Fraud Against Customers in Vulnerable Circumstances Is The Concentration Risk in Your Book

Customers in vulnerable circumstances: the cohort article 7 pointed at

Article 7 ended on a claim: the claims hardest to evidence and costliest to dispute concentrate in one customer cohort and that concentration is a risk-management reality. This article shows why.

The cohort is customers in vulnerable circumstances, in the FCA’s own construction: people with characteristics of vulnerability across health, life events, resilience and capability. If you run a mutual, they are your members in vulnerable circumstances and protecting them is close to why the institution exists. Nothing here questions that purpose; the question is where the risk gets filed.

A borrowed term, defined

Concentration risk. In risk-management use it means a correlated exposure: losses driven by one shared factor rather than arriving independently. On a fraud book, it is the segment where loss severity, evidence burden and regulatory consequence all peak at once.

The shared factor is how three regimes treat an incident once the customer has characteristics of vulnerability. That puts the risk in the institution’s regulatory position and its architecture. It also makes the exposure something a risk committee already knows how to own: measure it, limit it, report it.

Three asymmetries, one segment

Severity: the regulator’s own expectation

The FCA’s guidance on the fair treatment of customers in vulnerable circumstances (FG21/1) lists scams among the harms it has in mind. Its direct about what harm does to this cohort: “the impact on vulnerable consumers is likely to be greater than for other consumers”.¹ The level of care the FCA expects is different too and firms should take particular care.¹

The guidance also says that consumers with some characteristics of vulnerability may be more likely to fall victim to scams.¹ No stronger claim about frequency is made here as the asymmetry starts after the incident, not before it.

The FCA reviewed how firms treat this cohort and published its findings on 7 March 2025.² It left FG21/1 in place, concluding the guidance remains appropriate alongside the Consumer Duty, so the expectation above is current.² That is the first asymmetry: same loss, greater expected impact.

The shield that is not available

In PSR scope the reimbursement regime adds the second. A sending PSP can apply an excess of up to £100 and (where it can show gross negligence) refuse a claim under the consumer standard of caution. Neither is available where vulnerability had a material impact on the customer’s ability to protect themselves.³

So the same incident costs an in-scope firm more when the customer has characteristics of vulnerability. The loss is reimbursed without the excess and the one ground for refusal is closed. That is a P&L line, not a conduct point.

The PSR reported that 14% of APP scam claims between October and December 2024 came from consumers with a vulnerability, worth £7 million in total.⁴ That uses the regime’s narrow definition, vulnerability with a material impact on the claim. It is here for one reason: the shield comes off in practice, not only in the rules.

This asymmetry binds sending PSPs inside the reimbursement requirement. A building society whose members withdraw to a nominated account sits outside it and for that society the same incident arrives as a Duty question: was harm foreseeable and what did the firm do about what it could see (see article 5)? The excess and the caution exception were never the mutual’s to apply, so its severity asymmetry runs entirely through the Duty and the Ombudsman.

The review that follows

The third asymmetry sits in the review. When a fraud complaint reaches the Financial Ombudsman, the service considers the FCA’s vulnerable-customer guidance in cases involving customers in vulnerable circumstances.⁵ Article 7 showed that this raises the firm’s evidence bar rather than lowering it.

The event evidence adjudication rewards is contemporaneous, session-level and customer-specific. It is hardest to hold for exactly these customers because the review also asks what support was offered at the time. Article 7 noted that one body of evidence serves all three regimes; the mirror image is that all three regimes converge on one segment of your book.

Duty scrutiny of the cohort’s outcomes, the loss of the excess and the caution exception and the Ombudsman’s use of the guidance all land on the same incident. None of them gives the firm a defence and none of them waits for an enforcement case: the asymmetries bite in the ordinary course, in what the loss costs, what the complaint requires and what the board is asked to show.

Same loss, three regimes, no shield. That is what a concentration looks like on a fraud book.

The segment is material, not marginal

Half the adult population, on the regulator’s count

A concentration only matters if the segment is big enough to hold real exposure and this one is not an edge case. The FCA’s Financial Lives survey found 26.4 million adults, 49% of the UK total, had characteristics of vulnerability in May 2024.⁶ That is down from 52% in May 2022 and still roughly half the adult population.⁶

The drivers are ordinary. In May 2024 the survey found 26% of adults with low resilience and 20% who had been through a negative life event.⁶ A further 17% had low capability and 9% were in poor health, with overlap between the four.⁶

Unless your book departs sharply from the population, a material share of it sits inside the cohort on the FCA’s definition. FG21/1 already expects firms to understand the nature and scale of characteristics of vulnerability in their own customer base.¹

Reporting on its review of firms’ treatment of this cohort, the FCA found that “consumers in vulnerable circumstances continue to report poor outcomes when compared with other consumers”.

