Media statement: PASA on unauthorised debit orders (14 January 2019 )
Unauthorised debit orders, sometimes referred to as “R99 debit order scams” (although amounts vary), have once again received close press attention in recent weeks. The South African Reserve Bank, the Payments Association of South Africa (PASA), the banks, and a number of user associations are aware of the problem; they have been actively focused on the matter and on a number of steps to address it.
Customers are understandably frustrated by the issue, but there is also some confusion and misinformation around the issue which deserves some clarification – which we hope to achieve by responding to a few frequently-asked questions.
Why do banks allow debit orders to go through?
Banks act as facilitators of payments and are bound by law to honour debit orders submitted into the payment system by other banks on behalf of their clients. Each debit order transaction involves an entity (called a “user”) as well as the banks, and if all parties do not collaborate in an organised manner, the debit order system, through which 55 million payments to the value of over R80 billion are processed every month, would cease to function. Accordingly, when banks submit transactions on behalf of users, they do so on the basis that such a user has included only valid debit orders backed by a paper or voice mandate. These mandates are, however, held by the user, and not by the sponsoring bank — the bank simply facilitates the transaction on behalf of their client.
Then why don’t they just refuse debit orders from companies that customers regularly reverse?
The vast majority of disputed debit orders are in fact legitimate ones agreed to by customers, but which are reversed for “cash management” reasons – so that the money can be used for something else.
To put the numbers in perspective, on average about 1,5 million of the 55 million monthly debit orders are disputed – less than 3%. Based on PASA and bank estimates, however, of the 1,5m only about 10% of the debit orders disputed by customers are actually unauthorised.
This is a major problem for the industry. First, customers need to be aware that it is illegal, not to mention unethical, to reverse a debit order they have authorised as payment for a legitimate legal contract or service. Second, the millions of monthly reversed legitimate debit orders make it extremely difficult to identify those debit orders initiated by fraudsters. For example, a corporate user that is completely compliant to the rules in every respect and only submits debit orders with valid mandates may still face high levels of disputes through no fault of their own.
Are the banks profiting from this?
PASA CEO Walter Volker explains, “Banks are certainly not profiting from debit orders being reversed; on the contrary, by virtue of their sponsorship of the transactions and the associated legal obligations, they are exposed to the full value of the debit orders being disputed.
“If a bank reverses a debit order on instruction from a customer, and it turns out there was a valid mandate, the bank risks losing that entire amount if they cannot get it back from the consumer. On the other hand, in the event that an illegal debit order is disputed, the sponsoring bank would be liable to reimburse the full amount, even after the so-called rogue user has been exited from the system.” There are therefore many hidden costs and risks, which consumers are not always aware of.
Why are some banks charging consumers when they dispute a debit order?
Reversing disputed debit orders takes time and work. As explained above, banks take on the risk that the company submitting a debit order has either been excluded from the system or is no longer in business, so the cost of managing and upholding disputes is high. At the same time, as explained above, 90% of disputes are ultimately found to be illegal. Some banks, therefore, have introduced fees in the hopes of limiting such illegal disputes. Even for banks who do charge, however, a consumer would be within their rights to request a refund if it is found that there was no valid mandate and that the debit order is in effect unauthorised or fraudulent.
Which banks have been hit by the so-called “R99 scam”?
No bank is immune to unauthorised debit orders. Volker says, “This is not just a problem involving one bank, one company or one scam. It is an industry-wide problem and PASA is working with all the banks to improve the safety of the system, both for consumers and for companies.”
What is being done about the problem?
PASA has been working with the banking industry since 2013 to implement a wide-reaching and complex system called DebiCheck, the first of its kind anywhere in the world. The initial phase went live on 1 August 2018, by which time all 11 participating banks had implemented DebiCheck operationally.
Right now, user companies are busy implementing the systems and introducing the new business processes that are necessary to fully utilise DebiCheck. Volker explains: “Thousands of user companies, from large corporates to small business, will be using the system – so we need to ensure it remains stable and that consumers are not adversely affected.”
With DebiCheck, banks will require customers to electronically confirm debit order information with them directly at the start of a new contract with a user, before any collection can take place; thus ensuring that both consumers and their banks know precisely what should be debited from their bank account. Once the consumer has authorised the electronic mandate, it will be stored on their bank’s mandates database and can be verified or monitored at any time.
Will DebiCheck be available as an option in all instances?
In its initial phase, only consumers dealing with companies that have implemented DebiCheck will be required to confirm their debit order information electronically. Although the system is working already, it will take time for all DebiCheck users to ramp up their usage of the system. This number will grow over time, and the aim ultimately is to eradicate any and all unauthorised debit orders, through a combination of DebiCheck and other, more general debit order abuse measures.
While DebiCheck is ramped up, what other protection is provided?
In addition to DebiCheck, PASA is working with the banks to improve the processes by which new companies are allowed into the debit order system and to ensure rogue companies are identified and removed from the payment system. “This is a very serious matter for us and we are doing everything we can to identify those companies who are abusing the debit order system,” says PASA Senior Legal Counsel Charl Ackerman.
PASA and the banks are also working to refine existing rules and processes in the payment system to further curb debit order abuse. Informational material has been developed and is being rolled out to educate consumers on their rights and obligations in the debit order environment.
In some instances, individual banks have put in place other measures such as SMS alerts for all debit transactions, free debit order reversals below a certain amount and cheaper app- or online-based debit order dispute procedures.
Why is DebiCheck taking so long?
The scale and complexity of DebiCheck means that it has taken a great deal of work and time to implement. As of August 2018 the system is in place and in use, and companies are being added to the system all the time. New DebiCheck debit order customers are already receiving confirmation requests from their banks, but there is still work going on to mature the systems and to fully implement all functionalities required by users and banks.
The Reserve Bank recently granted a 12-month extension (until October 2020) to fully implement DebiCheck. This only affects the final date by which the old systems will be switched off. Nevertheless, says Volker, “The eleven banks participating in DebiCheck are committed to the process and still aim to have most companies on the system this year.”
These additional 12 months will also be used to mature the system and to phase out old contracts and systems.
What can customers do to protect themselves?
- Check your bank statements regularly for transactions you do not recognise.
- Query unauthorised debit orders with your bank immediately and report the details to the Payments Association of South Africa at doa@pasa.org.za.
- Ensure that your bank has your correct cellphone number so that you receive SMS alerts when money is deducted from your account and also to receive DebiCheck confirmation requests.
- Be wary when entering into contracts verbally, electronically or in writing.
- Do not share or confirm your banking details, including your account number and branch code, if you are not certain exactly what they will be used for.
- Do not dispute debit orders that you have authorised.
For more information about debit order abuse, DebiCheck and what the public can do to protect their accounts, please visit www.pasa.org.za
For regular updates, follow the Payments Association of South Africa on Twitter @PASA__ZA and Facebook