Contingent Reimbursement ModelReexamining the CRM: Is the Code REALLY Effective Against Fraud?

Does the Contingent Reimbursement Model Stop Push Payment Scams?

Regarding fraud, financial institutions generally prefer self-regulatory initiatives for managing and mitigating losses. This is common to most businesses; self-regulation is preferable to outside oversight.

The Contingent Reimbursement Model is a recent example of this phenomenon in the UK. But, does it actually deliver? Let’s find out.

Push vs. Pull Pyments

The Contingent Reimbursement Model seeks to correct issues that arise during the push payment process. So, before going any further, it's important to touch on the differences between “push” and “pull” payments.

The phrase “push payment” differentiates a buyer-initiated payment from a supplier-initiated one. The two payment methods differ in the following ways:

Of course, fraudsters are resourceful, and quickly developed new tactics to take advantage of push payments. In the last five years, we've seen a surge in cases of push payment fraud, with scammers using push payments to cheat users out of their funds. The CRM was developed in response to this.

What is the Contingent Reimbursement Model?

Contingent Reimbursement Model

[noun]/* kən • tin • jənt • rē • im • bərs • ment • mä • dl/

The Contingent Reimbursement Model (CRM) is a UK payments initiative intended to reimburse victims of authorized push payment fraud. In essence, the CRM is a reserve of cash that signatories to the Code agree to fund. The reserve can then be used to reimburse victims of APP fraud attacks.

The consumer protections enshrined under the code took effect in the UK on May 28, 2019. Many signatories introduced their unique long-term funding mechanisms for the CRM fund on January 1, 2020. It features three overarching objectives:

• Reduce occurrences of authorized push payment fraud.
• Protect customers from APP fraud by enabling reimbursement of fraud victims.
• Minimize disruption of legitimate payments.

The UK Payments Systems Regulator also insists that the CRM establishes better incentives for payment service providers (PSPs) to use the measures developed. The CRM was established to prevent and respond to push payment scams and incentivize consumers to remain vigilant.

Despite these claims, many customers have felt the CRM initiative falls short of its promises. We’ll get into more detail on this below. For now, though, let’s take a closer look at the pros—and the cons—of push payment adoption, and see why the CRM was necessary in the first place.

Pros & Cons of Push Payments

A key advantage to the authorized push payment method is that the buyer doesn’t reveal any sensitive information to the merchant. Instead, the merchant receives the funds from the transaction without ever handling the cardholder’s information. There are several advantages to this:

That all sounds great…right? Well, of course, the authorized push payment concept isn’t without flaws. Authorized push payment fraud (or simply “APP” fraud) is a fast-growing new threat source designed to manipulate this payment method.

Over the past decade, there has been rapid growth in APP fraud. Fraudsters are using social engineering techniques to trick people or representatives of businesses into sending money from their bank accounts to a fraudster. This is causing billions of dollars in potential liabilities.

Learn more about APP Fraud

What Does the CRM Code Cover?

Prior to 2020, deciding liability for APP scams was generally left to the banks. This meant that a bank could approve or deny reimbursement for fraud on a whim. As you might imagine, without a regulating framework to govern that process, many consumers were left holding the bill for fraud that was already beyond their control.

Due to consumer and regulatory pressure, banks supplied a faster payment method but failed to increase protections for those payments. The Contingent Reimbursement Model was instituted to rectify a general loss of security resulting from these real-time payments.

This voluntary code provides consumers with a reimbursement mechanism when they’re victimized by APP fraud. If a customer is tricked into authorizing a payment to an account they believe belongs to a legitimate payee, but which is actually a fraudster, the CRM allows for that cardholder to be reimbursed.

The CRM is not simply a pit of free money for anyone claiming to be a victim of fraud, though. It also gives banks the means to reject reimbursement if there is evidence of collusion or first-party fraud.

Recent CRM Code Updates

Initial response to the Contingent Reimbursement Model was mixed. In response,  the financial institutions have committed to several updates intended to allay public concern about any conflicting interests.

On 28 April 2022, the UK Lending Standards Board published a revised version of the CRM code. The revisions to the code are intended to enhance the consumer protections and clarify the requirements for firms signed up to the CRM. These include:

When the Contingent Reimbursement Model was launched in 2019, the provisions which reference Confirmation of Payee (CoP) had a holding date in place.

In October 2021, the Payment Systems Regulator published the outcome of its consultation on CoP. They provided clarity on the actions they expected the industry to take and an overview of how they would support the industry for wider uptake of this service. Now that the CoP has moved into phase 2, the relevant provisions of the Code will be activated by April 2023. Code signatories must implement CoP into the payment journey no later than April 28, 2023.

This terminology caused a lot of confusion between banks and consumers, as it seemed to affect how consumers should behave during a payment. The CRM code is not binding for customers, thus the term ‘requisite level of care’ is to be removed in April 2023.

It should be noted that the CRM represents a framework through which signatory firms are required to reimburse consumers who APP scams have victimized. If reimbursement is to be declined, signatory bodies must adhere to the requirements laid out in the CRM code.

The way in which firms should respond in the event of criminal fraud cases under investigation by banks and law enforcement bodies had also been a gray area in the CRM code. Now, in the event of unfavorable discoveries pending investigation, new language has been added to give the banks time to await the outcome before reimbursement is rendered.

This ensures that consumers are provided with a written explanation of decisions pending investigation, a reasonable timeframe for final review, and notification of the approval or denial of the reimbursement claim. If the customer is denied outright or receives only partial reimbursement, the bank must provide the information that led to such a decision.