Since 7 October 2024 your bank must refund you if you are tricked into sending money by UK bank transfer. The cap is £85,000 per claim, your firm may deduct an excess of up to £100, and you have 13 months from the last payment to report it. Most claims close within five business days. In the 18 months to 31 March 2026 the Payment Systems Regulator recorded 88 per cent of the money lost on in-scope claims reimbursed — £316 million. The catch is scope: of around 438,300 claims reported, only 301,500 were in scope.
This is a legal duty on payment firms, not a goodwill gesture, and far stronger than the voluntary code it replaced. But it has hard edges. Below: which payments are covered, the four gaps that are not, the one defence a bank can use, what to do first, and what the data says about your odds.
The rule, in one paragraph
On 7 October 2024 the Payment Systems Regulator’s reimbursement requirement came into force, covering everyone paying via Faster Payments or CHAPS from one UK bank account to another. Your own bank — the sending firm — pays you, then recovers half the cost from the firm that received the money: the policy statement requires that “receiving PSPs must … pay sending PSPs 50% of the reimbursement”. That split gives firms that open accounts for fraudsters a reason to stop.
Two things follow. You claim from your own bank, whatever you think of the receiving one. And this is not the Financial Services Compensation Scheme: the PSR set £85,000 to align with the FSCS deposit limit as it stood in 2024, because the number was already familiar. That limit rose to £120,000 on 1 December 2025; the scam cap did not follow it and does not track it. FSCS covers a failed bank, not a fraud.
What counts as an APP scam — and what does not
An APP scam is one where, in the regulator’s words, “a consumer is deceived into voluntarily sending an APP to either an unintended recipient, or for an unintended purpose”. You pressed the buttons. That is what makes it authorised, and why the old law gave you almost nothing. It covers individuals, microenterprises and charities.
Covered
A payment over Faster Payments or CHAPS, from one UK account to another UK account you do not control, on or after 7 October 2024. That is most of what people mean by a bank transfer: the item that never arrives from a seller who never existed, the impersonation call telling you to move money to a “safe account”, the invoice with altered bank details, the romance scam, the fake investment. In a PSR survey of victims published a year in, “almost 60% fell victim through purchase frauds” — a share of victims, not of claims.
The four gaps that catch people out
International payments. The requirement is built on two UK payment systems. Send money abroad and you are outside the regime entirely, however plainly you were deceived.
Anything routed through another payment system. The policy statement excludes payments that “take place across other payment systems – for example, if a consumer sends funds to their account at a crypto exchange and then pays a fraudster via a cryptocurrency”. This is the biggest hole. The transfer to your own exchange account is not a scam payment; the payment that reached the fraudster never touched Faster Payments.
Civil disputes. Also excluded are “civil disputes, such as where a consumer has paid a legitimate supplier for goods or services but has not received them”. A real builder who takes your deposit and does bad work is a dispute, not a scam. The line between a dishonest trader and a fictional one is where many rejected claims sit.
Payments to yourself. The requirement bites on money reaching “a relevant account in the UK that is not controlled by the consumer”. Move money into your own account first — a “safe account” opened in your own name, an exchange wallet, a second bank — and that leg is not reimbursable, even though the fraudster engineered it.
Smaller exclusions matter too. Payments made before 7 October 2024 fall under the old voluntary Contingent Reimbursement Model code, which far fewer firms signed. Payments for an unlawful purpose are out, as are claims where the consumer acted fraudulently. Accounts at credit unions, municipal banks and national savings banks are excluded from the definition of a “relevant account”, so transfers to or from them fall outside the requirement.
The limits: £85,000, £100 and the clock
The maximum was set in October 2024 at £85,000 per claim, a level the PSR calculated would fully reimburse 99.8 per cent of Faster Payments APP scams by volume and 90 per cent by value. Above the cap a firm may still pay voluntarily, and you keep the right to argue the bank was itself at fault.
