Since 7 October 2024, payment firms have had to reimburse most victims of authorised push payment (APP) scams. These are scams where someone is tricked into sending money by bank transfer to a fraudster. Before then, reimbursement was mostly voluntary and depended on which bank you used.

What the rules cover

The rules apply to payments made by Faster Payments (under Payment Systems Regulator rules) and CHAPS (under equivalent Bank of England rules). They cover:

• consumers, micro-enterprises and charities with annual income of less than £1 million

• payments sent from a UK account to another UK account that the victim doesn't control

They don't cover card payments, international payments or payments made through other systems.

How much can be reimbursed

• Limit: up to £85,000 per claim. Firms can choose to pay more. The regulator originally set the limit at £415,000 but reduced it to £85,000 before the rules started.

• Excess: the sending firm can deduct an excess of up to £100 per claim. It can't apply the excess to customers it considers vulnerable. If a claim is for less than the excess, the firm may not reimburse anything. The protection applies where the customer's vulnerability materially affected their ability to protect themselves from the scam.

• Who pays: the sending and receiving firms split the cost 50/50.

Each bank decides whether to apply the excess. When we checked banks' own websites in October 2026:

• Lloyds Bank and Santander said they would deduct a fixed £100 from each refund, unless something prevented the customer from protecting themselves.

• NatWest said a £100 excess "could apply", but not where a customer's circumstances materially affected their ability to protect themselves.

• first direct said an excess of £100 "may be deducted".

• Nationwide and TSB said they don't apply the excess.

This covers a small number of banks and may not reflect every bank's current approach. Check your own bank's terms.

How long it takes

Firms must normally reimburse within five business days of a claim. They can pause this ("stop the clock") to gather information, but must reach a decision within 35 business days.

When a claim can be refused

Reimbursement can be refused if:

• the customer was involved in the fraud (first-party fraud)

• the customer was grossly negligent, for example by ignoring specific warnings from their bank or the police, or not responding to reasonable requests for information. This exception doesn't apply to vulnerable customers. The protection applies where the customer's vulnerability materially affected their ability to protect themselves from the scam.

• the claim was made more than 13 months after the last scam payment

• the case is a civil dispute, such as a disagreement with a genuine trader

Firms have to show that the customer was grossly negligent. The customer doesn't have to prove that they weren't. In its launch announcement, the Payment Systems Regulator said: "The onus is on banks and payment firms to prove where customers have acted with gross negligence, through ignoring specific, tailored warnings or not responding to reasonable requests for information, for example."

Losses over £85,000

If you lose more than £85,000, or disagree with how your bank handled your claim, you can complain to the bank and then to the Financial Ombudsman Service. The Ombudsman decides whether the bank acted fairly. For complaints referred from 1 April 2026 about events on or after 1 April 2019, it can require a firm to pay up to £455,000.

What happened when the rules started

When the rules launched on 7 October 2024, Rocio Concha, Which?'s Director of Policy and Advocacy, said: "For too long, victims have been at the mercy of a reimbursement lottery depending on who they bank with." Which? also raised concerns about "the regulator's decision to weaken the scheme at the eleventh hour by slashing the maximum reimbursement limit".

David Geale, managing director of the Payment Systems Regulator, said at the time: "Today is a very important day in making it quicker and simpler for victims of APP scams to get back money they've lost to criminals, with a guaranteed minimum level of protection in place."

The government plans to abolish the Payment Systems Regulator and move its work to the Financial Conduct Authority. Legislation for this was going through Parliament in 2026.

Reducing the risk of APP scams

• Before paying someone new, check that the name on the account matches the person or business you expect to pay. Your bank's Confirmation of Payee check does this.

• Banks and the police won't ask you to move money to a "safe account".

• If you think you've been scammed, contact your bank straight away and report it to the police.

More guidance is available from Take Five to Stop Fraud.