Pay by Bank: who pays when it goes wrong?
The sixth annual Pay by Bank Signals & Trends survey from Token.io and Open Banking Expo shows a market that has moved beyond asking whether Pay by Bank will take off. Pay by Bank lets a customer pay straight from their bank account, approving the payment in their banking app through open banking rather than using a card. Among those surveyed, 72% of banks and 87% of payment service providers already offer or accept Pay by Bank, and most say merchants are asking for it. The key finding is about who pays when something goes wrong.
Rare, but unresolved
Pay by Bank fraud is 2.4 times lower by volume than traditional payment methods, according to Open Banking Limited's latest Fraud Monitor, which the report cites. But no payment method is immune, and when fraud does happen, the report says the question of who resolves it and who covers the loss remains unresolved.
Six answers to one question
Token.io and YouGov asked 150 UK businesses who should resolve a Pay by Bank transaction that a customer says was fraudulent or unauthorised, and cover any loss. The six main answers were the customer's own bank (24%), a central Pay by Bank scheme (20%), not sure (18%), the company processing the payment for the merchant (14%), shared across all parties (11%), and the technology provider behind the payment (10%).
It's a small sample, but the spread is striking. Nearly one in five businesses doesn't know, and no single answer comes close to a majority. The most common answer, the customer's own bank, fits a familiar pattern: when it isn't clear who should pay, expectations settle on the party the customer knows best.
The industry wants rules, and they're arriving
The industry's own answer is clearer. Asked what consumer protection for recurring and 1-Click Pay by Bank should look like, 46% of UK industry respondents chose scheme rules similar to debit cards, but more efficient to run. A robust consumer protection model ranked as the second most important factor in Pay by Bank becoming a genuine alternative to cards in the UK, just behind point-of-sale capability. In Europe, the lack of a liability framework was among the top barriers to recurring payments, close behind technical readiness.
Wanting rules like those for debit cards doesn't mean copying cards wholesale. TrueLayer has argued that Pay by Bank shouldn't import the cost and complexity of card chargebacks, which it says have become a route for refund fraud. We agree in principle. But some way of resolving disputes is still needed when a customer and a merchant can't settle a problem themselves, and TrueLayer's own proposals include a central dispute resolution process. The challenge is building one that works without card-style overhead.
In the UK, the UK Payments Initiative (UKPI) now has recurring Pay by Bank live under common rules. Its chief executive, Richard Koch, said on a panel chaired by Invela that he expects open finance to follow the same path, through model contracts inside a scheme rather than deals negotiated from scratch between each pair of firms.
Rules decide who pays - evidence decides whether they work
Scheme rules settle who should pay in principle. Applying them depends on knowing the participants: who was in the payment chain, whether each was a legitimate participant in good standing at the time, and what its risk looked like. Without that, even well-designed rules can end in an argument, or in the customer's bank absorbing the loss because it's the easiest party to reach.
Schemes set the rules. What makes them work in practice is knowing who's in the network and monitoring their risk continuously, so that when something goes wrong, liability can be allocated on facts rather than argued over. That's the layer Invela is building to support them.
Invela is the infrastructure layer that makes open finance trustworthy - accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place.
