Question 1

How safe is my money?

Accepted Answer

As a condition of its authorisation as an API by the FCA, Freemarket is required to protect and keep safe its customers’ funds. Specifically, Freemarket must comply with the Payment Services Regulations 2017 (PSRs). Freemarket Ireland must comply with the Payment Services Regulations 2018 (PSRs). These regulations stipulate that APIs must have appropriate and well-managed safeguarding arrangements to ensure client funds are not subject to any other claim and that in the event of insolvency, are returned to the client in full, and in a timely and orderly way.

This is set out in detail within:

PSRs regulation 23; and
Chapter 10 of the FCA Approach Document
(For Freemarket Ireland) within PSRs 2018 Regulation 17

Freemarket is not a bank; your account with Freemarket is a payment account rather than a bank account. The funds provided to Freemarket for the purposes of making a payment are not eligible for depositor protection via the Financial Services Compensation Scheme (FSCS) and/or the Deposit Guarantee Scheme (DGS).

Question 2

What is APP fraud and what measures are in place to prevent it?

Accepted Answer

What is APP (Authorised Push Payment) fraud?

APP Fraud is where individuals are victims of a scam due to fraudsters tricking them into sending money. Some examples (although not limited to) are as follows:

Impersonation scams where fraudsters pretend to be from your bank, a company you may have had interactions with in the past or the police.
Business Email Compromise scammers impersonate a company executive or supplier, sending an email that appears legitimate, instructing an employee to make a payment to a fraudulent account.
Purchase scams that trick you into paying for goods or services that are not brought to the point of completion.
Triangle scams where you may be asked to make a purchase for someone else, beware. This might be a triangle scam, where a scammer uses stolen payment info to buy goods and has you forward them. Secure your data, report the scam — and don’t make any transactions.
Investment scams is when criminals convince victims to ‘invest’ with promises of high or guaranteed returns. In 2023, investment scams comprised a quarter of all APP fraud losses, totalling £107.8 million.

Who is eligible for fraud reimbursement under the new rules?

The reimbursement requirement applies to individuals, micro-enterprises, and small charities, where an APP scam payment is made using Faster Payments or CHAPS in the UK and sent to a relevant account in the UK. To be eligible, you need to raise a claim as soon as you realise it’s a scam, but no later than 13 months of the final payment made to a fraudster as part of the same scam.

The rules require you to take caution when making payments — this is known as the Consumer Standard of Caution. Under the Consumer Standard of Caution, you should always remember to:

Report the fraud to Freemarket as soon as it happens.
Share all information necessary when reporting your claim to help the investigation.
Report the fraud to the police, or consent to Freemarket reporting on your behalf.
Have regard to specific, directed interventions made either by Freemarket, or by a competent national authority e.g. you should take note of any warnings made by Freemarket before you proceed with a payment.

Furthermore, as per clause 14.2 of the Freemarket terms and conditions, APP scams only apply to individuals, small charities and micro-enterprises and do not apply to companies deemed as corporates. Please ensure you are aware of the Terms and Conditions that have been agreed upon.

Every claim will be reviewed individually based on the information you provide as well as any information available from the receiving Payment Service Provider or the police.

How long will it take?

Any eligible APP claim must be reimbursed back within five business days of the victim reporting the scam. It may take longer under certain circumstances if we pause the five-business day reimbursement timescale. This can be done when Freemarket are liaising with yourselves and counterparties to ascertain the nature of the fraud and collect any relevant supporting documents. The timescale for deciding whether to reimburse is then moved to a maximum of 35 business days.

How much can be reimbursed?

The maximum reimbursement amount per claim is £85,000.

What measures have we taken to prevent APP Fraud?

Freemarket utilises best in class fraud detection measures and transaction monitoring to ensure we are playing our part in protecting you from fraud. Additionally, as per section 31 of your terms and conditions, Freemarket have implemented Confirmation of Payee to ensure better protection. Confirmation of Payee is an account name checking service designed to help reduce misdirected payments, and provides greater assurance that payments are being sent and collected from the intended account holder for UK domestic payments.

What can I do to avoid becoming a victim of APP Fraud?

