Unauthorised payments from your bank account: your refund rights

An unauthorised payment is one taken from your account that you, or someone acting on your behalf with your permission, never agreed to. In most circumstances your bank must refund you for any unauthorised payment¹. The rules come from the Payment Services Regulations 2017, which set out how banks, building societies and debit card providers must handle payments, and they give you a refund deadline measured in hours, not weeks: the bank must refund you no later than the end of the business day after the day it becomes aware of the unauthorised transaction².

Two limits shape every claim. Report the payment as soon as possible, and in any event within 13 months of the date it was made, or the bank can usually refuse³. And if your card or security details were lost or stolen, you may have to pay up to £35 of the losses taken before you notified the bank³. Where your card details were misused without the card ever leaving you, for example after a data breach, the refund is in full.

What counts as an unauthorised payment

A payment is unauthorised when it was executed without authorisation in the way the Payment Services Regulations require. The regulations place the duty on the bank: where an executed payment transaction was not authorised, the payment service provider must refund the amount of the transaction to you and restore the debited account to the state it would have been in had the transaction never taken place⁵. The same duty appears in the FCA's banking conduct rules, which require a firm to refund the amount of an unauthorised payment within a reasonable period and restore the account⁶.

Common situations that count as unauthorised include:

• your card is lost or stolen and someone spends on it
• your card is cloned, or your account data is exposed in a breach, and the details are used without the card leaving you⁷
• a business keeps taking recurring card payments after you cancelled the authority: any further payments taken after cancellation are considered to be unauthorised transactions⁸
• someone obtains your security details and moves money from your account without your knowledge

What an unauthorised payment is not: a payment you were tricked into making yourself. If you were deceived into authorising a transfer, perhaps by a fake investment or a bogus invoice, the payment was authorised by you even though it was fraudulent. Those are authorised push payment scams, and they are handled under a different reimbursement scheme described in the scams and fraud guide. The ombudsman can still help where reimbursement rules do not apply, for example card payments to genuine merchants, overseas payments and cash handed to a scammer⁹.

The refund is due by the end of the next business day

Once the bank is aware of the unauthorised transaction, the clock starts. The regulations require the refund to be provided as soon as practicable, and in any event no later than the end of the business day following the day on which the bank becomes aware of the unauthorised transaction¹⁰. This is a hard deadline in law, not a target. The FCA's conduct rules mirror it in plainer terms: the firm must refund the amount of the unauthorised payment within a reasonable period and restore the account¹¹.

The deadline runs from the bank's awareness, not from the date the payment was taken, which is why reporting quickly matters. The sooner the bank knows, the sooner the next-business-day deadline bites.

For comparison, if your case is an authorised push payment scam rather than an unauthorised payment, the timetable is different: the bank should provide the refund within five business days of you making the claim³.

What a refund covers: the payment plus charges and lost interest

The refund is not just the money that left the account. Because the regulations require the account to be restored to the state it would have been in had the unauthorised payment not happened⁵, everything that flowed from the payment gets reversed too. The FCA states that a refund also covers any charges and interest paid, or credit interest lost, because of the payment¹.

In practice this covers the knock-on costs that unauthorised payments often cause:

• overdraft fees or unpaid transaction fees triggered by the missing money, which are explained in overdraft charges
• debit interest charged on the resulting overdraft balance
• credit interest you would have earned on the money while it was gone

A related rule protects you when a payment you did authorise turns out larger than you expected. Where an authorised transaction initiated by or through a payee did not specify the exact amount, and the amount exceeded what you could reasonably have expected, you are entitled to a refund of the full amount¹². This is the rule behind refunds for unexpected card charges from a business.

The ombudsman applies the same thinking. In one case it upheld a complaint and told the bank to refund the extra account fees the customer had paid, plus interest¹³. In a scam case involving £100,000 transferred from a bank account, it told the bank to refund the full amount plus interest from the date of the loss to the date of the refund¹⁴.

