Gross negligence: when a bank can refuse a scam refund

An authorised push payment (APP) scam is one where someone is tricked into sending money to a fraudster posing as a genuine payee¹. Because the payment is authorised by the customer, it cannot simply be reversed once the victim realises what has happened². That is why the refund rules exist: payment firms must reimburse all in-scope customers who fall victim to APP fraud in most cases³.

The exception that matters most to consumers is gross negligence. A bank does not have to reimburse money lost in an APP fraud if the customer showed a significant degree of carelessness⁴. It is a high bar, and the payment provider carries the responsibility of proving it⁵. If you were particularly vulnerable to the specific type of scam used, the test does not apply to you at all⁶.

The rules took effect for payments made on or after 7 October 2024⁴. Claims are capped at £85,000, an excess of up to £100 may be deducted, and there is a 13-month time limit running from the last payment sent to the scammer as part of the same scam⁵.

APP fraud refunds: the default is that you get your money back

The starting point is reimbursement. The Payment Systems Regulator's requirement obliges payment firms to reimburse all in-scope customers who fall victim to APP fraud in most cases, with the aim of making sure more victims get their money back and prompting a step change in fraud prevention³. The regulator describes APP scams as the second biggest type of payment fraud¹.

The rules apply to payments requested by bank transfer or other types of online payment². They cover the situation where you are tricked into authorising a payment to a scammer⁷. They do not cover every loss: the requirement is about fraud, not about a purchase that went wrong.

There are conditions attached. You must report the fraud quickly, and you must meet certain other conditions to get a refund⁸. The bank also has to be able to establish what happened, which is why prompt reporting matters in practice as well as in the rules.

The rules came into force in 2024, and apply to payments made on or after 7 October 2024³. Anything sent before that date sits outside the scheme, and the older voluntary arrangements applied instead.

Gross negligence and the other reasons a bank can refuse

Gross negligence is the headline exception. The regulator lists the exceptions to reimbursement as gross negligence and first party fraud⁹. In plain terms, a bank does not have to reimburse if you showed a significant degree of carelessness when making the payment⁴. Firms put it the same way: where you have acted with a significant degree of carelessness, also known as behaving with gross negligence, the obligation to reimburse does not apply¹⁰.

It is not enough for a bank to think you were careless. Gross negligence is a high bar, you would need to have shown a significant degree of carelessness, and it is the payment provider's responsibility to prove it⁵. That burden of proof is the practical protection for most customers.

The other grounds for refusal are narrower. A bank can usually refuse only if it can prove you authorised the payments, if it can prove you were at fault because you acted fraudulently or negligently, or if you told it about the fraud 13 months or more after the payment was taken¹¹. Acting fraudulently is separate from being careless, and it is a ground in its own right.

Firms set out their own exclusion lists, which follow the same shape. One bank's terms say you will not be eligible for a refund if you acted fraudulently, or failed to do one of several things including ignoring warnings, reporting late, not responding to information requests, or refusing to report to the police or the National Crime Agency¹². Another lists ignoring warnings about possible fraud among its exclusion conditions⁸.

Refund limit: up to £85,000 per claim, with a possible £100 excess

The maximum you can claim back is £85,000⁶. The same figure appears across the rules: a maximum claim amount of £85,000 for each payment, with an excess of up to £100 that may be deducted from the reimbursement¹³. The regulator's own reporting refers to the value of APP scams below the £100 excess and above the maximum cap of £85,000¹⁴.

The excess is a maximum, not a fixed charge. Payment providers may charge an excess of £100 per claim⁶. Some firms state that a £100 excess may apply¹⁵, and others that they may deduct an excess of up to £100 from your reimbursement¹³. So the amount actually deducted can vary between firms.

One point of disagreement in the documents: an earlier policy statement set the maximum level of mandatory reimbursement at £415,000 per single APP scam case, applying to all consumers including vulnerable consumers⁹. The later consumer-facing rules use £85,000⁶. If you are dealing with a large loss, the figure that applies to your claim is the one your bank states in its own terms, and the two published figures do not match.

