The consumer standard of caution: when a refund can be refused

When someone tricks you into sending money from your own bank account, the rules start from a simple position: your bank should pay you back. Under the mandatory reimbursement requirement for authorised push payment (APP) scams, a bank that receives a valid claim must refund the money, with only narrow exceptions. The main exception is the "consumer standard of caution": the idea that a customer who was grossly negligent, in a specific and limited sense, can lose the right to a refund¹.

The standard matters because it is the main ground a bank can use to turn down a scam refund. But it is deliberately narrow. The Payment Systems Regulator (PSR), which wrote the rules, interprets gross negligence as "a higher standard than the standard of negligence under common law" and says the customer needs to have shown a "significant degree of carelessness"². The bank, not you, has to prove it. And the whole assessment is confined to four specific expectations: paying attention to warnings, reporting promptly, sharing information, and cooperating with police reporting².

There is also a £100 excess that banks can deduct from a refund, though not from vulnerable customers, and some banks choose not to apply it at all³. This page explains what the standard of caution is, what the four expectations mean in practice, where the protection for vulnerable customers comes in, and what to do if a refund is refused. It sits alongside the wider guide to APP reimbursement and the page on how to complain to your bank about a scam refund.

What the consumer standard of caution is

The consumer standard of caution is the name the PSR gave to the test a bank must apply before it can refuse a scam refund on the grounds that the customer was careless. The PSR consulted on it in detail before the mandatory reimbursement rules took effect, publishing a dedicated consultation on "the consumer standard of caution (gross negligence)" and the guidance that goes with it⁴. The point of the exercise was to stop banks from refusing refunds on a vague, general judgement that a customer "should have known better", and to replace that with a fixed, narrow list of things a customer is actually expected to do².

The standard only applies to authorised push payment scams, where you instructed the payment yourself after being deceived. It does not apply to unauthorised payments, where money leaves your account without your instruction; those are covered by a different set of refund rules, explained on the page comparing authorised and unauthorised payments. The distinction matters because the unauthorised payment rules have their own, narrower grounds for refusal, such as proving you authorised the payment or acted fraudulently⁵.

Under the reimbursement rules there are only two exceptions that allow a bank to refuse a claim outright: where the customer acted fraudulently (known as first-party fraud), and where the customer acted with gross negligence⁶. The standard of caution is the framework for the second of those. It narrows what "gross negligence" can mean, so that a bank cannot simply point to the fact that a scam was obvious in hindsight².

A refund is the default, and the bank has to prove gross negligence

The starting point of the rules is reimbursement. If your claim is in scope and valid, the bank must pay. The exceptions are the things the bank has to establish, not things you have to disprove. The consolidated policy statement is explicit that "the burden of proof falls exclusively upon the PSP to demonstrate that a consumer has acted with gross negligence"¹. The Financial Ombudsman Service, which settles disputes between customers and banks, says the same in plainer terms: if your bank turns down your claim, it must show that you acted with gross negligence⁷.

This is a deliberate reversal of how many people expect it to work. A customer who has been scammed often assumes they must prove they were careful enough. The rules say the opposite. The bank must prove the carelessness, and it must do so against a high bar: a significant degree of carelessness, more than ordinary negligence¹. National Debtline summarises the position for customers in the same way: a bank can refuse only if it can prove you authorised the payments, prove you acted fraudulently or negligently, or if you told them about the fraud 13 months or more after the payment was taken³.

If a bank refuses and cannot meet that burden, the refusal can be challenged. The first step is the bank's own complaints process, and after that the Financial Ombudsman Service, which can order a refund. The ombudsman has long interpreted gross negligence in the customer's favour, describing it as much more than ordinary carelessness⁸. The pages on complaining to your bank and taking a refused refund to the ombudsman set out that process step by step.

Gross negligence means a significant degree of carelessness, not a simple mistake

The rules define the bar deliberately high. The PSR interprets gross negligence as "a higher standard than the standard of negligence under common law", and says the customer needs to have shown a "significant degree of carelessness"². The same wording appears in the consolidated policy statement that brings the rules together¹. The Financial Ombudsman puts it in everyday terms:

The practical effect is that being fooled is not the same as being negligent. Scams work precisely because they are convincing: they use pressure, urgency, impersonation of trusted organisations and professional-looking documents. The ombudsman's approach, built up over years of casework, recognises that a person can take reasonable care and still be deceived⁸. The question under the reimbursement rules is not whether a smarter or calmer person would have spotted the scam, but whether you showed a significant degree of carelessness measured against the four specific expectations².

