The ePayments Code

Laurence O’Keefe and Karen Guerinoni

FOS National Conference 16-17 October 2012

This presentation focuses on the following five aspects

of the ePayments Code:

1. What is the ePayments Code?

2. What’s covered and not covered?

3. New provisions added by ASIC

4. Provisions governing the allocation of liability for

unauthorised transactions

5. Provisions governing complaint procedures

Snapshot

Revision by ASIC of the EFT Code, reworded in

plain English

Comes into effect on 20 March 2013

Redraft does not diminish the consumer

protections of the EFT Code

[refer ASIC Consultation Paper 158 dated May 2011]

Adds some new provisions, including mistaken

internet payments and low value facilities

Applies to FSPs that subscribe to the Code

What is the ePayments Code?

Applies to transactions initiated using electronic

equipment that are not authenticated by comparing

manual and specimen signatures [clause 2.4].

Examples in clause 2.5 include:

- card transactions, including PIN-authorised, contactless

card payments and ‘no PIN’ low value spends

- internet banking, telephone banking and BPAY

- direct debit arrangements and mail order transactions

- online transactions using card number and expiry date

What’s covered by ePayments Code?

ePayments Code does not apply [clauses 2.1 and 2.4]

where:

Transaction is intended to be authenticated by comparing

manual and specimen signatures (such as credit card

purchase in presence of merchant)

Facility is designed primarily for use by business

and established primarily for business purposes

Facility is one where the holder and subscriber do not have

a contractual relationship

What’s not covered?

In addition to what was already in the EFT Code, the

ePayments Code also addresses:

Mistaken internet payments

Low value facilities

Minimum expiry dates

Book-up arrangements

Leaving a card in an active ATM

New provisions in ePayments Code

Definition

Clause 23.2: main elements of that definition are:

Payment by user through ‘Pay Anyone’ internet banking

facility

Funds paid into account of unintended recipient; because:

– user enters or selects a BSB and/or identifier (account number) that

does not belong to named and/or intended recipient;

– as a result of user’s error or user being advised of wrong details

Does not include payments made using BPAY

Mistaken Internet Payments (MIPs)

Compliance requirements

Disclosure requirements in T&Cs about process, when

funds will be recovered and when holder liable [clause 24]

On-screen warning about risk of MIPs, including that it

may not be possible to recover funds [clause 25]

Reporting process must be effective, convenient and

either free or local call cost only [clause 26]

Investigation requirements [clause 27] mean:

sending ADI (S-ADI) must investigate report from user

and, if satisfied MIP occurred, request return of funds

receiving ADI (R-ADI) must acknowledge request and

advise S-ADI if there are sufficient funds to cover MIP

Mistaken Internet Payments Cont’d

Summary of return process

Whether or not funds will be returned to holder after

user has made an MIP depends on:

Whether or not sufficient funds remain in the account of the

unintended recipient;

The period of time that has elapsed between making the MIP

and reporting the MIP; and

In some circumstances, whether or not the unintended

recipient agrees to return the funds.

Mistaken Internet Payments Cont’d

Funds available

Report within 10 business days of MIP

Clause 28 sets out process

R-ADI must return funds to S-ADI within 5 business days of

receiving request, if practicable, but no longer than 10

business days

No requirement for consent of unintended recipient

If not satisfied MIP occurred, R-ADI may seek consent of

unintended recipient to return funds

S-ADI must return funds to holder asap

Mistaken Internet Payments Cont’d

Funds available

Report between 10 business days and 7 months

Clause 29 sets out process

R-ADI must complete investigation within 10 business days

R-ADI must prevent unintended recipient from withdrawing

funds for 10 further business days and notify it will withdraw

funds if recipient does not establish entitlement to funds within

10 business days of date of ‘freeze’

If unintended recipient does not establish entitlement, R-ADI

must return funds to S-ADI within further 2 business days

If not satisfied MIP occurred, R-ADI may seek consent of

unintended recipient to return funds

S-ADI must return funds to holder asap

Mistaken Internet Payments Cont’d

Mistaken Internet Payments Cont’d

Funds available

Report made more than 7 months after MIP

• Clause 30 sets out process

• If satisfied that MIP occurred, R-ADI must seek consent of

unintended recipient to return funds

• If not satisfied MIP occurred, R-ADI may seek consent of

unintended recipient to return funds

• No timeframes are specified

• If unintended recipient consents to return of funds, R-ADI

must return to S-ADI, and S-ADI must return funds to holder

asap

Funds not available

Clause 32 sets out process where an MIP has occurred but

there are not sufficient funds in account of unintended

recipient to full value of the MIP

R-ADI must use ‘reasonable endeavours’ to retrieve funds,

e.g. by facilitating repayment of funds by unintended recipient

in instalments

Applies at any time after the MIP is reported

No timeframes are specified

Mistaken Internet Payments Cont’d

Limited requirements apply to low value facilities

that can hold no more than $500 at any one time:

Usual T&C requirements do no apply.

