Publishing and copyright information

The BSI copyright notice displayed in this document indicates when the document was last issued.

No copying without BSI permission except as permitted by copyright law.

Publication history

First published 2017

Foreword

This PAS was sponsored by NatWest. Its development was facilitated by BSI Standards Limited and it was published under licence from The British Standards Institution. It came into effect on 31 October 2017.

Acknowledgement is given to the following organizations that were involved in the development of this PAS as members of the steering group:

Barclays
Building Societies Association
Consumer & Public Interest Network
Financial Fraud Action UK^*
Home Office Joint Fraud Task Force
KMB Telemarketing Ltd
Metropolitan Police
National Trading Standards
NatWest
Office of the Public Guardian
Santander UK plc
Scottish Business Resilience Centre
The Co-Operative Bank plc

Acknowledgement is also given to the members of a wider review panel who were consulted in the development of this PAS.

The British Standards Institution retains ownership and copyright of this PAS. BSI Standards Limited as the publisher of the PAS reserves the right to withdraw or amend this PAS on receipt of authoritative advice that it is appropriate to do so. This PAS will be reviewed at intervals not exceeding two years, and any amendments arising from the review will be published as an amended PAS and publicized in Update Standards.

This PAS is not to be regarded as a British Standard. It will be withdrawn upon publication of its content in, or as, a British Standard.

The PAS process enables a code of practice to be rapidly developed in order to fulfil an immediate need in industry. A PAS can be considered for further development as a British Standard, or constitute part of the UK input into the development of a European or International Standard.

Use of this document

As a code of practice, this PAS takes the form of guidance and recommendations. It should not be quoted as if it were a specification and particular care should be taken to ensure that claims of compliance are not misleading.

Any user claiming compliance with this PAS is expected to be able to justify any course of action that deviates from its recommendations.

It has been assumed in the preparation of this PAS that the execution of its provisions will be entrusted to appropriately qualified and experienced people, for whose use it has been produced.

Presentational conventions

The guidance in this standard is presented in roman (i.e. upright) type. Its recommendations are expressed in sentences in which the principal auxiliary verb is “should”. The word “may” is used in the text to express permissibility, e.g. as an alternative to the primary recommendation of the clause. The word “can” is used to express possibility, e.g. a consequence of an action or an event.

Commentary, explanation and general informative material is presented in smaller italic type, and does not constitute a normative element.

Where words have alternative spellings, the preferred spelling of the Shorter Oxford English Dictionary is used (e.g. “organization” rather than “organisation”).

Contractual and legal considerations

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with this PAS cannot confer immunity from legal obligations.

Particular attention is drawn to the following regulations, and their equivalents in the different countries of the UK:

Equality Act 2010 [1];
Payment Services Regulations 2009 [2];
Second Payment Services Directive 2016 [3];
Money Laundering Regulations 2007 [4];
Proceeds of Crime Act 2002 [5];
Mental Capacity Act 2005 [6];
Criminal Finances Act 2017 [7];
Fraud Act 2006 [8];
Adults with Incapacity (Scotland) Act 2000 [9];
Adult Support and Protection (Scotland) Act 2007 [10].

Introduction

Financial harm is the loss of an individual’s money or other assets that occurs as a result of fraud or financial abuse perpetrated by a third-party. Fraud is a criminal act involving deception or omission intended to result in financial or personal gain, or to cause loss to another party. Fraud can be carried out by individuals or organized crime groups, who constantly devise new and sophisticated methods to: deceive individuals; stay a step ahead of organizational fraud prevention measures; and evade enforcement agencies. Financial abuse is the criminal act of controlling a person’s property, money, pension book or other valuables intended to result in the financial or personal gain of the abuser. It is carried out by people in a position of trust, such as partners, relatives, friends or carers.

Fraud and financial abuse are both illegal acts.

Cases of fraud and financial abuse are widespread. In 2016, there were a total of 1,857,506 cases of financial fraud in the UK, according to Financial Fraud Action UK [11]. During 2016, financial fraud losses across payment cards, remote banking and cheques totalled £768.8 million, an increase of 2% compared to 2015 [11]. Certain types of fraud, such as mobile banking, and scams directly targeting customers, are on the rise [11].