The excess is optional and capped at £100. A firm may apply it, set it lower, or not apply it at all, and it cannot be applied to a vulnerable consumer. There is no published list of which firms charge it, so if a deduction appears, ask your firm to state its policy and whether it considered you vulnerable.
Two deadlines run in opposite directions. You must report within 13 months of the last scam payment. Your firm must then close the claim within five business days, though that clock “is paused at the point when the sending PSP sends its request for information” and restarts on your reply. The backstop is the “end of the 35th business day” — about seven weeks. Plan for that, not the average.
| Route | What it covers | Limit | Deadline | Decided by |
|---|---|---|---|---|
| Mandatory APP reimbursement | Faster Payments or CHAPS, to a UK account you do not control, from 7 Oct 2024 | £85,000 per claim; optional excess up to £100 | Report within 13 months; firm closes in 5 business days, 35 at the outside | Your own bank |
| Unauthorised payment refund | Payments you never authorised at all | The full amount; up to £35 can fall on you for a lost or stolen card | By the end of the business day after the firm learns of it | Your own bank |
| Section 75 | Credit card purchases, cash price over £100 and not over £30,000 | Whole cash price; issuer liable with the seller | Complain within 6 years, or 3 years of realising | Card issuer |
| Chargeback | Debit or credit card, under card scheme rules | Set by scheme rules, not by law | Usually around 120 days | Card issuer and scheme |
| Financial Ombudsman Service | Any of the above, after the firm answers | £455,000 for acts on or after 1 April 2019 | Within 6 months of the final response | An ombudsman; binding if you accept |
The one defence: the consumer standard of caution
A firm can refuse an in-scope claim on one ground only: that you were complicit, or grossly negligent. The regulator’s guidance on the consumer standard of caution sets four duties — “the requirement to have regard to interventions”, “the prompt reporting requirement”, “the information sharing requirement” and “the police reporting requirement”. Heed warnings, report promptly, answer questions, consent to a police report.
The bar is high, and it is not on you to clear it. Gross negligence is “a higher standard than the standard of negligence under common law”, requiring “a significant degree of carelessness”, and “the burden of proof falls exclusively upon the PSP”. Being fooled by a convincing criminal is not gross negligence.
If you are vulnerable, the defence disappears
The policy statement is unambiguous: “If, when assessing a consumer’s APP scam claim, a PSP believes that the consumer is vulnerable, it cannot apply either the consumer standard of caution exception nor the permitted claim excess.”
Vulnerability uses the Financial Conduct Authority’s definition: someone who, “due to their personal circumstances, is especially susceptible to harm”, driven by poor health, life events, low resilience or low capability. Bereavement, a new caring role, serious illness or acute money pressure can all qualify, and the test is susceptibility to this scam, not a permanent label. Say so in writing when you claim.
What the data says about your actual odds
The PSR publishes a running APP scams reimbursement dashboard, updated 30 July 2026. Covering 7 October 2024 to 31 March 2026, it reports that “88% (£316m) of the money lost to APP scams has been reimbursed to victims”, that “82% of claims were closed within five business days – and 98% within 35 business days”, and that “3% of claims were rejected due to the customer not taking enough care over the transaction or their claim”.
The number underneath them matters more. Consumers reported around 438,300 claims in that period and 301,500 were in scope. The difference is 136,800 claims — 31 per cent of everything reported — that never reached the question of whether the bank should pay.
An independent Frontier Economics evaluation published on 1 July 2026 found the policy works on its own terms: “APP fraud losses have fallen by an estimated £73 million per year”, and “reimbursement rates for all claims have risen from 54% to 65%”. Against that, the same evaluation found that “for claims in-scope of the policy, firms are now reimbursing 97%”. Those two are counted the same way, and the 32-point gap is scope, not fault. The dashboard’s 88 per cent is a third measure — money lost on in-scope claims, not claims.
