Banks drag their feet and customers carry the risk of online payments
Look carefully at the list of businesses below. If you’ve used any of these companies and paid online using POLi Pay, here’s a financial tip; go and change your internet banking password right now.
Consumer NZ warned last week that POLi Pay breaches your bank’s terms and conditions. This is because using it requires you to enter your customer number and password into a non-bank system. Around 1.6 million New Zealanders have used POLi and having done so risk invalidating their claims on the bank if they are victims of unrelated fraud; at least until they change their banking password.
A secondary risk is POLi itself. It’s never been compromised, but we live with that risk intensifying. Millions of transactions go through safely and POLi doesn’t save your customer number or bank password. But, spoiler alert, that’s no guide to future cyber resilience and your bank probably won’t reimburse any losses.
There’s a reason both the UK and Europe have banned similar systems and the Aussies closed POLi down.
Payment regulators don’t believe customers should ever risk breaching their terms and conditions. In New Zealand, we have no such regulation. The Reserve Bank and Financial Markets Authority have no jurisdiction over the payments system or banks’ behaviour in allowing POLi transactions to proceed.
So the advice is, change your bank password today if you’ve used POLiPay with these organisations, as you’ve likely breached your bank’s terms and conditions.
Air New Zealand
JetStar
Etihad
Air Asia
Qantas
CAA
Virgin Australia
Emirates
NZ Transport Authority
Hutt City Council
Intercity
Blue Bridge Ferries
Wise
World Pay
Net Teller
World Remit
Moola
Tiger Trade
Mighty Ape
PB Tech
2 degrees
Spark
Bunnings
Facebook
All Blacks Tours
About Health
Lunch Online
What should government and local authorities do?
Waka Kotahi/NZTA and Hutt City Council have led taxpayers and ratepayers into breaching their banks’ terms and conditions. That is scandalous. They should stop using POLi immediately and make debit card payments fee-free. A fraud breach can empty a bank account. We can’t have government entangled in a mess, where consumers lose fraud protection.
What should big retailers do?
In my opinion, retailers offering POLi Pay options should think long and hard about reputational risk. They should consider alternatives.
1. Move to online eftpos. This allows a customer to approve a payment on their phone in one click after following a log-in procedure to their banking app. There are a few issues; not everyone has a smart phone with a banking app, and the maximum payment is the eftpos limit (usually $10,000 a day). It’s not as cheap as POLi, but it’s secure and costs less than Visa and Mastercard.
2. Educate customers about card protection. Sometimes debit and credit cards are better. Recently, Australian airline Bonza went into liquidation. The only customers assured of refunds are those who used Visa and Mastercard, due to those services’ charge-back clause (when goods or services don’t arrive, or are faulty). Others who used an account-to-account bank transfer have no protection. Most travel insurance policies don’t cover insolvency situations either. Charge-back benefits are valuable in some settings.
What should banks do?
Banks should be forced to wear the risk of POLi, until they provide the approved interface and the real-time payments system required for proper account-to-account competition. POLi wants to re-engineer its service into a framework that doesn’t breach terms and conditions, but banks (via their ownership of Payments NZ) control its ability to take those steps.
Banks’ behaviour and delays in implementing open banking have been unacceptable. Supporting POLi is the price they should be forced to pay, until they’ve levelled the playing field. The risks cannot fall on consumers, given this is bank-manipulated theatre.
I believe banks have been playing an aggressive anti-competitive game with POLi for years. They’ve been complicit in allowing it to exist by not blocking payments, while making it clear it was unapproved and risky. This allowed our banks to herd customers towards expensive debit and credit cards with the surcharge fees we all despise.
It has also allowed banks to strategically delay a complete overhaul of the New Zealand banking system to real-time payments. This is the technology required for competition to exist with Visa and Mastercard. New entrants need a real-time system able to immediately shift money from a customer’s account to a retailer’s. They can’t sit around for 30 minutes or three hours waiting for confirmation of payment, whether it’s for a coffee or an airline ticket.
All the talk about open banking deadlines and how it will result in the launch of account-to-account payment methods is bluster.
The elephant in the room is the deadline for real-time payments. When is that? Without it, what exactly will this queue of new entrants do?
Our payments system is a dinosaur
We’re one of the last countries in Asia-Pacific to move to real-time payments. There’s no official plan or a date. Fiji and Kazakhstan have beaten us. Real-time payments launched in Australia six years ago, and the UK more than 15 years ago.
In 2023, New Zealand announced it would move to seven-day-a-week batch processing. The whole world giggled. But it really isn’t funny for consumers. We live with no idea when we’ll catch-up, alongside a bunch of calamities: unregulated payments, unregulated fraud reimbursement, and slapped with the liability of sub-optimal systems like POLi.
Janine Starks is the author of www.moneytips.nz and can be contacted at moneytips.nz@gmail.com. Readers should always seek specific independent financial advice appropriate to their own circumstances.