Financial Conduct Authority, Firms’ treatment of customers in vulnerable circumstances: review, 7 March 2025

The FCA wrote that in March 2025, after finding that progress in individual firms was not yet showing in its UK-wide survey data.² Its aim has not moved since FG21/1: outcomes for this cohort as good as those for other consumers.¹ The gap between the aim and the finding is where the concentration sits.

The exposure nobody has measured

The gap the regulator has already named

Article 5 introduced the measurement consequence: a prevention obligation that is not measured cannot be evidenced. For this cohort the FCA has named the gap itself.

Its 2025 review put outcomes monitoring among the areas where improvement remains.² Firms and experts asked for more guidance on data-monitoring methods and on which outcomes to measure.² The Duty expectation is more specific than the guidance the review left standing.

The FCA and the ICO, in their joint statement of 27 March 2026, expect firms’ monitoring to show where groups such as customers in vulnerable circumstances get worse outcomes.⁷ Root causes should be investigated and boards should be able to challenge the findings.⁷ Applied to fraud, that means management information (MI) a risk committee can challenge: cohort-level exposure, evidence-readiness and outcomes, with a named owner for the numbers.

Few institutions can produce that MI for fraud. Since October 2024 in-scope PSPs have recorded vulnerability at claim level because the reimbursement rules require it and the PSR’s 14% figure exists for that reason. What the claim record does not hold is exposure before a claim, evidence-readiness or outcomes beyond reimbursement.

Outside the claim record, loss is reported by fraud type and channel and complaint outcomes by product. The vulnerability flag, where there is one, usually sits in a customer record the fraud system never reads. The concentration is real and nobody can see it, which is a fragile position for a risk committee.

Why the reach of the architecture is the exposure

Article 2 established the pre-session window: the manipulation that defines these cases is complete before any transaction exists. Article 4 set the Duty test as foreseeable harm.

For customers in vulnerable circumstances the two combine. The harm is foreseeable on the FCA’s own account of the cohort and the point where it can still be prevented sits upstream of anything a session-level control can see. So the exposure has a second dimension beyond size: reach.

An architecture that starts at the transaction reaches this cohort last (after the manipulation has done its work) and it captures the least event evidence for them. Whatever the institution intends, the reach of its architecture sets the exposure it holds.

Welfare or concentration: the framing decides the budget line

The same incident, booked twice

None of this argues against the welfare motive. For a mutual it is close to the reason the institution exists; for any regulated firm it is a Duty obligation the FCA is watching. The argument is narrower: welfare framing under-resources the problem, because of where it files the spend.

Filed under welfare, the same incident produces a training module, a helpline, a goodwill payment and a case note and nobody owns the aggregate. Filed as concentration risk, it produces a measured exposure, an evidence-readiness position, a board metric and an architecture decision and the risk committee owns all four. The facts are identical; the framing decides the budget line.

Measuring customers in vulnerable circumstances is itself regulated

A design constraint, not a reason to leave the exposure unmeasured

Your data protection officer will have raised this already. Identifying customers with characteristics of vulnerability, monitoring their outcomes and reading behavioural signals to protect them all involve processing personal data, some of it special category data such as health. That is a design constraint, not a reason to leave the exposure unmeasured.

The FCA and the ICO dealt with the point directly in their joint statement of 27 March 2026. Data protection laws, the two regulators wrote, “do not stop firms from delivering good consumer outcomes under the Consumer Duty”.⁷ Firms must still comply with those laws while doing so.⁷

The statement sets out the lawful bases that may apply and the extra conditions for special category data.⁷ It covers when a data protection impact assessment is required and the rules on profiling and solely automated decisions.⁷ FG21/1 carries an appendix on the same considerations, so the tension predates the statement.¹

What the statement changes is the posture. The lawful-basis question gets answered in the design of the monitoring, with the DPO at the table, before the first metric exists. This is a description of the constraint, not legal advice on how to meet it.

Three questions for the risk committee

At the level a board report is written

Article 7 gave the risk team five audit questions on evidence. These three are for the risk committee, pitched at the level its MI pack is written. They belong there because the joint statement expects boards to be able to challenge the findings.⁷

1. Exposure: can we report fraud loss, claim volume and outcomes for customers in vulnerable circumstances as a segment, does a named person own that number and how old is it by the time the committee sees it?
2. Evidence: for a disputed claim from this cohort, could we show what the customer saw, did and was offered at the time, or only what the journey was configured to do?
3. Outcomes: can we show that outcomes for this cohort have moved in the direction the Duty requires and could the board challenge the figure?

“Not yet” to all three is, on our reading, where most books stand and it is not a conduct failure. It is an unmeasured concentration and the committee knows which one.

Concentration tells you where protection has to reach. It says nothing about when protection has to arrive and the answer to that is uncomfortable: the warnings most institutions rely on reach the customer at the worst possible point in the journey. Article 9 follows that journey to the moment the warning lands and asks why it lands there.