To avoid becoming a victim of APP fraud, here are some effective measures you can take:

Verify Requests: Always double-check the identity of anyone requesting a payment. If you receive a request via email or phone, contact the person or company directly using official contact details,
Don’t rush: Scammers often create a sense of urgency. Take your time to think through the request and do not feel pressured to act immediately,
Be wary of unsolicited communications: If you receive unexpected messages or calls, especially those asking for personal information or payments, be cautious. Scammers often use tactics like impersonation,
Educate yourself: Stay informed about the latest scams and tactics used by fraudsters. Awareness is key to prevention. Keep up to date with Take Five for further advice,
Report suspicious activity: If you suspect you’ve been targeted or have fallen victim to a scam, report it to your local bank and local authorities immediately.

For more information on keeping safe online, please see our help article here.

Will I always be reimbursed?

You won’t get your money back if you’re found to have been complicit in the fraud or grossly negligent (i.e. ignoring clear warnings) or if you’re not an individual, micro-enterprise or small charity. Please note, this exception does not apply to vulnerable consumers.

Question 3

How do I set up 2FA on my account?

Accepted Answer

Two-factor authentication (2FA) or multi-factor authentication adds an extra degree of protection, and all users have to provide this code in order to access their account and make cross-border payments.

A user is only permitted access to an application or website using the 2FA electronic authentication procedure after successfully showing two or more pieces of evidence, including knowledge, possession, and inherent characteristics. Here are a few examples of this:

Something you know - a password or a pin
Something you have - a smartphone
Something you are - a fingerprint or facial recognition

Each user must configure 2FA, you can't do this for others at your organisation.

With the two-factor authentication enabled on your account, you would require an additional 6-digit verification code for a successful sign in to Freemarket.

To create a time-based one-time password (TOTP) that will change each time you use it, we advise setting up two-factor authentication on an app. For this, we advise adopting a cloud-based application. The majority of applications available would support this. Below we've listed some of the options available to you.

You must enter a verification code if 2FA is enabled on your Freemarket account in order to sign in successfully.

After setting up 2FA, a 30-day window will open for your account. Otherwise, on the 30th day, you will be asked to perform 2FA during a period of activity. If you are unable to execute 2FA in order to pass the checkup, you must utilise the given shortcut to modify your 2FA settings and maintain platform access.

First time setup

Log into the platform here

2FA Screenshot 1

https://malcolm-en-gb.s3.eu-west-1.amazonaws.com/instances/fnDSsgZVaa/resources/pXeX4Nv2Vt/2FA%20Screenshot%201.png (2FA Screenshot 1)

Once logged in, you will be presented with the page provided below. Please click on receive code to get the verification code depending on your current 2FA

2FA Screenshot 2

https://malcolm-en-gb.s3.eu-west-1.amazonaws.com/instances/fnDSsgZVaa/resources/rrV9Wmzpr8/2FA%20Screenshot%202.png (2FA Screenshot 2)

If there is a phone number registered on the account, then a verification code will be sent to the registered mobile number as a primary option for 2FA
If there is no phone number registered on the account, the verification code will be sent to the registered email address as a primary option for 2FA

Type in the verification code you were supplied

https://malcolm-en-gb.s3.eu-west-1.amazonaws.com/instances/fnDSsgZVaa/resources/Yx9AyMmDcs/New%20QR%20code.png (New QR code)

If you'd like not to be prompted for another 30 days, choose to remember the device
When you log in to your account, the next screen will appear
Download an authenticator app from the Google Play Store or the App Store that is compatible

Microsoft Authenticator for Android, iOS
Google Authenticator for Android, iOS

After downloading one of the authenticator applications, you have the option of manually entering the information or scanning a QR code
The authenticator app will display a 6-digit verification number after scanning the QR number; this code automatically refreshes every 30 seconds. You must enter this code in the verification code text box above and select verify
If everything goes smoothly the app's setup will be finished

Please note: If your current password does not meet the new complexity rules you will be prompted to change your password: once the password is updated, you will be sent back to the sign in page so you can log in with your updated credentials to sign in.

2FA Screenshot 4

https://malcolm-en-gb.s3.eu-west-1.amazonaws.com/instances/fnDSsgZVaa/resources/frPNeQDAEc/2FA%20Screenshot%204.png (2FA Screenshot 4)

Signing into Freemarket using the authenticator app

Once you've successfully set up the authenticator app, subsequent logins will require the verification code it creates, so when you enter your credentials, the next screen you'll be provided with will ask you to input the verification code.

2FA Screenshot 5

https://malcolm-en-gb.s3.eu-west-1.amazonaws.com/instances/fnDSsgZVaa/resources/kSw1rDStX8/2FA%20Screenshot%205.png (2FA Screenshot 5)

Open the authenticator app
Enter the the 6-digit verification code displayed on the authenticator app and click on sign in

Please email support@wearefreemarket.com to disable or resetting your authenticator app if you experience any difficulties logging in. This will enable you to install the authenticator app on either your current or new smartphone.

