Which? says banks should refund all customers who are tricked into sending scammers money.