Banks should shoulder more responsibility when customers lose their cash after being tricked by a scam into transferring money, Which? has urged.
The consumer group has made a "super complaint" to regulators, saying that unlike many other payment methods, victims conned into transferring money by bank transfer to a fraudster have no legal right to get their money back from their bank. In some cases, scam victims have lost thousands of pounds.
Using its legal powers, Which? has made a super complaint to the Payment Systems Regulator (PSR) and alerted the Financial Conduct Authority (FCA). The regulators have 90 days to investigate and respond.
A super complaint allows certain bodies to complain to regulators about features of the market significantly harming consumer interests. Which? is a designated consumer body under the Financial Services (Banking Reform) Act 2013. It is the first super complaint the PSR, which was set up in 2015, has received.
Which? research found six in 10 (60%) people did not realise they had no consumer protection from their bank if they were scammed into making a bank transfer.
More than eight in 10 (84%) had used bank transfers to make payments and nearly one in 10 (9%) had, or knew someone that had, made a bank transfer payment to a fraudster's account.
Which? said UK consumers now made over 70 million bank transfers a month, compared with just over 100 million in a whole year a decade ago - but consumer protections had not kept up with changes in the way people paid.
By contrast, when people fell victim to fraudsters in other ways they had a better chance of getting their money back.
Which? said if a consumer authorised a payment to a scammer using a credit card they were likely to be able to recover lost funds from their bank under Section 75 of the Consumer Credit Act.
And if they had been tricked into providing their banking security details, and the scammer had used those details to make an unauthorised transfer of funds, the consumer may retrieve lost funds from their bank under the Payment Services Regulations 2009 (PSRs).
In one case seen by the consumer group, fraudsters claiming to be from a bank convinced a customer that their account had been compromised and to transfer £17,500 savings to another account, set up in their name.
Within minutes, the customer realised they had been tricked and contacted their bank, to be told the money had gone. The victim was offered a 10p refund - the amount the fraudsters had left behind.
In another case, a holiday lettings customer booked an apartment in Paris. He received an email with lettings agency branding asking for the payment to be sent via a bank transfer. The customer transferred the money from his account but soon after, the property was taken down from the listings.
The customer contacted the lettings agency who confirmed that the booking reference was invalid and that they were unable to help. The customer was unable to retrieve any of his money.
Which? wants regulators to formally investigate the scale of bank transfer fraud and how much it is costing consumers and take action with new measures and greater liability for banks.
Alex Neill, director of policy and campaigns at Which? said: "We all now regularly use bank transfers to pay for things, but what most of us don't realise is that if you're conned into paying out money to a fraudster you stand to lose all of your money, unlike when you use your credit or debit card.
"With scams on the rise, consumers can only protect themselves so far and we believe that banks must do more to tackle bank transfer fraud and safeguard their customers from scams."
The PSR said it would examine the evidence Which? had supplied and gather its own to build a clearer picture of the issue and decide a course of action.
Anyone with information they believe could be helpful can contact PSRSuper-Complaints@psr.org.uk.
Katy Worobec, director of Financial Fraud Action UK, said: "Banks take fraud extremely seriously and use advanced security systems which last year stopped £8 in £10 of attempted remote banking fraud.
"This week the banking industry, with many partners, launched its largest ever fraud awareness campaign, Take Five, helping customers protect themselves against the scammers.
"Banks are legally obligated to fulfil a customer's request to transfer money even if they have warned the customer they are at risk of a potential scam.
"All banks will always work to recover stolen money, and last year recovered 40% of funds taken through remote banking."
She continued: "Customers rightly expect banks to carry out transactions they have authorised, and banks will provide compensation on a case-by-case basis.
"However, a blanket approach is equivalent to asking an insurance policy to pay out for theft when the front door was left wide open."