Authorised and unauthorised payments: how refund rights differ

If a fraudster tricks you into sending a bank transfer, you are covered by the authorised push payment (APP) reimbursement rules. Your bank should refund you within five business days of your claim, up to £85,000, and it can deduct a £100 excess unless you are considered vulnerable¹. If instead someone uses your card or account without your permission, that is an unauthorised payment, and a different set of rules applies: your bank must refund the amount and restore your account to where it would have been³.

The distinction matters because the two routes have different rules, different limits and different grounds for refusal. An APP scam is one you authorised, because you were persuaded to send the money yourself. An unauthorised payment is one you never agreed to at all. Which one you are dealing with decides what you can claim, how quickly, and what your bank can hold back.

This page sets out both routes side by side, what each pays, the conditions attached, and what to do if a claim is refused.

Authorised or unauthorised: what the difference means for you

An authorised push payment is where you are persuaded to transfer money yourself, by a scammer pretending to be from your bank or a legitimate organisation². The payment is genuinely authorised by you, which is why the ordinary refund rules for unauthorised transactions do not apply. Instead, the APP reimbursement rules step in.

An unauthorised payment is the opposite: money leaves your account without your agreement. That covers a stolen card, a cloned card, or someone using your security details without permission. The Financial Ombudsman Service groups these into three categories: scams involving stolen details, unauthorised payments you have not made, and identity theft⁶.

The practical difference is who has to prove what. If you claim a card use was not authorised by you, it is for your bank to prove otherwise⁷. The burden sits with the bank, not with you. For an APP scam, the starting point is different: the payment was authorised, so the question becomes whether the reimbursement rules apply and whether any exception does.

Unauthorised payments are refunded under different rules

For unauthorised transactions, the Payment Services Regulations 2017 set the framework. Where a payment was not authorised, the payment service provider must refund the amount to the payer and, where applicable, restore the debited account to the state it would have been in had the transaction not taken place³. That is a legal duty, not a goodwill gesture.

Your liability is capped. You may have to pay up to £35 of any unauthorised payments taken before you notify the bank, and you are not liable for anything taken after you tell the bank your card has been stolen or that someone else has your security details⁵. Regulation 77 sets the same £35 maximum liability for losses from a lost, stolen or misappropriated payment instrument¹¹.

The refund covers more than the payment itself. Your debit card provider must also refund interest or other charges, such as an overdraft fee, caused by the unauthorised payment, so that you are put back in the position you would have been in¹². If a business keeps taking money after you cancel a recurring card payment, those further payments are considered unauthorised transactions¹³.

Savings providers apply the same principle. NS&I states that if you did not authorise a payment from your account, it will normally return the account to the position it would have been in had the unauthorised payment not happened¹⁴. Its broader policy is to refund unauthorised payments and any missed interest or prizes, unless the customer failed to take reasonable care or did not report lost security details promptly¹⁵.

APP fraud reimbursement: up to £85,000 per claim

The APP reimbursement requirement came into force on 7 October 2024, and applies to payments sent from a bank in the UK to another bank in the UK². The maximum you can claim is £85,000 per claim¹. The regulator's own data refers to the £100 excess and the £85,000 maximum cap in the same breath, confirming both figures⁹.

The £100 excess is a deduction the bank can make from the refund unless you are considered vulnerable under the rules, and some banks do not apply it at all¹⁷. There is no separate minimum value threshold for APP fraud claims under the requirement⁸, so a small loss is technically claimable, though the £100 excess means the amount recovered may be limited in practice.

The rules were designed to change behaviour as well as compensate. The regulator's stated aim was to significantly reduce APP scam losses by improving both prevention and reimbursement¹⁸. Cost is shared: the sending and receiving payment firms split the cost of reimbursing victims 50:50¹⁹.

Which payments the APP scheme covers

The scheme covers payments authorised by the provider's consumer, executed by that provider in the UK, received in a relevant UK account not controlled by the consumer, and not going to the recipient or for the purpose the consumer intended⁸. In plain terms: a UK-to-UK bank transfer that you were deceived into making.

It applies to individuals, microenterprises and charities⁸. The scheme rules describe an APP scam payment as one authorised by a victim who holds a payment account with the sending provider, executed from a UK account, settled through Faster Payments to a UK account not controlled by the victim, and not going to the intended recipient or purpose¹⁶.

