A major bank has been ordered to pay an eight-figure sum after key scam controls were missing from the payment path where most customer losses occurred.
Investigations took several months. Rules for deciding who should bear the loss were not properly applied. Customers struggled to get back into their accounts.
A code of practice existed, but the systems and workflows needed to follow it were not fully implemented.
That is the danger with partial implementation. The control appears to exist. Staff expect it to work. An audit may even find evidence of it.
But the uncovered path remains live.
The useful question is not:
“Do we have the right policy?”
It is:
“Does every relevant system path enforce it, and can we prove it?”
The same gaps can appear in lending, privacy, complaints, disclosure and reporting.
It is usually found by a regulator or a customer. Better to find it first.
