Consumer magazine Which? has issued a warning over a dangerous new card scam in which victims are tricked into approving card payments. The group said the scam could also be used to get people to make bank transfers for large sums of money.
Scam tactics
Which? described the scam as a “critical wake-up call” after years of security efforts focused on fighting fraud involving bank transfers. The consumer group is concerned that fraudsters are cashing in by convincing victims to approve card payments, rather than just sending money directly from their bank accounts.
In a typical scenario, a fraudster cold calls the victim, pretending to be from a bank’s security team, the police, or a regulator, and claims the account is under attack. The victim may be asked to move money to a “safe account” or to approve payments in their app, supposedly to stop fraud. Scammers may also manipulate victims into sharing one-time passcodes to add the card to their own digital wallet.
Refund challenges
Which? noted that unauthorised card fraud is generally refunded, but people who are manipulated into approving payments to scammers may face more hurdles getting their money back. If someone authorises a payment to a legitimate company that turns out to be part of a scam, they may struggle to claim a refund, even if the money ends up with criminals.
The chargeback and Section 75 mechanisms are primarily designed for unauthorised charges or issues like non-delivery, faulty goods, and misrepresentation. This leaves authorised card fraud victims in a devastating situation, as the company has provided the intended services, albeit as part of a fraud chain.
Comparisons with APP fraud
Authorised push payment (APP) fraud, where people are tricked into transferring money to criminals, has been under the spotlight in recent years. In October 2024, mandatory APP fraud reimbursement rules came into force, requiring banks to reimburse victims unless the customer has been grossly negligent. The rules apply to transfers between UK bank accounts, with a reimbursement limit of £85,000, though banks can choose to repay higher amounts.
Which? said that, like APP fraud, authorised card payments can also feature in romance scams, investment scams, and criminals impersonating banks.
Expert advice
Lisa Webb, a consumer law expert at Which?, said: “This is a particularly dangerous scam since card payments fall outside of the automatic refunds that banks are obliged to provide for authorised push payments.” She advised victims to “always raise a claim with your card provider and escalate to the Financial Ombudsman Service if needed, providing full details of how you were manipulated into approving the payments.”
Which? is calling on account providers to step up defences and publish further industry data on card fraud. A UK Finance spokesperson said: “Fraudsters use a wide range of tactics to trick people, including impersonating banks and well‑known organisations to bypass security checks such as one‑time passcodes.” They urged people to “never share sensitive information – including one‑time passcodes – with anyone other than a service you were expecting to hear from” and to hang up and call back using the number on the back of a card if they receive an unexpected call from someone claiming to be their bank.
