What is APP fraud? Authorised Push Payment scams explained.

APP fraud is now the largest category of fraud in the UK by value. Since October 2024 banks must refund you by default. Here is what the term means, why it is treated differently from card fraud, and what the law actually gives you.

What is the difference between APP fraud and unauthorised fraud?

Unauthorised fraud is when someone takes money from your account without your knowledge or consent — for example a stolen card or hacked online banking. APP (Authorised Push Payment) fraud is when you yourself send the payment, but only because you were tricked into doing it. The legal regime is different: unauthorised fraud is covered by the Payment Services Regulations 2017 with near-automatic refunds; APP fraud is now covered by the PSR Mandatory Reimbursement Scheme that came into force on 7 October 2024.

Is APP fraud actually fraud in the criminal sense?

Yes. The criminal offence is committed by the scammer, normally under the Fraud Act 2006 (fraud by false representation). The fact that you authorised the bank transfer does not make the act lawful — your consent was obtained by deception, which is precisely what the Fraud Act criminalises.

Does it matter what kind of scam I fell for?

For the criminal definition, no — APP fraud is a single legal category. For the refund rules, mostly no: investment scams, romance scams, impersonation scams, purchase scams, and invoice redirection are all in scope of the PSR scheme. The exceptions are international payments (the scheme covers Faster Payments and CHAPS within the UK only) and payments made using a credit card, which are usually better routed via Section 75 of the Consumer Credit Act 1974.

Why are banks suddenly refunding APP fraud?

Until October 2024, refunds were governed by the voluntary Contingent Reimbursement Model (CRM) Code — most major banks signed up, but enforcement was patchy. The Payment Systems Regulator made reimbursement mandatory under FSBRA 2013 powers. Banks no longer have a choice: if you were the victim of APP fraud and you meet the customer-standard requirements, the bank that sent the payment must refund you, with the receiving bank paying half the cost.

Can the bank refuse to refund me?

Only on narrow grounds. The bank must prove that you acted with gross negligence, or that the customer-standard requirements were not met (for example you ignored a specific Confirmation of Payee warning or did not report the fraud promptly). Simple negligence — being trusting, being persuaded — is not enough. The burden of proof sits firmly on the bank.

What if my bank does refuse?

You have a free statutory right to escalate the bank's decision to the Financial Ombudsman Service within six months of receiving the bank's final response letter. The Ombudsman reviews the case independently and applies a “fair and reasonable” test. The Ombudsman can order the bank to refund you, pay interest at 8% simple per year, and pay compensation for distress and inconvenience.

A plain-English UK guide to Authorised Push Payment (APP) fraud — how it works, why it is treated differently from card fraud, and how the PSR Mandatory Reimbursement Scheme entitles victims to refunds from October 2024.

Scam Refund · Getting Started

What is APP fraud? Authorised Push Payment scams explained.

What APP fraud actually means

Authorised Push Payment fraud means you sent the money yourself — but only because you were lied to. A fake invoice that looked like it came from your builder. A call from someone pretending to be your bank, telling you to move money to a “safe account”. An investment that never existed. A relationship that was never real. You pressed Confirm. The money left. And the authorisation was procured by fraud.

That word “authorised” is exactly why the law had to change. Under the Payment Services Regulations 2017, a bank that executes a payment you authorised has done its job. For years that meant APP fraud victims had almost no statutory right to a refund. Banks could — and often did — refuse on the basis that you pressed the button. That has now changed.

Why this is different from card fraud

When someone steals your card details and buys something in Romania, you did not authorise that. Under regulation 76 of the Payment Services Regulations 2017 your bank must refund you almost immediately. Section 75 of the Consumer Credit Act 1974 adds a separate route for credit card purchases between £100 and £30,000.

APP fraud breaks that model because the payment is technically authorised. Until October 2024, victims relied on the voluntary Contingent Reimbursement Model Code — banks signed up but applied it inconsistently. Refund rates varied wildly. The Payment Systems Regulator had seen enough. It used its powers under the Financial Services (Banking Reform) Act 2013 to make reimbursement mandatory.

Which scams the PSR scheme covers

The scheme covers any APP fraud where the payment went over Faster Payments or CHAPS to a UK-domiciled account, from a consumer, micro-enterprise or charity. That is most real-world cases. The scam types in scope include:

• — fake invoices, fake refunds, fake "safe account" warnings.
• — cloned brokers, crypto trading mentors, pig-butchering schemes.
• — long-grooming relationship scams that end in a payment.
• — calls or texts from fake bank fraud teams, fake police, fake HMRC.
• — fake online shops, marketplace scams, holiday rentals that do not exist.
• — business email compromise where supplier bank details are swapped.
• — paying a fee to release a loan, prize or inheritance that never arrives.

International payments and credit-card payments fall outside the scheme, but they have their own routes. International scams may still be reportable under the bank’s own fraud policy, and credit-card payments often sit better under Section 75 of the Consumer Credit Act 1974.

What the scheme actually gives you

Your sending bank must refund you up to £85,000 within five working days of you reporting the fraud — unless it can prove you acted with gross negligence. Being trusting is not gross negligence. Being persuaded by a convincing scammer is not gross negligence. The receiving bank pays half the cost, so both banks now have a reason to catch fraud early. You may pay a £100 excess if you are not classed as vulnerable.

What the law asks of you

Three things. Report the fraud to your bank within 13 months of the last payment. Cooperate with the investigation and provide a crime reference number from Action Fraud or Police Scotland. Do not ignore a specific Confirmation of Payee warning that the account name did not match. That is it. None of these is hard for an honest victim to meet. Vulnerable consumers cannot be denied a refund on gross-negligence grounds at all.

If the bank still says no

You get a final response letter with the bank’s reasons and your right to escalate. From the date of that letter you have six months to take the case to the Financial Ombudsman Service — free of charge, and free to use without a lawyer or a claims firm. The Ombudsman applies a “fair and reasonable” test, is not bound by the bank’s reasoning, and can order full reimbursement, interest at 8% simple per year, and compensation for distress. The decision is binding on the bank if you accept it.

Ready to start your refund claim?

We draft your PSR-aligned bank complaint and walk you through Financial Ombudsman escalation for a fixed £49. No CMC fee. You keep every penny of your refund.

Not legal advice. This guide is for general information only. For advice specific to your circumstances, consult a regulated legal professional or contact Citizens Advice.