Social media must do more to tackle payment fraud, says UK regulator