Banks must do more to tackle scams where people are tricked into transferring money to a fraudster, the regulator has said.
The Payments Systems Regulator (PSR) was responding to a "super complaint" from consumer group Which?.
This complaint highlighted the problem of "push" fraud whereby victims are conned into paying the wrong person.
However, the PSR stopped short of recommending that banks should be forced to compensate customers.
In response, Which? said that banks had been let off the hook, and they would have little incentive to protect account-holders.
It had wanted banks to refund consumers in cases where customers accidentally transferred money to a fraudster, similar to the protections provided on credit card transactions.
At the moment banks pay up in about a third of such cases. But mostly they do not admit liability, leaving consumers out of pocket.
Such transfers work instantly, and cannot be recalled.
In one example highlighted by Which?, Christopher Mills, from York, was tricked into paying a £10,000 house deposit to a fraudster who posed as his estate agent.
The bank refused to cover the loss.
"Tens of thousands of people have, combined, lost hundreds of millions of pounds to these scams," said Hannah Nixon, the PSR's managing director.
"We need a concerted and co-ordinated industry-wide approach to better protect consumers, and we need it to start today."
The regulator said banks needed to work together to help detect this type of fraud, adding they could do more to identify potentially fraudulent payments.
It is recommending that:
- banks collect more data on such scams, so the industry can publish "robust" statistics
- banks work harder to identify potentially fraudulent payments
- the industry develops best practice standards, so banks follow a common approach in cases of fraud
However Which? accused the regulator of letting banks off the hook.
"The outcome for people is unfortunately that they will continue to be scammed out of millions of pounds," said Alex Neill, managing director of Which? home and legal services.
"We need to see swift action and not see this kicked into the long grass."
How to protect yourself against "push" fraud
When you transfer money from your bank account, you are asked to enter three pieces of information: The name of the payee, their account number, and the sort code. However only the last two are cross-checked by the bank. So putting in the correct name is no guarantee that person will get the money.
Financial Fraud Action UK offers the following advice:
- Never disclose security details, such as your PIN or full banking password
- Don't assume an email, text or phone call is authentic
- Don't be rushed - a genuine organisation won't mind waiting
- Listen to your instincts - you know if something doesn't feel right
- Stay in control - don't panic and make a decision you'll regret
The PSR has already proposed a series of improvements, such as "confirmation of payee", which would enhance payment security.
However, such changes are not due to take effect for several years.