It can help to compare this with the standard of care in other consumer laws, where a similar "reasonable consumer" idea appears. Under the Consumer Insurance (Disclosure and Representations) Act 2012, the standard of care required of a consumer is "that of a reasonable consumer"¹⁰. The ombudsman applies comparable thinking when it looks at whether a customer's misrepresentation to an insurer was deliberate or reckless, a test the Act itself places on the insurer to prove¹¹. In each case the law sets an objective standard of ordinary care, and then requires the firm, not the customer, to show the customer fell far below it¹².

The PSR also keeps the gross negligence test under watch. When it published the 2024 APP scams data it noted it was considering additional metrics, including "time taken to close cases and reasons for customers being deemed grossly negligent"¹³. That monitoring exists because the standard of caution is the exception, not the rule, and a bank that applies it too freely is applying the rules wrongly.

The four things customers are expected to do

The standard of caution is not a general duty to be careful. It is a list of four specific expectations, and a bank considering a refusal can only look at these²:

1. Having regard to interventions. Paying attention to warnings given by your bank, by the police, or by another person in a position of authority, such as warnings raised during the payment itself.
2. Prompt reporting. Reporting the matter promptly to your bank, and in any event no more than 13 months after the last relevant payment was authorised.
3. Information sharing. Responding to reasonable requests for information from your bank so it can investigate the claim.
4. Police reporting. After making the claim, and if your bank asks, consenting to the bank reporting the scam to the police on your behalf, or reporting it yourself to a competent national authority.

Two features of this list are worth noticing. First, it is closed. A bank cannot add a fifth expectation, such as "the customer should have researched the company online" or "the customer should never pay a new payee on the same day". If a refusal letter cites something outside the four items, that is a challengeable refusal. Second, failing one of the four does not automatically mean no refund. The bank still has to prove gross negligence against the high standard described above¹. The four expectations are the only things the bank may look at, not a checklist where one tick means refusal.

The rules also allow a £100 excess to be deducted from a refund, unless the customer is considered vulnerable under the rules, and some banks choose not to apply it at all³. The dedicated page on the £100 excess covers how it works.

Paying attention to warnings and interventions from your bank

The first expectation is that you have regard to interventions: warnings from your bank, the police, or another authority. In practice this means the on-screen warnings your bank shows before a payment, the Confirmation of Payee result that says the name does not match the account, a call from your bank's fraud team, or a police warning about a known scam. The rules treat these as the moments where a customer is given a genuine chance to stop, and where ignoring them can count towards gross negligence².

Banks are required to give warnings in some situations by other rules too. Under the FCA's banking conduct rules, a firm must warn a customer who chooses not to receive some or all alerts that they will not receive alerts about their overdraft use and may incur avoidable charges as a result¹⁴. The same principle of telling customers what they need to know runs through the FCA's Consumer Duty, which requires firms to avoid causing foreseeable harm to retail customers and to support customers, including vulnerable ones, while they use a product or service¹⁵.

For you as a customer, the practical points are straightforward. Read what appears on the screen before you confirm a payment, especially when a warning says the account name does not match, and treat a call from your bank's fraud team as a reason to pause, not a nuisance. The page on what to do when Confirmation of Payee shows no match covers that specific situation. Common warning signs of a scam include inaccurate spelling and wording, a sense of urgency to act quickly, being asked for bank details or passwords and told not to tell anyone, and an unfamiliar email address¹⁷. Checking statements and your credit report regularly for anything you do not recognise is also sensible, because it shortens the time between a scam happening and you reporting it¹⁸.

Reporting promptly: no more than 13 months after the last payment

The second expectation has two parts. The rules require the customer to report the matter promptly to their bank once they learn or suspect they have been scammed, and in any event no more than 13 months after the last relevant payment was authorised². The consolidated policy statement confirms that sending banks can deny APP scam claims submitted more than 13 months after the final payment in a given claim¹.

The 13-month figure is not unique to APP scams. The Payment Services Regulations 2017, which govern unauthorised and incorrectly executed payments, entitle you to redress only if you notify your provider without undue delay and in any event no later than 13 months after the debit date¹⁹. Consumer guidance on unauthorised payments and continuous payment authorities repeats the same limit: report as soon as possible, and in any event within 13 months of the date the payment was made²¹. So whether the money left your account with or without your authorisation, the same outer deadline applies, though the APP rules measure it from the final payment in the claim rather than each debit.

The "promptly" part matters as much as the deadline. A claim made inside 13 months but months after you discovered the scam can still be challenged on the basis that you did not report promptly. The practical rule is simple: contact your bank as soon as you suspect anything, and keep records of every contact you had with the scammer, as the ombudsman advises⁹. The page on what to do straight away after paying a fraudster sets out the immediate steps.

