APP Fraud Reimbursement Rules: What Banks Must Now Pay
For eligible UK payments made on or after 7 October 2024, payment firms must normally reimburse victims of Authorised Push Payment (APP) fraud up to £85,000 per claim. Most claims should be resolved within five business days, although firms can pause that deadline while gathering information and must generally decide within 35 business days.
What are the APP fraud reimbursement rules?
The mandatory APP fraud reimbursement rules require payment firms to refund eligible consumers, microenterprises and charities deceived into authorising a payment to a fraudster. They apply to qualifying payments made on or after 7 October 2024 through Faster Payments or CHAPS between UK accounts.
APP fraud happens when a criminal tricks you into approving a bank transfer. Common examples include impersonation scams, investment scams, romance scams, purchase scams and invoice redirection. The rules do not cover card, cash or cheque payments, international transfers, payments made before 7 October 2024, or ordinary civil disputes with a genuine supplier.
You should report the scam to the firm from which you sent the money. The sending firm handles the claim even though the cost is normally shared with the firm that received the fraudulent payment.
What is the £85,000 APP fraud reimbursement limit?
The maximum mandatory reimbursement is £85,000 for each eligible APP fraud claim. The Payment Systems Regulator says this limit fully covers more than 99% of claims by volume, and a payment firm can choose to refund more.
If your loss exceeds £85,000, you should still submit the full claim and ask the firm to consider reimbursing the balance. If it refuses, you may be able to complain to the Financial Ombudsman Service, whose award limit is higher, or consider a legal claim depending on the circumstances.
How quickly must a bank refund APP fraud?
A payment firm should normally reimburse an eligible APP fraud claim within five business days. The five-day period runs from the claim being made, not from the date of the fraudulent transfer.
The firm may stop the clock when it reasonably needs more information, including information about the scam or a customer's vulnerability. Even where the clock is stopped, it must generally reach an outcome within 35 business days. A request for information should be relevant and proportionate rather than an open-ended reason to delay the claim.
How long do I have to make an APP fraud claim?
You should report APP fraud as soon as possible and no later than 13 months after the final fraudulent payment in the claim. A payment firm can reject a claim submitted after that 13-month window.
Reporting quickly gives the firms the best chance of tracing or freezing the money. Keep the payment confirmations, messages, emails, adverts, telephone numbers and any evidence showing how the fraudster gained your trust. You should also report the crime to Action Fraud, or to Police Scotland if appropriate, and retain the reference number.
Can a bank deduct a £100 excess?
A payment firm may choose to deduct an excess of up to £100 from an eligible APP fraud reimbursement, but it does not have to charge one. A firm can apply a lower excess or waive it completely.
The excess is not a minimum-loss rule: a firm should assess the claim under the reimbursement framework even where the loss is £100 or less. Crucially, no excess can be applied where the customer is vulnerable under the rules.
Can a bank refuse a refund for gross negligence?
A payment firm can refuse reimbursement if it proves that the customer acted fraudulently or with gross negligence, but gross negligence is a very high bar. It is not enough for the firm merely to show that the customer missed a warning or made a mistake.
The rules contain a consumer standard of caution. This can include paying attention to tailored warnings, promptly reporting the scam, responding to reasonable information requests and consenting to the details being reported to the police. The firm carries the burden of proving gross negligence, considering all the circumstances. It should explain precisely what it says the customer did and why that conduct crossed the high threshold.
What protection applies to vulnerable customers?
The gross-negligence exception and the optional excess must not be applied where a customer's vulnerability affected their ability to protect themselves from the scam. Vulnerability can arise from health, life events, resilience or capability and must be assessed in the context of the particular fraud.
A diagnosis is not always necessary. Bereavement, coercion, financial distress, cognitive impairment, mental-health difficulties, low digital confidence or other circumstances may be relevant. Tell the firm what was happening at the time, how it affected your decisions and what support you needed. The firm may pause the five-day timetable to assess vulnerability, but the claim should still generally be decided within 35 business days.
What should I do if my bank refuses reimbursement?
A bank's refusal is not necessarily the final word: ask for the decision in writing and make a formal complaint if the reasoning is wrong or incomplete. Address the exact refusal reason, provide the scam evidence, and explain any vulnerability or why the warnings were not effective in your circumstances.
If the firm does not resolve the complaint within eight weeks, or sends a final response you disagree with, you can usually take the complaint to the Financial Ombudsman Service within six months of that final response. The Ombudsman can consider the mandatory rules alongside the firm's wider legal and regulatory duties. Different protections may apply to older payments, international transfers, card payments and unauthorised transactions, so an out-of-scope decision under these rules does not always end the matter.