T&Cs only have to be provided if practicable; otherwise, a

notice that highlights key terms and advice how to obtain full

T&Cs [clause 4.4]

Changes to T&Cs have to be provided if subscriber able to

contact holder directly [clause 4.15]. Otherwise, in a way

reasonably likely to come to attention of holder [clause 4.17]

Low value facilities

Other Requirements

Limited requirements for low value facilities include:

Usual requirements about receipts do not apply. Must

give process to check balance and transaction history

[clause 5.8]

Usual requirements re statements do not apply

[clause 7.7]

Liability provisions for unauthorised transactions do not

apply [clause 9.2]

Low value facilities Cont’d

Clause 18 provides for facilities with expiry date

Non-reloadable facility – expiry date must be at least

12 months from date of activation

Reloadable facility – expiry date must be at least

12 months from last reload date

Minimum expiry date does not apply if holder is entitled

to refund on expiry

Subscriber must not bring forward the expiry date and

must give user a way to check it

Expiry information must be disclosed on a device

Minimum Expiry Dates

‘book up arrangement’ is defined in clause 2.6 to

mean –

“...credit offered by merchants for the purchase of goods

or services commonly used by Aboriginal people in

remote and regional areas of Australia. It is common for

merchants to hold a consumer’s debit card and/or pass

code as part of a book up arrangement”.

If a subscriber and a merchant have a merchant

agreement, the agreement must prohibit the merchant

from holding a user’s pass code as part of a book up

arrangement [clause 20.1]

Book up arrangements

Holder is liable if user leaves card in an ATM, as long as

ATM incorporates reasonable safety standards that

mitigate risk of card being left in ATM (e.g. card capture

after reasonable time) [clause 11.4]

Clause was added by ASIC at FOS’s request, because

not adequately covered by the EFT Code. Long-standing

practice of FOS was to allocate liability to the holder,

because user is in control of the card when using an

ATM.

Leaving card in an active ATM

Liability Provisions of ePayments Code

Laurence O’Keefe and Karen Guerinoni

FOS National Conference 16-17 October 2012

Reflect legal principal of mandate

- FSP may debit unauthorised transactions only in

exceptional circumstances where user contributes to loss

Apply to unauthorised transactions only. Do not

apply to transactions performed by a user or with

the knowledge and consent of a user [clause 9.1]

No liability in specified circumstances

Full liability only in specified circumstances

In other circumstances, limited liability of $150

Liability provisions

Holder is not liable for loss where:

Fraud or negligence by employee or agent of subscriber or

merchant [clause 10.1a]

Device, identifier or pass code that is forged, faulty, expired or

cancelled [clause 10.1b]

Transaction requiring device and/or pass code that occurred

before received by user [clause 10.1c]

Transaction incorrectly duplicated [clause 10.1d]

Unauthorised transaction performed after loss of device or

breach of pass code security is reported [clause 10.1e]

Unauthorised transaction made using an identifier without a

pass code or device [clause 10.2]

It is clear user had not contributed to loss [clause 10.3]

No Liability Provisions

Where clause 10 does not apply, holder is only liable where

subscriber can prove on balance of probability that:

User contributed to loss through fraud or breach of pass code

security requirements. Holder is liable for actual losses before

loss, theft or misuse of device or breach of pass code security

is reported to subscriber [clause 11.2a]

User contributed to loss by unreasonably delaying reporting

misuse, loss or theft of a device or that security of all pass

codes has been breached. Holder is liable for actual losses

that occur between when the user became aware of the

security compromise (or should reasonably have become

aware in case of lost or stolen device) and when the security

compromise was reported [clause 11.5a]

But.....

When holder is liable for losses

(Even if otherwise liable) holder is not liable for:

Losses exceeding daily transaction limit

Losses exceeding periodic transaction limit

Losses exceeding balance on facility, including any pre-

arranged credit

Losses incurred on any facility that the subscriber and the

holder had not agreed could be accessed using the device or

identifier and/or pass code

Exceptions to full liability above are set out in:

- clause 11.2(b) – for breach of pass code security requirements

- clause 11.5(b) – for unreasonable delay in reporting

Liability Provisions Cont’d

Limited liability

Where pass code was required to perform unauthorised

transaction and other full liability clauses do not apply,

holder’s liability is limited to no more than $150 [clause 11.7]

Credit cards, scheme debit cards, charge cards

Liability of holder cannot be greater than if the subscriber had

exercised any rights (e.g. chargeback) it had under scheme

rules at the time the report was made. This applies even if

subscriber did not exercise its rights [clause 11.10]

Liability Provisions Cont’d

Transactions using a device but not a code

Unreasonable delay in reporting can apply to a transaction

that uses a device, or a device and identifier, but does not

require a pass code [clause 10.2]

