial inclusion because they are seen as a more likely target for APP fraud. One could hardly blame SMEs for also being more cautious about who they accept for fear of having to fit the bill for their being scammed – a dynamic that doesn’t serve anyone.

What can be done

The best solution to preventing APP fraud is stopping it from happening in the first place. Educating the public should always be the first line of defence, and whenever thinking of new regulations regulators should always ask themselves ‘have we done enough to educate the public?’ Could resources be better used to stop ordinary people from falling for romance scams and the like?

In the absence of total prevention, a system needs to exist where there is a balance between accountability, responsibility and liability. Consumers need to be protected, but so do the SMEs and fintechs that support them. Ultimately, if regulators want to foster a financial ecosystem where innovation can flourish and consumers are protected, they must recognise that PSPs are essential stakeholders. By creating a system that allows their voices to be heard, regulators can ensure that new rules work for everyone, not just the biggest players.