When a payment goes wrong: your bank's duties

Most payments go through without a hitch, but when one does not, the law gives you specific rights against your bank or payment firm. If a payment you did not authorise leaves your account, the firm must refund it and put your account back the way it was. If you complain about a payment, the firm must give you a final response within 15 days, not the eight weeks allowed for other banking complaints. And if you send money to the wrong account by typing the wrong details, there is an established process for trying to get it back, though no guarantee you will.

These duties come from the Payment Services Regulations 2017, which brought the revised EU Payment Services Directive, known as PSD2, into UK law with effect from January 2018¹. They sit alongside older protections such as the Direct Debit Guarantee and the card chargeback rules. This page explains which payments are covered, what your bank must do when something goes wrong, how to recover a misdirected transfer, and how to complain if the firm will not play ball.

Which payments the rules cover: transfers, direct debits and cards

The payment services rules apply to the everyday ways of moving money out of a payment account. The Financial Ombudsman Service, which handles disputes about banking, lists current accounts, savings accounts, direct debits, money transfers and electronic payment platforms among the services it covers⁸. At the heart of the rules is the idea of a "payment account": an account held in the name of one or more consumers through which you can place funds, withdraw cash and execute and receive payment transactions to and from third parties, including credit transfers. Savings accounts, credit card accounts used solely to repay card debt, current account mortgages and e-money accounts are outside this definition unless they are used for day-to-day payment transactions⁹.

The transactions the rules cover include direct debits, payments through a payment card including online payments, and credit transfers including standing orders, within the United Kingdom in sterling. That list comes from the rules on basic bank accounts, but it describes the core payment transactions generally¹⁰. Direct debits carry their own long-standing protection: they are covered by the Direct Debit Guarantee, and if the bank or the organisation you are paying makes a mistake, your bank must refund the payment to you¹¹.

The rules also follow the money when a customer moves banks. Where there is an arrangement between the old and new bank, the bank must transfer any account balance and make arrangements for direct debits and standing orders, and the rules state that mistakes or delays in the transfer process which lead to bank charges are not something the customer has to pay for¹².

The central protection is for unauthorised transactions. Where a payment transaction was not authorised, the payment service provider must refund the amount of the transaction to the payer and restore the debited account to the state it would have been in had the transaction not taken place¹³. The same duty appears in the regulations themselves: refund the amount of the unauthorised payment transaction to the payer and, where applicable, restore the debited payment account to the state it would have been in².

Payments the rules do not cover: cash, cheques and ATMs

Not everything that moves money counts as a payment service. The regulations list what does not: cash transactions carried out without an intermediary, transactions by commercial agents, the physical transport of banknotes and coins, non-professional charitable cash collection, cashback, cash-to-cash currency exchange, paper cheques, bankers' drafts, paper vouchers and postal orders, system-internal transactions, securities asset servicing, services by technical service providers, limited-network instruments, services billed through telecoms accounts, certain own-account and intra-group transactions, and independent ATM cash withdrawal services¹⁴.

The practical effect is that the specific duties described on this page, such as the automatic refund of unauthorised electronic payments, attach to electronic payment services rather than to paper or cash methods. That does not leave you without recourse for these. The Financial Ombudsman Service can look at complaints involving cheques and bankers' drafts, giving examples such as a cheque bouncing after being paid in, a bank paying a written cheque after cancellation, a cheque being lost, stolen or forged, or a banker's draft turning out to be fake or going missing with the bank refusing to refund you¹⁵.

So a bounced cheque is not covered by the payment services refund rules, but the bank's handling of it can still be challenged through the complaints process and, if needed, the ombudsman. The distinction matters most for timing: payment complaints get the 15-day final response deadline, while complaints about other banking matters get eight weeks³.

How the payment services rules protect you when you send money

When you authorise a payment, the rules set out what the firm owes you if it goes wrong, is late, or is executed defectively. A payment service user is entitled to redress under regulations 76, 91, 92, 93 or 94 of the Payment Services Regulations 2017, which cover liability for unauthorised transactions, non-execution or defective or late execution of transactions, and charges and interest¹⁶. In plain terms: if the payment does not arrive, arrives late, arrives in the wrong amount, or leaves your account without permission, there is a specific regulation that says who bears the loss.

