Victims of bank fraud should not expect automatic refunds and are sometimes at fault for not taking a “duty of care”, the CEO of RBS has reportedly said.