FCA Enforcement Head Urges Big Tech Join Anti-Fraud Fight

The headline points to a recurring argument from the United Kingdom's conduct regulator: that payment fraud cannot be contained by banks alone, because most of it begins somewhere else. What follows is background on how fraud reaches consumers, where the legal duties currently sit, and why technology and telecommunications firms keep being named in the debate.

Who the Financial Conduct Authority regulates

The Financial Conduct Authority supervises the conduct of banks, payment institutions, e-money firms and other authorised businesses in the UK. Its remit covers how those firms treat customers, the systems and controls they operate, and their obligations under the Money Laundering Regulations. It does not extend to social media platforms, search engines, online marketplaces or mobile networks, even though a large share of consumer fraud originates on those services. That mismatch — the losses land on regulated firms, the point of contact does not — is the structural reason the enforcement debate keeps returning to the technology sector.

How authorised push payment fraud works

In an authorised push payment case, the victim makes the transfer themselves after being deceived. Because the payment is genuinely authorised, it does not look anomalous to a payment system in the way a stolen-card transaction does. Common patterns include:

• purchase scams, where goods advertised on a marketplace or social platform never arrive
• investment scams, often promoted through paid advertising or messaging groups
• impersonation of a bank, a government department or a delivery company, usually initiated by text or call
• romance and advance-fee approaches that build contact over weeks before any payment is requested
• invoice and mandate redirection aimed at businesses rather than individuals

The reimbursement question

The UK has moved towards mandatory reimbursement for victims of authorised push payment fraud on domestic transfers, with the cost split between the sending and receiving payment firms. That design deliberately gives receiving banks a financial stake in the accounts they open, since fraud proceeds have to land somewhere before they are moved on. It also sharpens the industry's objection: firms that carry the reimbursement cost have no control over the platforms where the approach was made, and no ability to require those platforms to verify advertisers or take down fraudulent listings.

Where the duties on technology firms sit

Separate legislation places its own obligations on online services. The Online Safety Act introduced duties relating to fraudulent advertising for the largest search and user-to-user services, supervised by Ofcom rather than the FCA. The FCA's financial promotions regime, meanwhile, restricts who may communicate or approve an invitation to engage in investment activity, which brings paid advertising for financial products within its perimeter even when it appears on a platform the regulator does not supervise. Firms co-operate in practice through information-sharing arrangements and industry initiatives on data exchange, but those are voluntary in a way that regulatory obligations are not.

Why this matters for anti-money laundering teams

Fraud proceeds are criminal property, so the money that follows a scam is a money laundering problem as much as a fraud problem. Funds are typically layered through mule accounts, sometimes opened with genuine but coerced or recruited identities, then dispersed rapidly across multiple institutions or converted into virtual assets. Effective mule detection depends on behavioural signals at account opening and in the first weeks of activity — inconsistent stated purpose, rapid pass-through of balances, device and address reuse across unrelated customers — rather than on the payment itself, which looks legitimate at the moment it is made.

Practical steps for consumers

Verify any payment request through a channel you already trust rather than one supplied in the approach, treat unexpected urgency as a warning sign in itself, and check that a firm offering an investment appears on the FCA's register under the name and reference it gives you. If a payment has already been made, contact the bank immediately, report the matter through the national fraud reporting service, and keep the original messages: recovery, where it is possible at all, depends on speed and on evidence.