Authorised push payment reimbursement: how bank transfer scam refunds work

An authorised push payment (APP) scam happens when someone is tricked into instructing their bank to transfer money to a fraudster¹. The criminal usually poses as a genuine organisation: your bank, a government body, a solicitor or a seller. Because you authorised the payment yourself, even though you were deceived, for years banks could simply refuse to give the money back.

That changed on 7 October 2024. Since then, all financial institutions must refund customers who have been victims of authorised push payment fraud, in all but exceptional cases². The rules, made by the Payment Systems Regulator (PSR), cover payments sent through Faster Payments and CHAPS from one UK bank account to another³. A victim can claim up to £85,000 per claim, though the bank may deduct an excess of up to £100⁴. Most refunds must be paid within five business days⁵.

The rules are working. Between 7 October 2024 and 31 March 2026, 88% of the money lost to APP scams, some £316 million, was reimbursed to victims⁶.

What an authorised push payment scam is

An authorised push payment scam occurs when someone is tricked into instructing their bank to transfer money to a fraudster¹. The scammer typically pretends to be from the victim's financial institution or another legitimate organisation². Common examples include fake bank security calls that persuade you to move money to a "safe account", fraudsters posing as solicitors during a house purchase, or non-existent goods sold online. The warning signs of a scam and the tactics behind phishing, vishing and smishing are covered elsewhere on this site.

What makes APP scams distinct is authorisation. With an unauthorised transaction, a fraudster takes money without your permission and the bank must usually refund it. With an APP scam, you instructed the payment yourself, under false pretences. The distinction between authorised and unauthorised payments matters because the refund routes differ.

Before October 2024, most banks signed up voluntarily to the Contingent Reimbursement Model Code, which set out when they would refund victims, but participation and outcomes varied. The PSR described APP scams as a growing problem that needed to be addressed, and moved from a voluntary approach to a mandatory reimbursement requirement¹. Under the new rules, payment firms must reimburse all in-scope customers who fall victim to APP fraud in most cases⁵.

Who the rules protect: personal, micro-business and small charity accounts

The reimbursement requirement applies to APP scam payments made by individuals, micro-enterprises and charities⁵. In practical terms, that means payments from personal bank accounts and payments made by micro-enterprises and certain charities⁷. A sole trader paying a fake invoice from a business account, a small charity transferring a grant to a fraudster, and an individual buying goods that never arrive from a scam seller are all within scope, provided the other conditions are met.

Larger companies are not covered. The rules were designed around consumers and small organisations, on the basis that these customers are least able to absorb losses and least able to assess payment risk themselves. If you run a business that is too large to count as a micro-enterprise, a scam loss is a commercial matter between you and your bank rather than something the mandatory rules compel the bank to refund.

The rules also protect honest claimants only. A consumer who is themselves party to the fraud or dishonesty giving rise to their claim, including what is known as first-party fraud, is ineligible for reimbursement⁸. This closes the obvious loophole of someone inventing a scam to recover money they knowingly sent, for example to a gambling site or an account they control.

Payments covered: Faster Payments and CHAPS within the UK

The mandatory rules cover two payment systems: Faster Payments, the near-instant transfer service most people use for online banking, and CHAPS, the same-day system used for large transfers such as house deposits⁷. Everyone making a payment via Faster Payments or CHAPS from one UK bank account to another is covered³.

The rules apply to the payment service providers that offer these systems, which includes most UK banks, building societies and e-money firms, and also to firms making CHAPS payments⁹. The requirement covers payments sent and received by providers in the UK, including payments initiated through a third-party payment service⁵.

Two everyday situations fall inside this net. A Faster Payment from a current account to another person's UK account is the most common route, and it is how most purchase and impersonation scams are paid. A CHAPS transfer, typically used for conveyancing or other high-value payments, is equally covered, which matters because these single payments can be very large. The difference between bank transfer and card protection is that card payments follow an entirely separate set of rules.