How to report an unauthorised payment and claim a refund

The first step is simple: if you see a payment from your account that you did not authorise, contact your bank as soon as possible and claim a refund¹⁵. Most banks have a dedicated fraud line, and many let you freeze your card instantly in their app while you report the problem.

A claim in order:

1. Tell the bank that a payment was taken without your permission, and ask for a refund. Do this as soon as you notice the payment.
2. Give the details: the date, the amount, the payee as it appears on your statement, and why you did not authorise it. Statement abbreviations that help you identify a payment are explained in bank statement codes.
3. Ask for the account to be restored, including any charges or interest the payment caused.
4. Keep a record of when you reported it and what the bank said, in case you need to complain later.
5. Change your security details, and cancel the card or authority if it is still live.

Where the unauthorised payment was a card purchase made over the internet, by telephone, TV or teletext, you may have a right to get your money back, and the bank may be able to cancel the payment or put the money back into your account¹⁶. If your card provider will not give you your money back in that situation, you can report it to Trading Standards¹⁶.

The 13-month limit for making a claim

The regulations give you a long window, but not an unlimited one. You must report an unauthorised payment as soon as possible, or in any event within 13 months of the date the payment was made¹⁷. The same 13-month rule is repeated in guidance on continuous payment authorities taken from credit and debit cards⁴.

The limit runs from the date of each payment, not from when you noticed it. If a series of unauthorised payments was taken over months, the oldest ones may fall outside the 13-month window while the newest ones remain claimable. Missing the limit is one of the few grounds on which a bank can usually refuse a refund: it can refuse if you told them about the fraud 13 months or more after the payment was taken³.

When you pay up to £35 of the loss

If your payment instrument was lost, stolen or misappropriated, the regulations allow the bank to require you to bear a share of the losses, up to a maximum of £35¹⁰. Independent guidance puts the same figure in practical terms: tell the bank immediately, because you may have to pay up to £35 of any unauthorised payments taken before you notify the bank that your card was stolen or that someone has your security details³.

Three things to know about the £35:

• it is a cap, not a fixed charge: the customer's share cannot exceed £35 however large the losses
• it applies only to payments taken before the bank was notified; no liability falls on the customer for unauthorised payments taken after the bank has been told that a card was stolen or details compromised³
• it does not apply where the card was never lost or stolen, for example cloned card details or a data breach: in those cases the full refund is due as long as the transaction is reported promptly⁷

The position is different again for authorised push payment scams, where you authorised the payment after being deceived. There the bank can deduct £100 from the refund unless you are considered vulnerable under the rules, and the rules set a maximum the bank has to pay, currently £85,000³.

When a bank can refuse a refund

The starting point is firmly in your favour: in most circumstances, your bank must refund you for any unauthorised payments¹. A refusal has to rest on specific grounds. In an unauthorised payment claim, your bank can only refuse to refund you if you authorised the payment, if you acted fraudulently, or if you failed to protect the details of your card, PIN or password in a way that allowed the payment¹.

Independent guidance lists the same three doors a bank can use: it can prove you authorised the payments; it can prove you were at fault because you acted fraudulently or negligently; or you told them about the fraud 13 months or more after the payment was taken³.

The grounds are slightly different where the payment came from a credit card or an overdrawn current account. There, the bank can refuse if you, or someone acting on your behalf, authorised the payment, or if the person who used your card, including a virtual card, had it with your consent¹. Credit card payments sit under the Consumer Credit Act 1974 rather than the Payment Services Regulations⁷, which is why the rules are not identical.

Case studies from the ombudsman show both outcomes. In one, a bank refused a refund because it said the customer had authorised the payments herself, and the ombudsman examined whether that was fair¹⁸. In another, a customer complained that his bank had failed to cancel a direct debit; the ombudsman did not think the bank had made a mistake in one dispute and did not ask it to refund the payment¹⁹. Refusal is not the end of the road: each decision can be challenged through the complaint route at the end of this page.

