Banks will be obliged to compensate customers for money stolen by fraudsters: but there are nuances

Experts questioned the effectiveness of this method of combating financial scams

Banks that sent the client’s money to a fraudulent account are required to return it to the person within 30 days. Such an amendment to the federal law “On the National Payment System” was proposed by the Central Bank. The idea itself is sound and noble, but it has a strict law enforcement framework. In particular, we are talking only about those situations where a suspicious account is listed in the database of the regulator. And if it is not listed, but the money went to someone unknown? After all, the Central Bank is not an all-seeing eye, its control possibilities are not unlimited. And the banks themselves do not need this trouble at all.

The current law does not stipulate the terms during which banks must reimburse customers for funds stolen by intruders. As the head of the information security department of the Central Bank Vadim Uvarov explained, now these terms can be set exactly – 30 days (from the moment the application is received from the client), and for cross-border transfers – 60 days. In addition, the regulator proposes to suspend the transfer of funds to a doubtful account for two days.

The amendment intersects with the draft law on information exchange with the Ministry of Internal Affairs, which has already been adopted by the Duma in the first reading. The document provides for the connection of this department to the FinCERT automated system, which receives information about transfers (or attempts to transfer) money to fraudsters. Thus, the security forces will be able to track dubious transactions online while observing all the rules on bank secrecy. But here, according to Russian custom, the saying “it was smooth on paper, but they forgot about the ravines” comes to mind.

“The level of cyber-fraud in Russia today is prohibitively high,” says Nikolai Pereslavsky, an employee of the Economic and Financial Research Department at the CMS Institute. – In 2021, banks alone transferred funds in the amount of 13.5 billion rubles to fictitious accounts. But only 6.8% of this amount was returned to customers. In 2020, the share of returns was 11.3% of the total amount of stolen funds, and in 2019 – 14.6%. As the mechanisms and methods of deception become more and more sophisticated, the adoption of emergency measures at the state level is overdue.”

In Pereslavsky’s opinion, the Central Bank’s initiative has both obvious advantages and equally unconditional risks. On the one hand, the ability to suspend for two days any transfers to a suspicious account is undoubtedly useful. During this time, a bank client who has become a victim of scams will get a chance to catch on and save money. At the same time, credit institutions themselves will receive an additional headache and financial burden. They will have to allocate part of the capital from the turnover and send it to pre-created funds, and from there they will compensate the victims of fraudsters for losses. It will not be difficult for banks from among the top 10 to do this, but for the rest, which have a much smaller margin of financial strength, there may be huge problems, up to bankruptcy.

“According to the law, the responsibility for transfers made by a citizen from his bank card or account lies with him,” notes Petr Gusyatnikov, senior managing partner at PG Partners law firm. – That is why it is so difficult to deal with scammers using social engineering methods. The person seems to voluntarily hand over their personal information, including passwords. The bank is just an executor, it cannot reliably know who exactly the money is going to. By the way, because of this approach, it is almost impossible to cancel erroneous operations, when, for example, a person made a mistake in the details and the money went to the wrong addressee.

The measures proposed by the Central Bank can to some extent reduce the number of fraudulent activities, but they will not protect citizens by 100%. The fact is, explains Gusyatnikov, that banks want to oblige to compensate for transfers that are made to accounts located in the Central Bank’s dropper database (droppers are recipients of illegally debited money). But far from all accounts are contained there, and attackers are constantly finding new options. As soon as the account gets into the “black list” of the regulator, they start using others and manage to deceive more than one person.

“As for banks, they will also look for all sorts of loopholes so as not to pay customers,” says Gusyatnikov. – Most likely, the victims will have to collect an impressive package of documents, including from the Ministry of Internal Affairs. In turn, the police extremely dislike such cases, since it is difficult to expose scammers, they often work from other states. Accordingly, individuals run the risk of facing a lot of delays. Also, the option of litigation is not ruled out, when the bank will prove its case, and the citizen – his.