Banks’ scam compensation code called ‘too little, too late’ by victim

Wednesday, 23 April 2025

The scamwave that has swept over New Zealand is being orchestrated by criminal gangs overseas, but there seems to be no shortage of Kiwis willing to act as ‘money mules’ to help send stolen funds overseas.

The Government says change to banks’ fraud compensation code is a “win” for victims of scams, but victims don’t think it has come fast enough, or goes far enough.

Last year former Commerce and Consumer Affairs Minister Andrew Bayly told banks to update their voluntary code after a scamwave swept over the country revealing weaknesses in the banking system, costing as much as $2 billion a year, and leading to banks being accused of victim-blaming.

The Banking Association, an industry lobby group for banks, has now unveiled changes to its Code of Banking Practice.

It will require its 13 member banks, including ANZ, ASB, Westpac, Kiwibank and BNZ, to have five levels of fraud protection for customers. However, the changes to the code will only come into force on November 30.

Fraud victim Carla O’Neill said it was “encouraging to finally see banks stepping up with stronger protections and clearer commitments to compensation. But for those of us who have already lost significant amounts where the bank missed clear warning signs, it still feels too little, too late.

“The new Code of Conduct acknowledges full compensation in situations like mine, and many others in our victim support group, which is a step in the right direction, but it raises the question: what about those of us who’ve already suffered these losses before the code was updated?”

Stephan Rattray is just one of a half million Kiwis who were ripped off last year.

Borja Ares, who successfully fought BNZ for compensation for the fraud he suffered, said the banks had not consulted with the public, or victims. He also said changes to the code should be retrospective as the banks should have already been providing those protections.

The updated code will obligate banks to pay compensation for unauthorised payment losses, provided customers were not dishonest, negligent, and took reasonable steps to protect their banking.

Out will go the much-hated clause allowing banks to avoid paying compensation in cases where they could prove a customer did not follow their lengthy “terms and conditions” to the letter.

And for the first time, the code will explicitly pledge that banks will reimburse scam victims who have been tricked into making payments to scammers. However, they will only have to do so in limited circumstances.

First, a bank will only have to make compensation payments if it has not met any one of five “scam commitments”.

These are: to provide education warnings to customers before certain payments are made, to provide a confirmation of payee system, to have systems to identify “high risk” transactions, to provide a 24/7 reporting channel and quick response to scam notifications, and to share information with other banks to identify things like mule accounts used by scammers to get money out of the country.

An example provided by the Banking Association of a bank failing to identify a high-risk transaction suggests that merely having these systems will not be enough for banks to get out of paying compensation. The systems must be effective, though Ares said the wording of the code was “vague”.

Second, a bank will only make compensation payments in cases where customers made domestic, not international payments.

And compensation would be capped at $500,000.

Borja Ares was victim of an investment scam, and has worked with a group of other victims to lobby for effective laws to force banks to better protect their customers.

There would be no compensation should people lose money trying to buy things on social media or the likes of Facebook Marketplace, where scam adverts were rampant.

Another change to the code will mean scam victims will be able to seek compensation from a receiving bank.

Scam victims have long argued it is unfair to only let them seek compensation from the bank at which they hold an account, not to one hosting a “mule” account to which they make a payment, or the account of a local crook pretending to sell goods online.

That loophole in the code has meant a receiving bank that has been negligent in identifying an account being used as a mule account escaped having to pay compensation to scam victims who transferred money to it.

Banking Association chief executive Roger Beaumont said the new scam protection measures were “a huge step up in the fight against scams”.

Banking expert Janine Starks has helped scam victims fight for compensation, working pro bono.

“Our banks’ new protective measures will be progressively rolled out over the next seven months,” he said.

“This timeframe reflects the considerable time and effort that will be required to put enhanced customer protection measures in place across more than a dozen banks.”

Victims’ advocate Janine Starks said: “We are getting somewhere here.”

But she feared the five commitments effectively gave the banks a “leaky sieve” with plenty of room to avoid paying compensation.

“We will have to see how this plays out,” she said, including whether the systems and staff training banks put in place were fit for purpose.

She noted there was no commitment to transparency through the publication of “dashboard” figures of fraud cases and compensation paid, or a review of how well the code worked for victims.

She would like to see New Zealand lawmakers follow their peers overseas by putting a legal duty on banks to identify, prevent and minimise fraud, as there is in Australia, punishable by fines.

However, she wanted New Zealand to go further than Australia, by following the United Kingdom in making compensation for victims mandatory, unless they were reckless in incurring losses.

“New commitments from banks mean that if a bank fails to adequately warn and protect a consumer from a scam, they will reimburse the victim up to $500,000,” says Commerce and Consumer Affairs Minister Scott Simpson.

Labour MP Duncan Webb has a members’ bill to have such a duty written into law.

Commerce and Consumer Affairs Minister Scott Simpson said: “This is an important win for bank customers, who have been advocating for some time for better recognition from banks of the role they play as the final gate between a consumer and a scammer.

“Last year the Government wrote to banks outlining our expectation that banks take greater responsibility for protecting Kiwi consumers. I am pleased that banks have responded to this directive,” he said.

“We see first-hand the emotional and financial cost of scams. Beyond the monetary impact, victims endure the distress of being deceived, leading to a loss of confidence to operate online,” says Banking Ombudsman Nicola Sladden.

But, he said: “I have been clear with banks that the journey doesn’t stop here. I expect banks to continue to prioritise security and adapt to the ever-evolving scams environment.”

Victims can take complaints that banks have not paid compensation when they should to the Banking Ombudsman.

Banking Ombudsman Nicola Sladden, who has called for better protection from banks against scams, described the code update as a step forward.

But she called for similar codes for telecoms companies and digital platforms governing their responsibilities in preventing scams and the scope of their liability in the event of scam losses.

She said the ombudsman scheme received 949 scam cases in the 2023-24 financial year with an average loss of $80,000, up from $57,000 the previous year.