Extra refund protection if you are vulnerable

If a scammer talks you into sending money from your own bank account, the reimbursement rules that took effect on 7 October 2024 normally cover the loss¹. Two things can still be taken off or held against you: a £100 excess deducted from the refund, and the consumer standard of caution, which lets a bank refuse a claim if you showed a significant degree of carelessness¹.

Where you are assessed as a vulnerable consumer, both of those protections fall away. The rules state that the customer standard of caution and the claim excess must not be applied to vulnerable customers³. The bank cannot rely on the caution exception to deny the claim, and the excess is not deducted⁴.

The protection is not automatic and it is not a blanket exemption. It turns on whether you have a vulnerability that had a material impact on your ability to protect yourself from the scam⁶. That is the test your bank is expected to apply, case by case, rather than a label you either have or do not⁷.

Vulnerable customers are reimbursed without the £100 excess or the standard of caution

The consumer standard of caution is the rule that lets a bank refuse a refund where the customer showed a significant degree of carelessness, sometimes called gross negligence¹. It is the main route by which an otherwise valid claim is turned down. For a vulnerable customer, that route is closed: where you are assessed as a vulnerable consumer, the bank cannot rely on the consumer standard of caution exception to deny the reimbursement claim⁴.

The £100 excess works differently. It is not a refusal, it is a deduction: payment providers may charge an excess of £100 per claim². Where a consumer may be considered vulnerable, there is no excess charge⁸. The rules put it plainly: the customer standard of caution and claim excess must not be applied to vulnerable customers³. The regulator has confirmed that where a customer is vulnerable, no choice to apply the excess is open to the sending firm⁵.

The two protections are linked by the same test. It is not enough to have a vulnerability in the abstract. The rules require that the vulnerability had a material impact on your ability to protect yourself from the scam⁶. Where that is met, you can still be reimbursed even if you did not take all the steps required under the consumer standard of caution, because your circumstances affected your ability to spot or protect yourself from the fraud¹.

The regulator has been explicit that this is not a box-ticking exercise. In determining whether a consumer falls under the vulnerability exemption, payment firms should carry out a case-by-case assessment to understand how the consumer's vulnerability led to them being defrauded⁷. That means the bank should look at your circumstances and the specific scam, not apply a fixed list.

How APP fraud reimbursement works for everyone

An authorised push payment scam is one where you are tricked into authorising a transfer of money to an account you believe belongs to a legitimate payee¹². The payment is authorised by you, which is why the refund rules exist separately from the protections for payments you never approved.

Since October 2024, it has been mandatory for banks to reimburse faultless victims of authorised push payment fraud¹³. The policy requires payment firms to reimburse all in-scope customers who fall victim to APP fraud in most cases⁹. The regulator's stated aim was to make sure more victims of fraud get their money back and to prompt a step change in fraud prevention¹⁴.

All types of APP fraud are covered, including impersonation and romance scams, and the rules apply to payment service providers that offer Faster Payments, which is most UK banks, building societies and e-money firms¹⁵. The requirement came into force on 7 October 2024 and applies to bank transfer scams that happen on or after that date¹. The regulator has since described the policy as ensuring victims of APP scams are reimbursed in all but exceptional cases¹⁶.

The additional protections for vulnerable customers sit inside that wider scheme rather than beside it⁹. Everyone in scope gets the baseline protection; vulnerability removes the two deductions and refusals that would otherwise apply to a claim.

Refund limit: up to £85,000 per claim

The maximum amount you can claim under the rules is £85,000¹. The rules require banks and other payment service providers to reimburse you up to a maximum of £85,000 if you are the victim of an APP scam⁸. The same cap appears across the scheme: a maximum claim amount of £85,000 for each payment¹⁸, and a maximum reimbursement claim limit of £85,000¹⁹.

The cap applies to vulnerable customers too. The vulnerability exemption removes the excess and the caution test, but the maximum claim amount still applies⁶. Being vulnerable does not raise the ceiling.

The maximum a victim can claim under the APP fraud reimbursement rules is £85,000 per claim¹. A £100 excess applies to each claim¹². One policy statement set the maximum level of mandatory reimbursement at £415,000, applying to all consumers²⁰, while the later consolidated policy statement and the consumer-facing guidance use £85,000¹⁰. The two figures are not reconciled, so both are given here. The £85,000 figure is the one that appears in the current scheme rules and in the regulator's own consumer data, which records the value of APP scams above the maximum cap of £85,000²¹.

If your loss is above the cap, the amount over £85,000 is not covered by the reimbursement requirement. There is a separate question about what happens to losses above the limit, and the options for recovering them, which is covered on what happens if you lose more than £85,000 to a bank transfer scam.