One finding should change your behaviour. In the PSR’s survey a year in, 71 per cent said they were unaware of the policy and 49 per cent of victims did not claim at all. Claim even when you feel foolish, because foolish is not the test.
Could you get through seven weeks without that money?
Most claims close in five business days, but the legal backstop is 35. A month of essential spending held separately turns a fraud into an inconvenience — find your number with the budget planner.
Explore GetSmartSaver →The first hour
Speed decides how much money still exists to recover, and prompt reporting is itself one of the four duties.
- Call your bank’s fraud line on the number on your card or via the app — never a number given to you by whoever called. If unsure a line is genuine, hang up and dial 159, the Stop Scams UK short code reaching “customers of more than 99% of the UK’s retail bank current accounts”.
- Say “I want to make an APP scam reimbursement claim”. That starts the five-business-day clock. Note the date; the 13-month limit runs from the last payment.
- Ask for a recall from the receiving firm, and freeze any further scheduled payments.
- Report it to the police — Action Fraud on 0300 123 2040 in England, Wales and Northern Ireland, or Police Scotland on 101.
- Write down what happened while it is fresh: numbers that called you, screenshots, the wording of any warning your bank showed. That is your evidence if the firm later says you ignored an intervention.
- Say if anything made you vulnerable at the time. Bereavement, illness, a caring crisis or acute money pressure all count, and they remove both the excess and the gross-negligence defence.
Confirmation of Payee and the four-day delay
Confirmation of Payee checks the name you type against the name on the receiving account and returns a match, close match or no match. The PSR’s July 2026 consultation records that “over 320 PSPs now offer CoP checks in the UK”, that over 99 per cent of firms initiating Faster Payments offer it, and that over two million checks run daily. A “no match” you click past is the clearest possible failure to have regard to an intervention.
That direction has a loose end. Specific Direction 17 expires on 1 November 2026, and the PSR consulted until 20 August 2026 on removing the expiry and widening the scope. No decision had been published at the time of writing. The service is not going away, but the requirement is not yet permanent.
The second mechanism is the delay. Since 30 October 2024, under the Payment Services (Amendment) Regulations 2024, a firm may hold a payment where it has reasonable grounds to suspect fraud or dishonesty by a third party, for “no longer than the end of the fourth business day following the time of receipt of the payment order”. It must tell you of the delay and its reasons by the end of the next business day, and stays liable for any charges or interest the hold costs you. A held payment is not obstruction; the call that follows is the best chance of stopping the loss.
If you paid by card instead
Card payments are outside the APP regime, but in several respects card protection is better.
If you did not authorise the payment at all — a stolen card, a compromised account — regulation 76 of the Payment Services Regulations 2017 requires a refund “no later than the end of the business day following the day on which it becomes aware of the unauthorised transaction”. Next day and in full — unless the firm has reasonable grounds to suspect you acted fraudulently, or regulation 77’s £35 liability for a lost or stolen card applies. If you were tricked into authorising it, that regulation does not help.
Section 75
Section 75 of the Consumer Credit Act 1974 makes your credit card provider “jointly and severally liable” with the seller for misrepresentation or breach of contract, where the cash price is over £100 and not more than £30,000. The ombudsman stresses the point people miss: “it’s the cash price of the goods or services that matters, not what you paid on your credit card or loan” — so a £150 deposit on a £2,000 sofa is covered for the full £2,000. Our Section 75 guide has the edge cases.
Chargeback
Chargeback is the fallback, and the only card route on a debit card. It lets you “claw back” a payment made by debit or credit card under card scheme rules. It is not a legal right: a bank need not raise one, and the window is normally about 120 days. Below £100, or on a debit card, it is usually all there is, whatever the perks on your cashback debit card.
If your bank says no
Make the firm give you its decision in writing, with the reason. If the reason is the consumer standard of caution, ask which of the four duties it says you failed, and what evidence it holds.
