PRAXANAJurisdictions around the world are shifting the cost of scams from victims to institutions, through mandatory reimbursement schemes and prevention obligations. The legal commentary is extensive; the operational guidance less so. Here is where programmes actually need to move.
From detection to interruption
Traditional fraud controls optimise for detecting unauthorised transactions. Scams are authorised β the customer genuinely intends to pay. That means the control moment shifts earlier: warnings that respond to the specific payment context, friction that scales with risk, and the ability to pause a payment long enough for a customer to reconsider. Generic 'are you sure?' pop-ups demonstrably do not work; specific, dynamic warnings demonstrably do.
The data problem underneath
Reimbursement rules typically hinge on questions your current data may not answer: did the institution identify the payment as high-risk? What warnings were shown, and when? Did the customer proceed anyway? If your systems cannot reconstruct that sequence for a payment made eight months ago, every reimbursement decision becomes an argument. Fixing the audit trail is unglamorous and should probably be your first investment.
Inbound matters too
Receiving institutions face growing obligations around mule accounts. Account-opening controls, inbound transaction monitoring and rapid funds-freezing processes are becoming compliance requirements rather than good practice. The interaction between fraud, AML and sanctions teams β historically three separate rooms β is where most institutions will find their gaps.
Prepare for the disputes
However schemes are designed, edge cases will be contested. Clear internal decision frameworks, consistent record-keeping and honest customer communication will decide whether reimbursement becomes a manageable cost or a reputational problem.