Payments covered and payments that are not

The scheme covers payments made using Faster Payments and CHAPS, from personal bank accounts and payments made by micro-enterprises and certain charities¹. It does not cover everything that looks like a scam loss.

Payments that are not covered include those made using cash, a cheque, or a credit, debit or prepaid card¹. Payments across other payment systems are also outside the scheme, for example card payments and cryptocurrency transfers². The reimbursement protections for recovering your losses apply to UK Faster Payments only².

There are further exclusions. The requirement does not apply to civil disputes, such as where a customer has paid a legitimate supplier for goods or services but has not received them, has found them defective, or is otherwise dissatisfied with the supplier³. It also does not apply where the customer has acted fraudulently, known as first-party fraud, or where the customer has acted with gross negligence³. A consumer who is themselves party to the fraud or dishonesty giving rise to their claim, including first-party fraud, is ineligible for reimbursement⁵.

The gross negligence exclusion is the one vulnerability overrides. If you were grossly negligent, you might not get your money back, but this does not apply to vulnerable customers²². Where the rules apply and you were particularly vulnerable to the specific type of APP scam, your bank or payment service provider must reimburse you²³.

If your loss came through a card payment, a crypto purchase or a gift card rather than a bank transfer, different rules apply, and the routes are set out on bank transfer or card: how protection differs when you pay.

How to claim and how long your bank has to pay

The claim is made to your own bank or payment provider, not the scammer's. Sending firms must reimburse customers within five business days under the reimbursement requirement²⁰. Most APP fraud victims are reimbursed within five business days²⁴. Scam victims must be reimbursed within five UK business days unless the bank or payment provider needs to gather more information about what happened¹¹.

The cost is then shared between firms. The rules require sending and receiving payment firms to share the cost of reimbursing victims 50:50⁹. That is why your own bank pays you and then recovers half from the bank that received the money, and why you deal only with your own provider.

If the claim is not paid in time, or is refused, the next step is a formal complaint to your bank. If you are still unhappy after the bank's final response, the complaint can go to the Financial Ombudsman Service, which is free to use. The ombudsman's own guidance on scams you were tricked into paying sets out how it looks at these cases²³. The process for escalating a refused claim is set out on taking a refused scam refund to the Financial Ombudsman.

What happens if you were tricked into moving money through more than one account

Multi-step fraud, where money passes through more than one account before it reaches the fraudster, is covered by the reimbursement rules. The regulator has set out its proposed approach to multi-step fraud cases⁹. The rules do not require you to identify which payment in the chain to claim for; you report every payment you made to the scammer to your own bank.

The definition of an APP scam is broad enough to catch these cases: they occur when consumers are tricked into authorising a transfer of money to an account that they believe belongs to a legitimate payee¹². Government and stakeholders have highlighted particular concerns about APP frauds, where fraudsters trick victims into making payments or sharing information like account details²⁵.

In practice, the vulnerability assessment applies to the payments you made, and the bank should look at how your circumstances affected your ability to protect yourself across the sequence of payments, not just the first one⁷. If you made several transfers to the same fraudster, report them together so the bank can assess the whole loss against the £85,000 cap¹.

Where extra protection does not apply

The vulnerability exemption is narrower than it first appears, and it is worth being clear about its edges.

• The vulnerability must have had a material impact. The excess is waived and the caution test disapplied only where the vulnerability had a material impact on your ability to protect yourself from the scam⁶. A vulnerability that did not affect what happened does not trigger the protection.
• The cap still applies. The maximum claim amount of £85,000 still applies to vulnerable customers⁶.
• The payment must be in scope. The protections apply to UK Faster Payments only, and not to card payments, cash, cheques or cryptocurrency transfers².
• First-party fraud is excluded. A consumer who is themselves party to the fraud or dishonesty giving rise to the claim is ineligible⁵.
• Civil disputes are excluded. Paying a legitimate supplier who then lets you down is not an APP scam³.

The assessment is the bank's to make, but it is expected to be individual. The regulator's expectation is a case-by-case assessment of how the consumer's vulnerability led to them being defrauded, not a standard test applied to everyone⁷. If a bank refuses a claim on the caution test without considering vulnerability, that is a decision the ombudsman can look at²³.

Where a claim is refused, free and impartial help is available. The Financial Ombudsman Service handles complaints about scam refunds at no cost to the consumer²³. MoneyHelper and the debt advice charities can help where a scam loss has caused financial difficulty, and the Consumer Council offers guidance on stopping, avoiding and reporting scams²⁶.