Central Bank Drafts Push Payment Fraud Rules With 14-day Probe, 48-hour Refund

As part of efforts to promote a sound financial system in Nigeria, the Central Bank of Nigeria has released a draft guideline for handling Authorised Push Payment Fraud in the country, stipulating a 14-day resolution of customer complaints and a 48-hour window for reimbursing customers.

According to a circular issued to all banks and other financial institutions in the country by the CBN and signed by the Director of the Financial Policy and Regulation Department, Dr Rita Sike, the guidelines, when finalised, would mandate all financial institutions to institute preventive measures as well as modalities for mitigating and managing APP fraud.

APP fraud has become one of the most prevalent forms of financial crime in Nigeria’s rapidly expanding digital payments system. APP fraud involves fraudsters convincing customers by making them believe they are dealing with their banks to approve transfers themselves, usually through fake calls, phishing texts WhatsApp messages or impersonation.

According to the draft guideline, Banks and OFIs are expected to establish reporting mechanisms that allow customers to report APP fraud incidents within a stipulated 72-hour window, through designated channels, including customer service hotlines, email, and mobile applications and in person at any branch.

“Any customer who is a victim of APP fraud is expected to, within 24 hours of the occurrence, report the incident to their financial institution using the designated channels. Notwithstanding this expectation, customers shall have up to an additional 48 hours to make such a report.”

The draft guideline, however, noted that “Where a customer fails to report an APP fraud incident within 72 hours of occurrence, and without reasonable justification, the financial institution may not be obligated to provide reimbursement, except where internal control failures or staff negligence contributed to the fraud.”

Banks and OFIs are also expected to open and conclude an investigation into the fraud within 14 days and reimburse the customer within 48 hours after the conclusion of the investigation. “Upon receipt of the report from a customer, the financial institution shall ensure that a formal investigation into the alleged APP fraud is initiated immediately.

“Financial institutions shall acknowledge receipt of the report within 24 hours and issue a unique case reference number to the customer and a summary of the review process, including indicative timelines for resolution.

“The full investigation shall be concluded within 14 working days, after which a clear decision shall be communicated to the customer. Financial institutions shall clearly communicate the outcome of the APP fraud investigations to the customer, stating if reimbursement is approved or denied. Where the reimbursement is denied, financial institutions shall provide reasons to the customer for such denial.”

The guideline noted that accounts used for fraud are to be identified stating that “the CBN may direct NIBSS or any relevant settlement entity to withhold settlement for the full value of any transaction identified as fraudulent. This may extend to second level or other subsequent beneficiary institutions along the transaction chain.”

However, the draft guideline stated that financial institutions are not obligated to reimburse in cases where the customer acted fraudulently or with negligence, cases that occurred before the effective date of the guideline, as well as cases where the customer failed to or delayed reporting the fraud beyond 72 hours of occurrence.

It noted that customers with reasonable justification of failing to report within the stipulated 72-hour window, such as “circumstances beyond the control of the customer, such as illness, force majeure events, and time of becoming aware of the fraud, security constraints, or demonstrable unavailability of reporting channels”, may be exempted.

It further stated that “failure to initiate or conclude the investigation within the stipulated timelines without reasonable justification may constitute a breach of consumer protection obligations and attract appropriate regulatory sanctions.