For unauthorised transactions, the refund duty is the core protection. Where an executed payment transaction was not authorised, the provider must refund the amount and restore the debited account to the state it would have been in had the transaction not taken place². Which, the consumer organisation, sets out what this means for card fraud: where card details are used without the card being lost or stolen, for example where a card is cloned, account data is lost in a data breach, or details are misused by a retailer, the regulations provide for a refund in full as long as the unauthorised transaction is reported promptly. The debit card provider must also refund interest or other charges, such as an overdraft fee, caused by the unauthorised payment, so that the account holder is in the position they would have been in if it had never happened¹⁷.

The rules have been tightened since 2023 for fraud cases. The Financial Services and Markets Act 2023 amended regulation 90 of the Payment Services Regulations, which deals with liability for incorrect unique identifiers, such as when a transfer is sent to the wrong account. The amendment provides that nothing in that regulation affects the liability of a payment service provider under a relevant requirement where the payment order is executed subsequent to fraud or dishonesty¹⁸. In other words, a firm cannot use the "you typed the details" rule to escape duties that apply when fraud is behind the payment¹⁹.

There are limits to what a firm must do. Payment services providers, for example banks and building societies, are allowed to block payments and freeze your current account if they suspect it has been used as part of fraudulent activity, for money laundering or other illegal activity, or if a court orders them to do so²⁰. And the protection you get depends on how you pay. MoneyHelper advises paying by credit card for purchases over £100, by debit card or by PayPal rather than by bank transfer, because you have more protection²¹.

One structural protection worth knowing about is Confirmation of Payee. It works by checking whether the name of the account a payer is sending money to matches the name they have entered, and alerting the payer when there has not been a match²². It is designed to catch both typing errors and impersonation scams before the money leaves your account.

Sent money to the wrong account: how recovery works

A "misdirected payment" happens when you send money to the wrong bank account⁶. It is one of the most common payment errors, and the recovery process depends on whether the account you typed actually exists.

If the account does not exist, the payment should fail and the money should automatically bounce back to you⁶. If the account does exist, you need to contact your bank to request your money back⁶. Your bank then contacts the receiving bank under a code of best practice, introduced in 2014, which outlines how banks should act when a customer sends money to the wrong account⁶. The recipient's bank contacts its customer to ask for permission to return the funds.

The recovery route for money sent to the wrong account.

The hard part is the person who received the money. If your bank cannot reclaim the funds straight away, for instance if the recipient disputes their return, the bank aims to report the outcome of its investigation within 15 business days⁶. There is no absolute right to the money back: if the recipient keeps it and the banks cannot persuade them otherwise, the code cannot force them. If you are unhappy with how your bank handled the recovery, you can complain, and the firm has 15 days to give a final response on a payments-related complaint³.

The ombudsman can also look at the other side of the transfer. It can examine complaints about the bank or payment service provider that received your money, considering the steps it took to recover it and whether it should have had concerns about its customer's account²⁴. That matters in scam cases, where the receiving bank's conduct is part of the picture.

Two related points are worth knowing. Authorised push payment scams, where someone knowingly or unwittingly transfers money from their own bank account to another that belongs to a scammer, are the second biggest type of payment fraud²⁵. If you were tricked rather than merely careless, the complaint is treated as a fraud matter, not just a misdirected payment, and the ombudsman can consider whether either bank should have spotted the warning signs.

Strong customer authentication: why your bank asks you to verify payments

If your banking app asks you to approve a purchase with a fingerprint, a passcode and a text message, that is the law at work. A payment service provider must apply strong customer authentication where a payment service user accesses its payment account online, initiates an electronic payment transaction, or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses⁷. The same duty appears in the regulations' miscellaneous provisions².

