APP Fraud Reimbursement

Authorised push payment (APP) fraud occurs when a consumer is tricked into sending money from their own account to a fraudster's account. Until 2024, UK banks reimbursed victims only voluntarily under the Contingent Reimbursement Model (CRM) Code, leading to inconsistent outcomes. The Payment Systems Regulator (PSR) introduced mandatory reimbursement rules under the Faster Payments scheme, effective 7 October 2024.

Under these rules, both the sending and receiving payment service providers split reimbursement liability 50/50. The default maximum reimbursement is £85,000 per claim (set to match the FSCS deposit protection limit at the time; the FSCS limit itself rose to £120,000 on 1 December 2025), though the PSR can raise this. There is a mandatory excess of £100 (which providers may waive). Customers lose the right to reimbursement only in narrow circumstances: gross negligence, deliberate fraud by the customer, or claims within certain exempt categories.

The receiving bank's inclusion in the liability split is designed to incentivise tighter onboarding controls and faster account closures when fraud is detected. Consumers who are unhappy with a reimbursement decision can escalate to the Financial Ombudsman Service.

Status as of 19 September 2026: the UK government has announced that the PSR will be abolished and 'will mainly be consolidated into the Financial Conduct Authority', and the Financial Services and Markets Bill now before Parliament contains a clause stating 'The Payment Systems Regulator is abolished'. The Bill is not yet law. HM Treasury has said transitional provisions will 'transfer pre-existing PSR requirements, technical standards, other legal instruments, and guidance to the FCA'. Until the abolition takes effect the PSR keeps its statutory powers, and the reimbursement rules described here continue to apply.