Banks are denying reimbursement to innocent victims of bank transfer fraud, despite many signing up to a new voluntary code, Which? claims.