Strong customer authentication means two or more independent elements to log in: something you know, such as a password, something you hold, such as a phone, and something you are, such as a fingerprint. For remote transactions, a unique authentication code must dynamically link the transaction to the amount and the payee, so the approval you give is tied to that specific payment and no other¹⁷. That is why the app shows you the exact amount and recipient before it asks for approval.

The duty also shifts the burden of proof in your favour. If you claim the use of your card was not authorised by you, it is for your bank to prove otherwise²⁷. The same rule applies to unauthorised payments taken for distance sales, purchases made over the internet, by telephone, TV or teletext, where you may have a right to get your money back from your bank account, and the bank may be able to cancel the payment or put the money back into your account²⁸.

Recurring card payments, where a business asks for your debit or credit card information instead of your bank account details, get specific treatment too²⁹. Any further payments taken by the business after you cancel a recurring card payment are considered to be unauthorised transactions²⁹, which brings the refund duty into play.

Banks do not always accept a claim at face value. In one ombudsman case study, a customer's bank refused to refund money, saying she had authorised the payments herself⁵. That is exactly the kind of dispute the complaints process and then the ombudsman exist to settle, and it shows why keeping your own record of what you approved matters.

No surcharges for paying by card

A retailer or trader cannot charge extra for paying by consumer debit or credit card. The ban works by prohibiting a payee from charging a payer any fee in respect of payment by means of a card-based payment instrument which is not a commercial card, or a payment service to which Regulation (EU) 260/2012 applies³⁰. The same prohibition is restated in the regulations' schedules³. Which summarises the effect for consumers: retailers and traders are no longer allowed to charge a surcharge for using a credit or debit card when making a purchase¹⁷.

The carve-out is for commercial cards, the corporate cards businesses use. If you are paying as a consumer with a personal debit or credit card, the ban applies. A trader who adds a "card handling fee" to your bill is breaking the rule, and you can challenge the charge with the trader and, if it is not dropped, complain about the practice. This is a consumer protection rule rather than a payment error rule, but it belongs on this page because it is one of the most common ways a payment ends up costing more than it should.

Note the difference from charges your own bank may apply. The surcharge ban stops the payee, the business taking your money, from charging for the method of payment. It does not stop your own bank charging its own fees, for example an overdraft charge, which is a matter of your account terms.

Complaining to your bank: a final response within 15 days

Payment complaints run on a faster clock than other banking complaints. When people complain about payment services, businesses need to give their final response within 15 days, rather than the eight weeks they had previously¹. MoneyHelper states the same rule for bank complaints: they have 15 days to investigate and give a final response if the complaint is related to payments, and if it is about anything else, they have eight weeks³.

The 15-day deadline applies across the payment complaints the ombudsman handles. If your complaint is about a card payment or direct debit, the business must look into things and get back to you within 15 days³¹. The same applies to complaints about fraud and scams³², and to complaints about frozen accounts and blocked payments, where the firm must get back to you within 15 days, either with a response or to explain that it needs more time²⁰.

The stages of a payment complaint and the deadlines at each one.

The process in order:

1. Contact the firm and set out what went wrong, when, and what you want it to do. For unauthorised payments, do this within 13 months of the payment date⁴.
2. The firm investigates. For payment services complaints, including bank transfers and direct debits, fraud and scams, and electronic money, it has 15 days to consider the complaint and give a final response³⁴.
3. If the firm cannot resolve it, or you are unhappy with the final response, take the complaint to the Financial Ombudsman Service³⁴.

The ombudsman sets out the same list: a business has only 15 days to consider complaints about fraud and scams, payment services such as bank transfers or direct debits, and electronic money, for example online money transfers, Apple Pay or travel money cards³⁴. If the firm misses the deadline or sends a final response you reject, the ombudsman can pick up the case. The guides to complaining about a bank, making a complaint to a financial firm and taking a complaint to the ombudsman cover each stage in more detail.