Coverage is narrower than all payments. Only UK bank transfers are covered, not payments to foreign accounts or other payment methods such as card payments²⁰. If you paid a scammer by card, by gift card or in crypto, the APP route does not apply, and you would look instead at the rules for unauthorised transactions or at chargeback and Section 75 routes.

The legal basis for a claim depends on how the money moved. You can ask for a refund under the FPS Reimbursement Rules if the payment was made using the Faster Payments system, or the CHAPS Reimbursement Rules if it was made using CHAPS⁴.

Where APP reimbursement does not apply

The rules require firms to reimburse all in-scope customers who fall victim to APP fraud in most cases, but there are exceptions¹⁹. The regulator has published the exceptions for when reimbursement does not have to be issued¹⁹. Gross negligence is one of the conditions where the rules may not apply².

Civil disputes sit outside the scheme. The reimbursement requirement does not apply where a customer has paid a legitimate supplier for goods or services but has not received them, has found them defective, or is otherwise dissatisfied with the supplier²¹. Those are consumer disputes, not scams, and they follow a different path.

There is also a boundary around who was in control of the account. Payment orders executed by a fraudster exercising control over a payment account are not within scope⁸. And where a payment was made for an unlawful purpose, it is not a reimbursable APP scam payment under the scheme rules¹⁶.

How to claim a refund after a scam

For an unauthorised payment, the instruction is simple: contact your bank as soon as possible and claim a refund²³. Speed matters because your liability for up to £35 applies only to payments taken before you notify the bank⁵.

For an APP scam, the claim goes to your own bank under the FPS or CHAPS reimbursement rules, depending on how the payment was sent⁴. Your bank should provide the refund within five business days of you making the claim⁴. If it needs to gather more information about what happened, that deadline can be extended²².

1. Report the scam to your bank as soon as you realise what has happened.
2. Ask for a refund under the reimbursement rules, stating which payment system was used if you know.
3. Provide the information the bank asks for about how the payment came about.
4. Expect a decision within five business days, unless the bank needs longer to investigate.
5. If the claim is refused, complain to the bank formally, then take it to the Financial Ombudsman Service if unresolved.

The Ombudsman can order remedies that go beyond the payment itself. It may ask a bank to refund payments you did not authorise, refund charges and interest the bank has applied, compensate you for money you lost, and pay compensation for distress or inconvenience²⁴. Complaints about APP scams are a significant share of the Ombudsman's banking casework: in the first quarter of 2025/26, around half of fraud and scams complaints, some 3,400, were about authorised push payment scams²⁵.

Extra protection for vulnerable customers

The rules build in additional protection for vulnerable customers. The regulator committed to provide additional protections for vulnerable customers as part of the reimbursement requirement¹⁹. In practice this matters most at the £100 excess: the bank can deduct it unless you are considered vulnerable under the rules¹⁷.

The scheme rules drafted for the Faster Payments system reflect the same principle, allowing the sending provider to decline to pay the first £100 of a reimbursable APP scam payment unless the victim was a vulnerable consumer when the payment was authorised¹⁶. Vulnerability is therefore not just a matter of how a case is handled, but of whether the excess applies at all.

The regulator has also worked on prevention, not only reimbursement. It consulted on requiring banks and building societies to adopt a standardised approach to sharing data to help identify these scams before they happen¹⁸, and on extending customer protection across all banks and building societies at a minimum standard by changing payment system rules¹⁸.

How the APP rules are being reviewed

The reimbursement regime is not settled. The regulator has consulted on changing the maximum level of reimbursement for Faster Payments APP scams, noting that the previous maximum had been set at £415,000 per claim in September 2024²⁷. An earlier policy statement had set the maximum level of mandatory reimbursement at £415,000 per single APP scam case, applying to all consumers including vulnerable consumers¹⁴. The current figure is £85,000¹.

The regulator has also consulted on the consumer standard of caution, on the excess and maximum reimbursement level for Faster Payments and CHAPS, and on draft legal instruments for the reimbursement requirement²⁸. It has considered whether payment system operators should play a greater role in preventing and responding to APP scams³¹, and has published behavioural economics work on understanding and preventing APP fraud³².

An independent evaluation of the APP scams policies concluded in July 2026, with the regulator confirming the scope of planned work and beginning stakeholder engagement³³. A formal consultation on policy proposals, including policy parameters and data requirements, opens in December 2026, and the regulator expects to publish its decision and revised legal directions in May 2027³³.