Then complain formally. For a fraud, scam or payment services complaint the firm must send its final response within 15 business days — not the eight weeks that covers most complaints — stretching to 35 business days only in exceptional situations beyond its control. You then have six months from that final response to take the case to the Financial Ombudsman Service. Complain to the business within six years of the problem, or three years of realising. Since 31 January 2019 FCA rules also let victims complain about the receiving firm.
The ombudsman is free and its decisions bind the firm if you accept them. For complaints referred on or after 1 April 2026 about acts on or after 1 April 2019, the maximum award is £455,000 — far above the £85,000 cap. A large loss is worth running as a complaint about the firm’s conduct as well as a reimbursement claim.
Where the rules are heading
The government has decided to abolish the Payment Systems Regulator and fold its functions into the FCA. That is settled policy, not yet law: the Treasury’s consultation response says consolidation “will require primary legislation”, to come “as soon as parliamentary time allows”. No date is set, and transitional provisions will move the reimbursement regime across. Your rights do not change; the letterhead does. Beyond that, treat everything as speculation: the PSR has published no proposal to move the £85,000 cap or to close the crypto and international gaps.
Does this apply across the whole UK?
Yes. Financial services regulation is reserved, so the reimbursement requirement, the Payment Services Regulations, Section 75 and the Financial Ombudsman Service work identically in England, Scotland, Wales and Northern Ireland. The test is where the accounts are, not where you live. The one practical difference is police reporting: Action Fraud covers England, Wales and Northern Ireland, while in Scotland you report to Police Scotland on 101.
Frequently asked questions
Does my bank have to refund me if I was tricked into a bank transfer?
In most cases, yes. Since 7 October 2024 payment firms must reimburse victims of authorised push payment scams where the money went over Faster Payments or CHAPS from one UK account to another account you do not control. Your own bank pays and recovers half from the receiving firm. It can refuse only if you were complicit or grossly negligent.
What is the maximum my bank has to refund after a scam?
£85,000 per claim. The Payment Systems Regulator set that level in October 2024, calculating that it fully reimburses 99.8 per cent of Faster Payments APP scams by volume and 90 per cent by value. Firms may pay more voluntarily. Above the cap you can complain that the firm itself was at fault, where the ombudsman’s £455,000 limit applies.
How long does my bank have to refund me?
It must close your claim within five business days of you reporting it. That clock pauses while the firm waits for information it asked you for, and restarts when you reply. The backstop is the end of the 35th business day, about seven weeks. Regulator data shows 82 per cent of claims closed within five business days and 98 per cent within 35.
What scams are not covered by the bank refund rules?
International payments, anything routed through another payment system such as a cryptoasset exchange, payments to an account you control yourself, civil disputes with a genuine trader, payments for an unlawful purpose, and payments made before 7 October 2024. Card, cash and cheque are excluded too, but have their own protections through Section 75 and chargeback.
Can my bank refuse to refund me if I ignored a warning?
It can try, but only by showing gross negligence, which the regulator defines as a significant degree of carelessness and a higher standard than ordinary negligence. The burden of proof sits entirely with the firm. Neither that defence nor the £100 excess can be applied to a consumer the firm considers vulnerable, so say if something made you vulnerable.
What should I do first if I have just been scammed?
Call your bank’s fraud line on the number printed on your card, or dial 159 to reach your own bank safely, and say you want to make an APP scam reimbursement claim. Ask the bank to attempt a recall. Then report it to Action Fraud on 0300 123 2040, or Police Scotland on 101 in Scotland, and write everything down.
Last reviewed: September 2026. These rules apply across the whole United Kingdom because financial services regulation is reserved. Figures come from Payment Systems Regulator, FCA, Financial Ombudsman Service and GOV.UK publications current at the time of writing, and the reimbursement data covers 7 October 2024 to 31 March 2026. This article is general information, not personal financial advice — check your own position with gov.uk or the relevant regulator, or get free help from MoneyHelper or Citizens Advice, before acting on it.