Where the reimbursement rules do not apply

The requirement has clear boundaries, and a claim can be refused, or simply fall outside the rules, on several grounds⁵:

• payments made through other payment systems, such as Bacs or international transfer networks
• payments made before 7 October 2024
• international payments: you are not covered for a payment sent overseas⁷
• payments made for unlawful purposes
• civil disputes, such as paying a legitimate supplier who then fails to deliver or delivers something defective¹⁰

The civil dispute exclusion is worth understanding. If you paid a real company for goods or services and something went wrong with the purchase, that is a dispute, not a scam, and the reimbursement rules do not apply even if you paid by bank transfer. Your remedies lie elsewhere, such as the company's own complaints process or the courts.

Payments made using cash, a cheque, or a credit, debit or prepaid card are also excluded⁷. If you paid a scammer by card, different protections apply: credit card versus debit card protection explains chargeback and Section 75. Payments to another account you control, and payments to or from credit union, municipal bank or national savings bank accounts, are outside the rules too⁷. The position on overseas payments and on crypto purchases are covered in detail on their own pages.

Reimbursement limit and excess: up to £85,000 per claim, minus up to £100

The rules require banks and other payment providers to reimburse victims up to a maximum of £85,000 per claim⁴. A claim can include several payments made as part of the same scam, so the cap applies to the total, not to each transfer. The maximum amount you can claim back is £85,000⁹.

The limit was not always this number. When the PSR finalised the policy in December 2023, it set the maximum level of mandatory reimbursement at £415,000 per claim, in line with the Financial Ombudsman's maximum award, applying to all consumers¹¹. In 2024 the regulator reduced the maximum for Faster Payments APP scams to £85,000 per claim, from the previously confirmed £415,000¹², a change Which? had responded to in consultation¹³. Some guidance and commentary still quotes the old figure, which is why confusion persists. What happens when losses exceed £85,000 is explained separately.

On top of the cap sits an excess. Payment providers may charge an excess of up to £100 per claim⁹, deducted from the refund. The sending bank decides whether to apply the full £100, a lower excess, or none at all¹¹. The excess must not be applied to vulnerable customers¹⁰.

The consumer standard of caution and gross negligence

Reimbursement is the default, but there are two exceptions: where the consumer acted fraudulently (first-party fraud), and where the consumer acted with gross negligence⁵. Gross negligence is a deliberately high bar. The PSR interprets it as a higher standard than ordinary negligence under common law: the customer needs to have shown a very significant degree of carelessness¹⁰. Simply falling for a convincing scam, ignoring a vague warning or being rushed by a caller does not come close to it.

The consumer standard of caution sets out the steps a customer is expected to take, such as heeding specific warnings from their bank before paying. Where the standard is not met, the bank may be able to withhold a refund, but only if the customer was not vulnerable at the time¹⁴. The full detail is on the page about the consumer standard of caution and on gross negligence.

There is also a reporting expectation. Consumers should, after making a claim and if their bank asks, consent to the bank reporting the matter to the police on their behalf, or report the details of the scam themselves to a competent national authority¹¹. Failing to do so can affect a claim under the standard of caution. The PSR's consolidated policy statement is general guidance to help interpret the policy; the definitive requirements sit in the legal instruments¹⁵.

Extra protection for vulnerable customers

The rules build in additional protections for customers deemed vulnerable¹⁶. If the rules apply and you were particularly vulnerable to the specific type of APP scam, your bank or payment provider must reimburse you⁴. Vulnerability is assessed against the particular scam, not as a general label: someone may be highly susceptible to an impersonation scam call, for instance, in a way they would not be to an online purchase scam.

Two concrete protections follow. First, the customer standard of caution and the claim excess must not be applied to vulnerable customers¹⁰, so a vulnerable victim receives the full refund with no £100 deduction and cannot have it refused for ignoring warnings. Second, under the scheme rules, a payment is reimbursable where the consumer standard of caution exception does not apply, or where the victim was a vulnerable consumer when the payment was authorised¹⁴.

Banks are expected to identify vulnerability when a customer reports a scam, but it helps to say plainly, at the outset, any circumstances that made you susceptible: illness, bereavement, cognitive difficulty, financial pressure or coercion. The page on extra refund protection if you are vulnerable goes further, and helping an older relative or someone else who has been targeted covers how to support someone else making a claim.

