Authorised push payment (APP) fraud: bank transfer fraud explained, and how to get your money back.

Authorised push payment (APP) fraud is bank transfer fraud: a scammer tricks you into sending money from your own account. Since October 2024, UK banks must reimburse most victims up to £85,000 under the Payment Systems Regulator’s mandatory scheme, unless the bank can show you acted with gross negligence. You need to report it to your bank within 13 months of the last payment. Below is what the term means, why it is treated differently from card fraud, and what the law actually gives you.

What is the difference between APP fraud and unauthorised fraud?

Unauthorised fraud is when someone takes money from your account without your knowledge or consent — for example a stolen card or hacked online banking. APP (Authorised Push Payment) fraud is when you yourself send the payment, but only because you were tricked into doing it. The legal regime is different: unauthorised fraud is covered by the Payment Services Regulations 2017 with near-automatic refunds; APP fraud is now covered by the PSR Mandatory Reimbursement Scheme that came into force on 7 October 2024.

Is APP fraud actually fraud in the criminal sense?

Yes. The criminal offence is committed by the scammer, normally under the Fraud Act 2006 (fraud by false representation). The fact that you authorised the bank transfer does not make the act lawful — your consent was obtained by deception, which is precisely what the Fraud Act criminalises.

Does it matter what kind of scam I fell for?

For the criminal definition, no — APP fraud is a single legal category. For the refund rules, mostly no: investment scams, romance scams, impersonation scams, purchase scams, and invoice redirection are all in scope of the PSR scheme. The exceptions are international payments (the scheme covers Faster Payments and CHAPS within the UK only) and payments made using a credit card, which are usually better routed via Section 75 of the Consumer Credit Act 1974.

Why are banks suddenly refunding APP fraud?

Until October 2024, refunds were governed by the voluntary Contingent Reimbursement Model (CRM) Code — most major banks signed up, but enforcement was patchy. The Payment Systems Regulator made reimbursement mandatory under FSBRA 2013 powers. Banks no longer have a choice: if you were the victim of APP fraud and you meet the customer-standard requirements, the bank that sent the payment must refund you, with the receiving bank paying half the cost.

Can the bank refuse to refund me?

Only on narrow grounds. The bank must prove that you acted with gross negligence, or that the customer-standard requirements were not met (for example you ignored a specific Confirmation of Payee warning or did not report the fraud promptly). Simple negligence — being trusting, being persuaded — is not enough. The burden of proof sits firmly on the bank.

What if my bank does refuse?

You have a free statutory right to escalate the bank's decision to the Financial Ombudsman Service within six months of receiving the bank's final response letter. The Ombudsman reviews the case independently and applies a “fair and reasonable” test. The Ombudsman can order the bank to refund you, pay interest at 8% simple per year, and pay compensation for distress and inconvenience.

Is there a time limit for an APP fraud claim?

Yes. You must report authorised push payment (bank transfer) fraud to your bank within 13 months of the last fraudulent payment to be covered by the mandatory scheme. If the bank refuses, you then have 6 months from its final response letter to take the case to the Financial Ombudsman Service.

Scam Refund · Getting Started

Authorised push payment (APP) fraud: bank transfer fraud explained, and how to get your money back.

What is authorised push payment fraud?

Authorised Push Payment fraud means you sent the money yourself — but only because you were lied to. A fake invoice that looked like it came from your builder. A call from someone pretending to be your bank, telling you to move money to a “safe account”. An investment that never existed. A relationship that was never real. You pressed Confirm. The money left. And the authorisation was procured by fraud.

That word “authorised” is exactly why the law had to change. Under the Payment Services Regulations 2017, a bank that executes a payment you authorised has done its job. For years that meant APP fraud victims had almost no statutory right to a refund. Banks could — and often did — refuse on the basis that you pressed the button. That has now changed.

How is push payment fraud different from card fraud?

When someone steals your card details and buys something in Romania, you did not authorise that. Under regulation 76 of the Payment Services Regulations 2017 your bank must refund you almost immediately. Section 75 of the Consumer Credit Act 1974 adds a separate route for credit card purchases between £100 and £30,000.

APP fraud breaks that model because the payment is technically authorised. Until October 2024, victims relied on the voluntary Contingent Reimbursement Model Code — banks signed up but applied it inconsistently. Refund rates varied wildly. The Payment Systems Regulator had seen enough. It used its powers under the Financial Services (Banking Reform) Act 2013 to make reimbursement mandatory.

Which push payment scams does the scheme cover?

The scheme covers any APP fraud where the payment went over Faster Payments or CHAPS to a UK-domiciled account, from a consumer, micro-enterprise or charity. That is most real-world cases. The scam types in scope include:

International payments and credit-card payments fall outside the scheme, but they have their own routes. International scams may still be reportable under the bank’s own fraud policy, and credit-card payments often sit better under Section 75 of the Consumer Credit Act 1974.

Authorised push payment compensation: how much can you get back?

Your sending bank must refund you up to £85,000 within five working days of you reporting the fraud — unless it can prove you acted with gross negligence. Being trusting is not gross negligence. Being persuaded by a convincing scammer is not gross negligence. The receiving bank pays half the cost, so both banks now have a reason to catch fraud early. You may pay a £100 excess if you are not classed as vulnerable.

How to claim APP fraud reimbursement

The claim goes to your own bank, the one that sent the payment, not the bank that received it. Tell your bank that you were the victim of authorised push payment fraud and ask for reimbursement under the mandatory scheme. Report the fraud to Action Fraud or Police Scotland as well, so you have a crime reference number to give the bank. The bank then has five working days to refund you, up to £85,000, unless it can prove gross negligence. If it refuses, it sends a final response letter, and you can take the case to the Financial Ombudsman Service for free.

Is there a time limit for an APP fraud claim?

Yes, two. You must report the fraud to your bank within 13 months of the last fraudulent payment for it to fall under the mandatory scheme. If your bank then refuses a push payment fraud refund, you have 6 months from the date of its final response letter to take the case to the Financial Ombudsman Service.

What does the law ask of you?

Three things. Report the fraud to your bank within 13 months of the last payment. Cooperate with the investigation and provide a crime reference number from Action Fraud or Police Scotland. Do not ignore a specific Confirmation of Payee warning that the account name did not match. That is it. None of these is hard for an honest victim to meet. Vulnerable consumers cannot be denied a refund on gross-negligence grounds at all.

What if the bank still says no?

You get a final response letter with the bank’s reasons and your right to escalate. From the date of that letter you have six months to take the case to the Financial Ombudsman Service — free of charge, and free to use without a lawyer or a claims firm. The Ombudsman applies a “fair and reasonable” test, is not bound by the bank’s reasoning, and can order full reimbursement, interest at 8% simple per year, and compensation for distress. The decision is binding on the bank if you accept it.

See also: how much you can get back after a scam.

Ready to start your refund claim?

We draft your PSR-aligned bank complaint and walk you through Financial Ombudsman escalation for a fixed £99. No CMC fee. You keep every penny of your refund.

Not legal advice. This guide is for general information only. For advice specific to your circumstances, consult a regulated legal professional or contact Citizens Advice.