Question 4

I am entering the correct OTP but it still says incorrect OTP?

Accepted Answer

Freemarket sends a one-time password (or OTP) to authenticate customers, which you can receive OTP on mobile or email based on your preference. OTP is used to add extra layer of security during the sign in process or during delivery of certain orders. OTPs are unique and should not be shared with anyone.

If you have tried to access your login page multiple times, every new click on “Resend an OTP” will generate a new OTP. You should enter the latest OTP that you have received based on your preferences.

If you are still having trouble with the code, contact your Relationship Manager or email support@wearefreemarket.com.

Question 5

What is One Time Password (OTP)?

Accepted Answer

A one-time password (OTP) is a randomly generated string of letters, numbers, and/or symbols that is delivered to a user to be used for just one login or transaction. An OTP is more secure than a static password, particularly one that was established by the user and may be insecure or used on several accounts.

What are the benefits of OTPs?

OTPs reduce the risk around passwords.

Multi-factor authentication: OTPs can add an additional layer of authentication. Using security tokens, OTPs can be generated for users to provide as an additional form of authentication, which increases security and reduces the risk of a breach.
Time-based OTP (TOTP): this type of OTP is time-based, in that it provides a window of time within which the OTP code will be valid. In general, timesteps are 30-60 seconds in length. If the user does not enter the OTP code within the specified timestep, they must request a new one.

Read more on Twilio, Transmit Security, and Entrust.

Question 6

How can I keep safe online?

Accepted Answer

Take Five is a national campaign offering straight-forward, impartial advice that helps prevent email, phone-based and online fraud – particularly where criminals impersonate trusted organisations. Led by UK Finance and backed by His Majesty’s Government, the initiative is supported by a range of partners such as; the payment industry, financial services firms, legal sector, telecommunications providers, and commercial, public, and third sector organisations.

Stop: Taking a moment to stop and think before parting with your money or information could keep you safe.
Challenge: Could it be fake? It’s ok to reject, refuse or ignore any requests. Only criminals will try to rush or panic you.
Protect: Contact your bank immediately if you think you’ve fallen for a scam and report it to Action Fraud.

Visit the Take Five website here for more information.

We utilise best-in-class services to enhance our compliance and risk policies, and we use real-time rules-based monitoring in our automated transaction monitoring tool. To further safeguard our clients we hold all funds in segregated accounts with our banking partners.

How do I spot a fake, fraudulent or phishing email or website?

Phishing is a type of email attack in which a fraudster sends you an email while impersonating a person, business, or reliable website in order to obtain your passwords or other sensitive information or gain complete control of your computer.

The majority of phishing efforts take place via email, but fraudsters will use every method they can think of to get you to give them your information or money, including:

Fraudulent emails and other messages that look like they're from legitimate companies
Fake invoices saying you’ve missed a payment
Misleading pop-ups and ads that say your device has a security problem
Scam phone calls or voicemails that impersonate employees at companies
Fake promotions that offer free products and prizes

It’s best to be vigilant at all times, fraudsters want your personal details for a number of reasons. Freemarket will never ask you for any personal data. If you receive a message and are unsure it’s really from Freemarket, check to see if it does any of the following:

Uses generic, impersonal greetings like "Dear user" or "Dear [your email address]." We'll always refer to you in our correspondence by your first and last name or by your company name. Greetings like "Dear user" or "Hello Freemarket member" are never used by us.
Requests that you click on links that lead to phoney websites. Before clicking any links in emails, always double-check them. A link can have a secure appearance, such as www.wearefreemarket.com/SpecialOffers. To view the actual location, be sure to hover your cursor over the link. Don't click on the link if you aren't sure.
Has unidentified attachments. Open an attachment only if you are certain it is trustworthy and safe. Pay particular attention to invoices from businesses and contractors you are unfamiliar with. Some attachments contain viruses that install themselves when opened.
Projects a false feeling of urgency. Phishing emails frequently use alarmist language and urge you to update your account right away. They're hoping you'll be swayed by their haste and disregard red flags that the email is a scam. If there’s an urgent need for you to complete something on your account, you can find this information by logging into Freemarket directly.

You can find some more information, tips, how to spot phishing attempts and best practices from Apple, Santander, Microsoft, and Which.