How to make a claim, and the 13-month deadline

Your first step is to contact your bank, the sending institution, and report the scam². The bank will ask for details of the payments, the messages you received and how the scam unfolded. Ask it to attempt a recall of the payment and to freeze the receiving account. The page on first steps for victims covers what to do in the minutes after realising, and calling 159 explains the safe way to reach your bank by phone.

Claims are subject to a 13-month time limit, counted from the last payment sent to the scammer as part of the same scam¹⁷. Sending banks can deny claims submitted more than 13 months after the final payment in the claim⁵. If a fraudster took several payments over months, the clock runs from the most recent one, not the first.

When you claim:

1. Report the scam to your bank as soon as you can, and ask about a reimbursement claim.
2. Give the bank the payment details, dates, amounts and any messages or adverts involved.
3. Report the scam to the police, or consent to the bank doing so on your behalf if it asks¹¹. Where to report is covered in reporting a scam.
4. Keep copies of everything you send and receive.
5. Wait for the outcome within the timescales, and if refused, follow the complaints route below.

Five business days to be refunded, or up to 35 if the bank needs more time

Once a claim is made, the timescales are fixed. Sending banks must reimburse consumers within five business days⁵. Scam victims must be reimbursed within five UK business days unless the bank or payment provider needs to gather more information about what happened¹⁷. Where it does need more time, it must arrive at an outcome within 35 business days¹⁹. The PSR has clarified that the 35-business-day timescale is the window in which the sending bank must decide whether to reimburse¹¹.

The reality matches the rule. Of the claims closed under the policy between 7 October 2024 and 31 March 2026, 82% were closed within five business days, and 98% within 35 business days⁶. Firms are required to close cases and reimburse victims within five days of a Faster Payments APP scam claim being made²⁰.

If the deadline passes without a refund or a decision, that is itself grounds for complaint. Keep a note of when you reported the scam, because the clock runs from your report, not from when the bank acknowledges it. A bank that misses the timescales has not followed the rules, and the Financial Ombudsman can look at that failure as part of a complaint about how the claim was handled.

Who pays: the sending bank refunds, then shares the cost

The bank that sent the money, yours, pays the refund first. It can then claim back half: once a sending firm has reimbursed the consumer, it can require the receiving firm to pay it 50% of the reimbursement amount⁵. The cost of reimbursing victims is shared 50:50 between sending and receiving payment firms¹⁶.

The split reflects the regulator's reasoning that responsibility for allowing fraudulent payments belongs to both the sending and the receiving bank²¹. The receiving firm held the account that the fraudster used to collect the money, and the PSR's policy aims not only to make sure more victims get their money back but to prompt a step change in fraud prevention, by making receiving firms financially invested in spotting and freezing mule accounts²².

For the victim, none of this changes the experience: you claim from your own bank, it pays you, and the split happens behind the scenes. It matters only if your bank suggests the receiving bank must agree first. It does not. Your bank's obligation to reimburse is not conditional on the other side paying its share.

If your bank refuses: complaints and the Financial Ombudsman

If your bank refuses a refund, or applies an excess you disagree with, complain to the bank first. If you are unhappy with its response, you can take the matter further by referring it to the Financial Ombudsman Service¹⁸. The ombudsman can look at how your bank handled a scam where you were tricked into making a payment, including how it assessed your claim under the reimbursement rules⁴. The complaints process and taking a refused refund to the ombudsman are covered step by step on their own pages.

The ombudsman's powers are broad. It may ask the bank to refund payments, refund charges and interest the bank has applied, compensate you for money lost, and pay compensation for distress or inconvenience²³. It is a free service, and if the financial firm refuses a refund and you disagree, it can look into the complaint²⁴.

Two things are worth knowing. First, the ombudsman can still help where the reimbursement rules do not apply at all, for example me-to-me scams, card payments to genuine merchants, overseas payments and cash withdrawals handed to a scammer⁴. Second, the Payment Systems Regulator itself does not adjudicate individual complaints; its role is to set and enforce the rules and to publish data showing how well each bank protects customers²⁵. Individual performance varies: in 2024 cases closed before the mandatory rules began, Nationwide fully reimbursed 97% of reported APP scam cases and partially reimbursed 2%²⁶. Since the law changed, the reimbursement rate has risen from around 54% to 65%²⁷.