Failure to prevent fraud: platforms in the firing line

The UK’s corporate crime and technology accountability frameworks are undergoing a radical transformation. From the implementation of the Economic Crime and Corporate Transparency Act 2023 (ECCTA) to the regulatory duties of the Online Safety Act 2023 (OSA), the legal landscape is shifting decisively towards a failure-to-prevent model and greater corporate exposure. Jonathan Fisher KC’s landmark report, Fraud in the Digital Age, published in July 2026, has intensified this debate with recommendations specifically targeting online platform providers.

The statistics are damning: fraud now constitutes 44% of surveyed crime in England and Wales, yet a mere 1% of reported cases result in a criminal justice outcome. Underfunded and deprioritised over decades by successive governments, the justice system is plagued by systemic delays and poor infrastructure. Meanwhile, the tech revolution has created a world where platforms provide criminals with low-cost, highly sophisticated tools able to execute fraud on an industrial scale. This requires a serious effort to catch up and rebalance accountability: while the financial sector shoulders the heavy burden of mandatory reimbursement for authorised push payment (APP) fraud, the digital platforms hosting and monetising the underlying scam advertisements have so far escaped financial liability.

The Expansion of “Failure to Prevent” and Platform Liability

The “failure to prevent fraud” offence under the ECCTA, which came into effect on 1 September 2025, holds large organisations criminally liable if an associated person commits fraud for the organisation’s benefit. The principal defence is that the organisation had reasonable fraud prevention procedures in place. However, Fisher notes that this offence contains a loophole for tech companies, as it applies only to fraud committed by “associated persons”, such as employees or agents, for the benefit of the organisation. It does not capture fraud perpetrated by platform users, even when the platform directly profits from the resulting traffic and advertising revenue.

The Online Safety Act 2023 now imposes regulatory duties on platforms to mitigate illegal-content risks, including fraud, empowering Ofcom to issue substantial civil fines. However, this is a regulatory content-moderation tool, not a criminal enforcement mechanism. It does not impose a direct corporate criminal duty on platforms to prevent fraud at an organisational level.

To close this accountability gap, the Fisher Review proposes a dual-track mechanism that, if adopted, would fundamentally redefine platform liability.

First, Recommendation 2 calls for a new corporate criminal offence holding providers of regulated user-to-user services, as defined under the OSA, criminally liable if they fail to prevent fraud on their platforms. This offence would mirror the ECCTA’s failure-to-prevent model, likely requiring platforms to implement robust, proactive fraud prevention procedures or face unlimited criminal fines.