However, experts pointed out the weaknesses of the bill adopted by the State Duma in the first reading
The State Duma in the first reading adopted a bill obliging banks to reimburse customers for funds stolen from their accounts within 30 days in full if the operation was performed without their consent. And the banks themselves get the right not to execute orders for obviously fraudulent transactions within two days, even despite the consent of the citizen. Whether this bill will be able to reduce the avalanche of fraudulent transactions and whether it has drawbacks, experts told MK.
According to the Central Bank of the Russian Federation, in 2022, the total damage caused by fraudsters increased by 4.3%: they managed to steal almost 14.2 billion rubles from the accounts of Russians. It is curious that the number of illegal transactions decreased by 15.3% and amounted to about 877 thousand. This indicates an increase in criminal skill: for fewer transactions, scammers learned to steal more money.
In this case, it was possible to return the funds to the victims only in 4.4% of cases. Such sad statistics is connected with the high prevalence of social engineering in the arsenal of scammers (more than half of the cases).
The bank was previously not obliged to reimburse the funds that the victim herself voluntarily sent to the scammers, believing that she was being called from the “security service” or «from the Ministry of Internal Affairs.» Now the situation may change.
According to the draft law adopted by the State Duma in the first reading, the money transfer operator is obliged to fully refund the amount of the transaction performed without the voluntary consent of the client within 30 days after receiving his application, and in the case of a cross-border money transfer — within 60 days.< /p>
Now not only the sending bank, but also the receiving bank will check transactions for signs of fraud, including reconciliation with the database of criminals and their accounts and schemes maintained by the Central Bank of the Russian Federation. And the banks themselves will be able not to execute orders for obviously fraudulent transactions for two days, even despite the consent of the client.
“Now everything is arranged in such a way that the sending bank is not responsible for anything,” explains the project manager Popular Front «For the Rights of Borrowers» Yevgeny Lazarev. “The beneficiary bank doesn't know anything either. And in the end, all the damage falls on the victim, which is not entirely fair.”
For attackers who use droppers (holders of fake accounts) in their “work”, this will also become a certain obstacle, because fear and haste are their main levers of pressure on the victim. And when, in the process of confirming a transaction, the client is informed twice about the risks of the actions taken, a gap will appear in the legend of the villains due to the doubts of the victim, the interlocutor of MK emphasized.
But will this result in more refunds to the accounts of the victims? “It is worth noting that the text of the bill contains more provisions on the preliminary work of the bank with suspicious transactions than on the return mechanism,” says Andrey Tugarin, managing partner of GMT Legal. “That is, the main idea of the project is to prevent fraud, not to compensate for losses.”
But it will not be easy for banks to avoid obligations under this law, since it is assumed that banks will receive information about potential fraudulent accounts and transactions and transfer to the Central Bank of the Russian Federation. In other words, the implementation of this law will be monitored by a supervisory authority directly involved in the process.
According to Andrey Bobrov, Senior Associate at SVA-Group, the concern is that eventually the banks themselves and other money transfer operators will determine in their internal documents the final procedures for identifying transactions with signs of lack of the consent of the paying client, as well as the standards for such procedures. This will increase the risk of errors and abuse of power, and may adversely affect the normal economic activities of citizens and organizations.
According to the head of InDeFi Smart Bank, Sergey Mendeleev, most banks have long ago introduced the mechanisms listed in the bill to prevent rash transfers of funds from the accounts of victims, the main of which is a live conversation with the operator of the “security service”. It will be possible to speak about any specifics only after the appearance of the list of signs of involuntary transfer of funds provided for by law, which should be published by the Central Bank on its website.
“It is clear that banks will protect themselves as much as possible from any liability, in order not to show any losses on the balance sheets, most likely, everything will end with the imposition of special insurance, without which the transfer rates will become prohibitive,” the expert believes.
The question of where banks will take money to pay victims of fraudsters indeed remains open. According to Polina Gusyatnikova, Senior Managing Partner at PG Partners, most likely they will create some kind of insurance funds or increase commissions and rates to compensate for possible losses.