E-money firms and money transfer companies

The same complaint rules reach beyond high street banks. The Financial Ombudsman Service deals with complaints about electronic money, also known as e-money, digital currency or digital cash³⁵, and it can assist with complaints about an e-money business if it has unfairly reversed a payment or placed restrictions on your account. If it thinks the e-money business has done something wrong, it will tell them to put things right, and may also tell them to pay compensation for any distress or inconvenience you have experienced³⁵.

E-money firms hold your money differently from banks. Under FCA rules, payments firms must continue to hold relevant funds they receive in exchange for issued e-money in a separate safeguarding account from relevant funds received for unrelated payment services³⁶. Safeguarding is not the same as FSCS deposit protection, so the protection for money held with an e-money firm works differently from money in a bank account. The FSCS explained page covers what deposit protection covers and what it does not.

For money transfer companies, the ombudsman's scope covers the businesses that send money abroad: a high street bank, a specialist money transfer and remittance business, an online payment service, or a foreign exchange specialist³⁷.

One eligibility rule matters for scam victims. Under the FCA's complaint rules, a person who has transferred funds as a result of an alleged authorised push payment fraud is an eligible complainant where the respondent is or was involved in the transfer of the funds and the complaint is not a PSD complaint³⁸. In practice, that means a victim of a bank transfer scam can complain to the ombudsman about the firm that received or handled the money, not only their own bank.

One boundary to note: the ombudsman's rules for small businesses differ depending on whether what you are complaining about happened before or after 1 April 2019³⁹. For individuals, that boundary does not apply.

When recovery or a fix takes longer

Not every payment problem is solved in 15 days. A frozen account or blocked payment can take longer to investigate, and the firm's first response within 15 days may be an explanation that it needs more time rather than an answer²⁰. A misdirected payment where the recipient disputes returning the money runs to its own 15-business-day investigation outcome under the code⁶, and even then the money may not come back if the recipient refuses.

Switching banks adds a longer safety net. Under the Current Account Switch Service, for 36 months the new bank will arrange for payments accidentally made to your old account to be automatically redirected⁴⁰. The new bank must also refund you for any charges incurred as a result of a direct debit or standing order not having been successfully transferred to the new account⁴⁰. So a payment that goes to a closed or old account after a switch is not lost; it should follow you, and any charges it caused should be refunded.

If a payment problem drags on, the escalation route is the same: complain to the firm, wait for the final response or the deadline, then go to the ombudsman. The ombudsman can look at whether the firm handled the investigation properly, not only at the original error. The page on how long the Financial Ombudsman takes covers what to expect after a complaint is referred.

What a payment error can cost you

A payment that fails or bounces can trigger charges elsewhere in your finances. If a direct debit or standing order bounces because a payment you were expecting did not arrive, you can face heavy bank charges, so it is worth making sure there is enough money in your account⁴¹. If an unauthorised or misdirected payment pushes you into unarranged overdraft, the consequences can include a penalty charge and a high rate of interest, charges for reminder letters and for direct debits or cheques put through the account, and the bank may freeze the account until the overdraft is paid off⁴².

The rules push these costs back where the error was not yours. Where card details are used without the card being lost or stolen, your debit card provider must refund charges caused by the unauthorised payment so that you are in the position you would have been in¹⁷. Where a switching error causes charges, the new bank must refund them⁴⁰. And where the ombudsman finds a firm did something wrong, it can tell the firm to put things right and pay compensation for distress and inconvenience³⁵.

The practical steps to limit the cost of a payment error:

• Report unauthorised payments promptly, and in any event within 13 months⁴.
• Ask for a refund of any charges the error caused, citing the refund rules¹⁷.
• Keep a record of what you authorised, since the bank must prove a payment was authorised if you dispute it²⁷.
• If the firm refuses, complain and take an unresolved complaint to the ombudsman³⁴.

Free, impartial help is available at each stage. MoneyHelper, the government-backed money guidance service, publishes guidance on banking and payment problems, and the Financial Ombudsman Service handles complaints about banks, e-money firms and money transfer businesses free of charge. The consumer protection guide and the scams and fraud guide pull together where each kind of help fits.