Proof that user contributed to losses

All reasonable evidence and explanations must be

considered

The fact that facility was accessed with correct device and/or pass

code, while significant, does not constitute proof on balance of

probability that user contributed to losses

Use of non-secret information is not relevant to user’s liability

[clause 11.8]

Liability Provisions Cont’d

Discretion to reduce liability

Where subscriber has not applied a reasonable transaction limit,

an EDR body may reduce the holder’s liability by such amount as

it considers fair and reasonable, taking into account:

prevailing industry practice regarding reasonable limits;

whether security and reliability of means used to verify transaction

was authorised adequately protected holder from losses in absence

of reasonable limit; and

if unauthorised transaction involved a credit facility (including a

redraw facility), whether at time of making credit facility available,

subscriber had warned holder of the risk of unauthorised

transactions [clause 11.9]

Liability Provisions Cont’d

Pass code security requirements

Where a pass code is needed, a user must not:

voluntarily disclose a pass code to anyone, including a

family member or friend [clause 12.2a]

keep a record of a pass code on a device or liable to

loss or theft simultaneously with a device, unless user makes

a reasonable attempt to protect the security of the pass code

[clause 12.2b]

where a device is not needed to perform a transaction,

keep a written record of a pass code without making a

reasonable attempt to protect the security of the pass code

[clause 12.2c]

Liability Provisions Cont’d

Pass code security requirements continued

Where a pass code is needed, a user must not:

act with extreme carelessness in failing to protect the security of

all pass codes. This involves a degree of carelessness that

greatly exceeds what would normally be considered careless

behaviour [clause 12.4]

on or after 1/4/02, select a pass code that represents the user’s

birth date or name, if subscriber has specifically instructed the

user not to do so and warned the user of the consequences of

doing so [clause 12.5]

Onus is on subscriber to prove compliance with clause 12.5

[clause 12.7]

Liability Provisions Cont’d

Pass code security requirements

Reasonable attempt to protect security of a pass code

record includes:

making any reasonable attempt to disguise pass code

within the record; or

preventing unauthorised access to the record, such as -

- hiding or disguising the record among other records

- hiding or disguising the record in a place where pass

code record would not be expected to be found

- keeping the record in a securely locked container

- preventing unauthorised access to an electronically

stored record

[clause 12.3]

Liability Provisions Cont’d

Subscriber may give a user guidelines in T&Cs for

ensuring security of devices and pass codes [clause

13.1]

Guidelines must:

- be consistent with pass code security requirements in

clause 12;

- clearly distinguish the circumstances in which the holder

is liable for unauthorised transactions; and

- include a statement that liability for losses from

unauthorised transactions will be determined by the

Code rather than the guidelines [clause 13.2]

Security guidelines

Complaints Procedures of ePayments Code

Laurence O’Keefe and Karen Guerinoni

FOS National Conference 16-17 October 2012

Subscriber must have IDR procedures that comply

with ASIC RG165 and ISO10002-2006

Subscriber must accept complaint received within 6

years from day user first became aware, or should

reasonably have become aware, of the

circumstances giving rise to complaint [clause 38.1]

For complaints about unauthorised transactions,

clause 38.2 lists information the subscriber must

make reasonable efforts to obtain

Complaint procedures

Within 21 days of receipt, subscriber must either

complete investigation and advise user in writing of the

outcome; or advise the need for more time [clause 38.4]

Unless there are exceptional circumstances, subscriber

must complete investigation within 45 days [clause 38.5]

If subscriber cannot resolve complaint within 45 days, it

must explain the reason, provide monthly updates and

give user a date when they can reasonably expect a

decision (but does not apply where the subscriber is

waiting for a response from the user) [Appendix A3.3]

Time frames for complaints

Subscriber must inform the user about the outcome

of a complaint and the reasons for the outcome,

including references to the relevant clauses of the

Code [clause 38.7]

If a complaint is resolved within 5 business days,

the outcome need not be advised in writing [clause

38.6]

If resolved after 5 business days, the information

must be given in writing [clause 38.9]

Explaining outcome of complaint

Where subscriber does not comply with the Code and

non-compliance contributes to:

- a decision that is against the user; or

- delay in resolution of the complaint,

EDR scheme may decide subscriber must pay part of

the amount in dispute, even if subscriber is not

otherwise liable [clause 38.10]

EDR will take into account all the circumstances when

deciding on the amount of compensation [clause 38.11]

Compensation for non-compliance

Where the complaint is about a credit card, scheme

debit card or charge card and the subscriber exercises

its rights under scheme rules:

Timeframes under scheme rules apply [clause 39.1a]

If subscriber can’t resolve within 60 days, it must give reasons

for delay and provide updates every 2 months [clause 39.1b]

Subscriber must suspend payment on amount in dispute until

dispute is resolved [clause 39.1d]

Credit card complaints

Questions?