However, experts believe that only a fraction of all fraud cases are reported [12]. Consumers might not realise that a crime has taken place; they might not know where to report incidents; or might be too scared or embarrassed to tell anyone what has happened.

Anyone can be a target of fraud or financial abuse, but there are a number of factors that can contribute to financial harm (see Figure 1). Some individuals are more susceptible to fraud and financial abuse, or more likely to suffer financial harm. This can include individuals in vulnerable circumstances, either temporarily or permanently, which can affect their ability to communicate, understand, make decisions or take actions that are in their best interests.

The way that organizations treat customers can also contribute to levels of financial harm. Inadequate systems and procedures that fail to inform, protect and support customers can exacerbate existing consumer vulnerabilities, making it more likely that fraud or financial abuse will result in financial harm.

This PAS aims to help organizations protect customers from financial harm, by identifying good practice in systems and procedures to prevent and detect fraud and financial abuse, recognizing customers who might be susceptible to risk, and advising on the best way to respond to certain situations. This PAS provides detailed recommendations, guidance and a comprehensive checklist to organizations that want to implement change, to achieve or maintain levels of good practice.

Working together has many benefits for financial service providers, as well as fraud prevention organizations, enforcement agencies, and consumers. Sharing knowledge, experience and intelligence, within the limits of current legislation, can help to build stronger defences against fraud and financial abuse and reduce the impact of financial harm. Organizations that comply with this PAS are encouraged to explore opportunities for collaborative working, at both a local and national level, to ensure consistent messaging and effective protection for consumers.

1 Scope

This PAS gives recommendations to organizations for protecting customers from financial harm that might occur as a result of fraud or financial abuse.

The PAS also gives guidance on how to recognize customers who might be at risk from fraud and financial abuse, how to assess the potential risks to the individual and how to take the necessary actions to prevent or minimize financial harm.

In cases where fraud or financial abuse has already occurred, the PAS gives guidance on how to help and support customers, and how to minimize future risks.

This PAS does not cover financial services provided to businesses, organizations that only hold, manage or process personal data, or the sale of products and services by retail organizations. It does not cover financial service providers operating outside the UK, even if they are providing services to UK consumers.

The PAS is applicable to any size or type of organization, operating in the UK, that manages the money or other financial assets of UK consumers, in particular banks, building societies, credit card providers, credit unions, and pension providers.

NOTE 1 This PAS could also be of interest to local authorities across the UK that provide social care services.

NOTE 2 This PAS cannot help organizations to prevent fraud or financial abuse from external threats, but aims to help them minimize or prevent the financial harm experienced by customers as a result of these activities.

NOTE 3 Fraud or financial abuse can involve transactions which are not authorized by the customer, or are authorized by a customer who has been deceived or socially engineered by a criminal.

2 Terms, definitions and abbreviations

3 Organizational principles, culture and strategy

3.1 General principles

3.2 Organizational culture

3.3 Customer fraud prevention strategy

Service planning and design

4.1 Review existing practice

4.2 Customer service

4.3 Identification and provision of resources

4.4 Effective partnerships and communication

4.5 Maintaining expertise

4.6 Staff training and support

4.7 Record keeping and data sharing

Systems and tools for the prevention and detection of fraud and financial abuse

5.1 General

5.2 Prevention of fraud and financial abuse

5.3 Detection of fraud and financial abuse

5.4 Responding to fraud and financial abuse

Helping customers to make informed decisions

6.1 Communicating with customers

6.2 Raising awareness

6.3 Practical guidance

6.4 Further information

Identifying customers at risk from financial harm

7.1 Frontline staff observation

7.2 Clarifying concerns with the customer

7.3 Checking systems for evidence of fraud or financial abuse

Taking action to prevent or reduce financial harm

8.1 Risk assessment

8.2 Preventative action

8.3 Remedial action

8.4 Further action

Service evaluation

9.1 Customer feedback

9.2 Staff feedback

9.3 Complaints

9.4 Performance monitoring and evaluation

9.5 Continual improvement

Bibliography

PAS 17271:2017

Protecting customers from financial harm as a result of fraud or financial abuse. Code of practice

Published:

31 Oct 2017

Withdrawn:

13 Jun 2022