Extra protection if you are a vulnerable customer

Vulnerability changes the calculation. The regulator's requirement provides additional protections for vulnerable customers³. Customers deemed to be vulnerable to a specific type of APP fraud are not subject to the gross negligence test or the claim excess⁶.

That means two of the main ways a claim can be reduced or refused fall away. If you were particularly vulnerable to the specific type of APP scam, and the rules apply, your bank or payment service provider must reimburse you¹⁷. The regulator's stated aim is that customers are more protected under consistent minimum standards, with most APP fraud victims reimbursed¹.

Vulnerability here is specific to the scam, not a general label. It is worth saying plainly what you were going through at the time when you report the fraud, because it is the bank that applies the test and the ombudsman that reviews it.

How to claim and how long a bank has to decide

The process is a claim to your own bank, not to the scammer's. The sending firm decides whether to reimburse, and the regulator has clarified the 35-business-day timescale within which the sending payment service provider must make a decision on an APP scam case¹⁸. Consumer guidance puts the reimbursement deadline at five UK business days unless your bank or payment provider needs to gather more information about what happened⁵.

In order:

1. Report the fraud to your bank as soon as you realise, and to the police. Reporting quickly is one of the conditions for a refund⁸.
2. Give the bank the facts: what the payment was for, who asked for it, what you were told, and anything you were going through at the time.
3. Expect a decision within five UK business days, or longer if the bank needs more information⁵.
4. If the bank refuses, ask for the evidence behind a gross negligence finding and complain formally.
5. If the complaint is not resolved, take it to the Financial Ombudsman Service, which can look at whether the firm treated you fairly¹⁷.

The 13-month limit runs from the last payment sent to the scammer as part of the same scam, not from the first⁵. Firms can reject fraud claims submitted more than 13 months after the final payment to the fraudster¹⁹.

Where the refund rules do not apply

The exclusions are worth knowing before you assume a refund is due. The rules cover payments made within the UK, and you are not covered for a payment sent overseas⁴. They do not apply to civil disputes, such as where a customer has paid a legitimate supplier for goods or services but has not received them, has found them defective, or is otherwise dissatisfied with the supplier¹⁸.

Firms list the same categories. One bank's exclusion list covers first party fraud, gross negligence, time exclusions including claims made before 7 October 2024 and claims submitted more than 13 months after the final payment, international payments, payments across other payment systems, scam payments made using cheques and cash, payments to an account the consumer controls, unauthorised payments, civil disputes, payments sent or received by credit unions, municipal banks and national savings banks, and on-us or me-to-me payments²⁰. Another sets out a near-identical list²¹.

There is a separate rule for unauthorised payments. Where a payment was initiated through a third-party provider without your authorisation, your bank must refund you immediately unless it has grounds to suspect fraud or negligence, and if the third party was at fault the bank can recover the funds from them²². That is a different route from APP reimbursement, and it turns on whether you authorised the payment at all.

Which bank pays, and what happens if the bank says no

Your bank pays you, and the cost is shared behind the scenes. The requirement shares the cost of reimbursing victims 50:50 between sending and receiving payment firms³. The regulator publishes reimbursement data covering the largest 14 banking groups in Great Britain and Northern Ireland, which shows how firms compare on paying out²³.

If your bank says you were grossly negligent, you can challenge it. Gross negligence is a high bar and the bank has to prove it, so a refusal should come with reasons you can test⁵. The Financial Ombudsman Service handles complaints about scams where you were tricked into making a payment, and it can look at whether the firm's decision was fair¹⁷.

Free, impartial help is available. The Consumer Council for Northern Ireland provides scam guidance for consumers there²⁴, and general consumer rights bodies publish step-by-step guidance on what to do if a bank will not refund you⁵. If a refusal leaves you in financial difficulty, debt advice services can help you work out what to do next¹¹.