Strong customer authentication also affects liability. The regulations define it as authentication based on two or more independent elements, where the breach of one element does not compromise the reliability of any other²⁰. Where strong customer authentication was required for a payment but your bank did not require it, you are not liable for the resulting loss, unless you acted fraudulently²¹. The regulations also require stronger authentication generally, including a unique authentication code that dynamically links remote transactions to the specific amount and payee⁷.

Cancelling card payment authorities and challenging Direct Debits

Recurring card payments, sometimes called continuous payment authorities, are the regular card charges used by subscriptions and gyms. You can cancel one by contacting the business taking the payment and asking them to stop, or by asking your card issuer to cancel the payment⁸. Your bank or card provider must cancel the payment authority when you ask⁴. If you did not consent to the recurring card payments at all, your card issuer should stop the payments and give you your money back⁸.

The key protection is what happens next: any further payments taken by the business after you cancel a recurring card payment are considered to be unauthorised transactions⁸. That brings them within the refund rules described above, including the next-business-day deadline once the bank is aware.

Direct Debits work differently, and are covered by the Direct Debit Guarantee: if the bank, or an organisation you are paying, makes a mistake, your bank must refund the payment to you²². The ombudsman enforces this in practice. In one case, a customer cancelled a direct debit but the payments continued; the ombudsman told the bank to refund him for the payments made since the cancellation²³. Direct Debit problems remain a live source of complaints: the ombudsman's data for the first quarter of 2026/27 records 113 complaints opened about Direct Debits²⁴. The differences between the two systems are set out in Direct Debits and standing orders, and the cancellation process in the Direct Debit Guarantee guide.

Credit cards, NS&I and credit unions: where different rules apply

Not every account sits under the Payment Services Regulations in the same way.

Credit cards. The refund provisions described on this page do not apply to credit cards, because the Consumer Credit Act 1974 already sets out rules that apply to credit card transactions⁷. Credit card purchases have their own protections, including Section 75, which is explained in the credit cards guide. The refusal grounds for credit card payments and overdrawn accounts are listed in the section above.

NS&I. National Savings & Investments states its own policy in the terms of its accounts: if you did not authorise a payment from your account, it will normally return the account to the position it would have been in had the unauthorised payment not happened²⁵. The same wording appears across its accounts, including Direct Saver²⁶, Green Savings Bonds²⁷ and the Junior ISA²⁸, and it extends to missed interest or prizes. The refund can be withheld where the customer failed to take reasonable care, did not report lost security details promptly, or where fraud by the customer is suspected.

Credit unions and others. The Payment Services Regulations do not apply to credit unions, municipal banks or the National Savings Bank²⁰. This does not mean money in those institutions is without protection, but the specific refund deadlines and liability caps on this page come from regulations those providers are exempt from. Credit unions are covered in the credit unions guide.

E-money accounts. Prepaid cards and e-money firms are not banks, but the ombudsman can assist with complaints about an e-money business that has unfairly reversed a payment or placed restrictions on your account, and can tell it to put things right and pay compensation for distress or inconvenience²⁹.

Complaining if your bank says no

If your complaint is about something your bank has done, for example refusing to refund an unauthorised payment, the route starts with the bank itself: contact the bank to make a complaint¹⁵. Give it the chance to investigate and issue a final response.

If the bank upholds its refusal, the Financial Ombudsman Service is the next step, and it is free. Its powers are wide: it may ask the bank to refund any payments you did not authorise, refund charges and interest the bank has applied, compensate you for any money you lost, and pay compensation for distress or inconvenience²². It can also look into complaints about the bank or payment provider that received the money, considering the steps it took to recover it and whether it should have had concerns about its customer's account⁹. Where reimbursement rules do not apply, such as card payments to genuine merchants, overseas payments and cash withdrawals handed to a scammer, the ombudsman can still help⁹.

The ombudsman's decisions are not automatic wins for consumers. In one case involving a holiday apartment rental scam, the ombudsman did not think the bank had made a mistake and did not ask it to refund the payment¹⁹. Each case turns on its facts, which is why keeping records of what you reported, and when, matters from the first phone call. More widely, your rights across financial services are set out in the consumer protection guide.