Sharing information and letting your bank tell the police

The third and fourth expectations work together. When you make a claim, your bank will ask for information: what happened, what you were told, what evidence you have of the scammer's messages and account details. The rules expect you to respond to reasonable requests for information so the bank can investigate². This is not an open-ended demand: the request has to be reasonable, and refusing to engage at all is what can count towards gross negligence, not failing to produce something you do not have.

The fourth expectation concerns the police. After making a claim, and if your bank asks, you are expected either to consent to the bank reporting the scam to the police on your behalf, or to report the details yourself to a competent national authority². The design is deliberate: it removes any excuse for a victim not to report, because the bank can do it for you, while still making sure the report happens. The ombudsman's guidance for scam victims also recommends contacting the police and reporting the scam, alongside contacting your bank immediately⁹.

One point sometimes confuses customers whose accounts are frozen or investigated. Under section 333A of the Proceeds of Crime Act 2002, it is an offence for a bank to tell anyone, even the customer concerned, that an investigation into suspected financial crime is taking place if doing so might affect the investigation²². This is separate from the scam reimbursement process, but it explains why a bank sometimes cannot explain why it is acting as it does. The page on where to report a scam covers the reporting routes across England, Wales, Scotland and Northern Ireland.

Where the standard of caution does not apply: vulnerable customers

The standard of caution has a hard boundary: it must not be applied to customers identified as vulnerable. The consolidated policy statement states that "the consumer standard of caution exception and claim excess must not be applied to vulnerable consumers"¹. The PSR said the same when the rules were first set: "The customer standard of caution and claim excess must not be applied to vulnerable customers"⁶, and the December 2023 policy statement confirmed the exception "does not apply to customers identified as vulnerable" and that the £100 excess "may not be charged to vulnerable consumers"².

This means that if your bank identifies you as a vulnerable customer, it cannot refuse or reduce your refund on the basis of carelessness at all, and it cannot deduct the £100 excess¹. The draft scheme rules put it in the same terms: the consumer standard of caution exception does not apply, or the victim was a vulnerable consumer when the payment was authorised²³.

Vulnerability in this context is wider than many people assume. The ombudsman's work on vulnerability describes it as changing the way the redress system works, and its guidance on complaints involving discrimination notes that firms are expected to be flexible and find ways to support vulnerable customers²⁴. Health conditions, life events such as bereavement, and reduced resilience at the time of the scam can all be relevant. If you believe vulnerability was missed when your claim was decided, say so in your complaint: it changes the test the bank was allowed to apply. The dedicated page on extra refund protection if you are vulnerable goes further into how vulnerability is identified.

When a refund can be refused outright: first-party fraud

The standard of caution is one exception. The other is narrower and absolute: where the customer acted fraudulently, known as first-party fraud¹. The PSR's high-level overview lists the two exceptions plainly: "Gross negligence, First party fraud"²⁶. First-party fraud means the "victim" was themselves part of the scheme, for example making a claim for a payment that never happened, or working with the fraudster to split the proceeds. In those cases no reimbursement is due, and the standard of caution is not the reason: the claim is excluded because of the customer's own fraud¹.

This is distinct from the grounds on which a bank can refuse a refund for unauthorised payments. There, the FCA explains, a bank can only refuse if you authorised the payment, you acted fraudulently, or you failed to protect the details of your card, PIN or password in a way that allowed the payment⁵. The FCA's banking conduct rules similarly allow a firm to make a customer liable for all losses only where the customer acted fraudulently or intentionally or with gross negligence failed to keep their security details safe²⁷. The common thread across all these rules is the same: fraud by the customer removes the right to redress, and gross negligence has to be proved by the firm, not assumed.

How banks explain the standard to their customers

Because the standard of caution decides whether a refund is paid, the rules expect banks to be clear with customers about what it involves. The PSR consulted on producing guidance for payment providers alongside the policy itself, so that the standard is explained consistently rather than each bank inventing its own version⁴. The FCA's Consumer Duty reinforces this: firms must avoid causing foreseeable harm to retail customers¹⁶, and the Duty sets expectations for firms in areas including consumer understanding and consumer support¹⁵. A bank that buries the standard of caution in fine print, or that does not tell a customer what information it needs to decide a claim, is not meeting those expectations.

In practice, a bank handling a claim is expected to tell the customer what the four expectations are, what information it needs, and how the £100 excess works if it applies one². The ombudsman's own guidance for customers sets out its benchmark for good practice: contact the bank immediately, contact the police, report the scam, and keep records of all contact and correspondence between the customer and the scammer⁹. If a bank's explanation of the standard differs from the four items in the rules, or if it refuses a claim without explaining which expectation the customer failed and why that amounts to gross negligence, the refusal can be challenged, first through the bank's complaints process and then through the Financial Ombudsman.