CyphrQ
Menu

UK APP Fraud Reimbursement Rules: What Is Covered, the £85,000 Limit

Since 7 October 2024, UK banks must reimburse most APP fraud on Faster Payments or CHAPS, up to £85,000. What is covered, the exceptions, and what to do.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

10 min read

Since 7 October 2024, UK banks and payment firms must reimburse most victims of authorised push payment (APP) fraud on Faster Payments and CHAPS transfers, up to £85,000 per claim. Reimbursement is expected within five business days. The exceptions are fraud where the customer was complicit or grossly negligent, and the rules do not cover card, cash or cheque payments.

APP fraud is when a criminal tricks you into sending a payment yourself: you authorise it, but to the wrong person or for a false reason. Before these rules, whether you got your money back depended on your bank's voluntary code. Now the rules are mandatory and set by the regulator, the Payment Systems Regulator (PSR).

This post explains who is covered, what the limit is, where the exceptions sit, what the first 18 months of data show, and what banks and customers should do.

What is APP fraud, and how is it different from unauthorised fraud?

In unauthorised fraud, someone else takes money from your account without your permission, for example with a stolen card. In APP fraud, you make the payment. The PSR is explicit that "APP fraud is different to unauthorised fraud." Unauthorised fraud has its own long-standing protections.

Typical APP scams include a fake investment opportunity, an impersonated bank "fraud team" asking you to move money to a "safe account", an invoice with changed bank details, and a romance scam. The common thread is a convincing story and a request to pay by bank transfer.

Voice and video cloning make some of these stories more believable. I cover that in how to spot deepfake scams.

How big is APP fraud in the UK?

UK Finance's Annual Fraud Report 2026, published on 15 June 2026, gives the 2025 figures. UK Finance's press release reports:

Measure (UK, 2025) Figure
APP fraud losses £576.4 million, up 19%
APP fraud cases 248,070, up 7%
Personal losses / business losses £500.8 million / £75.6 million
Reimbursed to victims £354.3 million, 61% of losses
Investment fraud losses £221.5 million, up 40%
APP cases starting online 66% of cases, 32% of losses
APP cases starting by telecoms 17% of cases, 28% of losses

Telecoms-origin cases are fewer but costlier: 17% of cases led to 28% of losses.

One caution on the 61%: the PSR says its own reimbursement figure and UK Finance's are not directly comparable, because they count different things. More on that below.

What do the UK APP fraud reimbursement rules cover?

The PSR's consumer page sets out the scope:

  • Which payments: UK bank transfers made over Faster Payments or CHAPS, on or after 7 October 2024.
  • Which scams: "All types of APP fraud are covered by the new measures."
  • Who can claim: individuals, microenterprises and charities.
  • Who is not in the scheme: credit unions, municipal banks and national savings banks.
  • Other payment types: card, cash and cheque payments "have their own protections in place."

The costs are shared. The PSR says the sending and receiving firms split the cost of reimbursement 50:50. That matters because it gives the receiving bank, the one holding the criminal's account, a financial reason to stop that account being used.

What is the UK APP fraud reimbursement limit?

The maximum claim is £85,000 per claim. The PSR's consumer page states: "The maximum amount of money people can claim is £85,000."

The PSR's policy statement PS24/7, dated 2 October 2024, confirmed £85,000 from 7 October 2024. The PSR says that level means "99.8% of all Faster Payments APP scams by volume, and 90% by value, are fully reimbursed," provided they are in scope. The Bank of England set the same £85,000 maximum for CHAPS.

For losses above the limit, the PSR points to the Financial Ombudsman Service, which it says has a "compensation limit of £430,000."

The PSR also said it will keep the level under review as part of its 12-month evaluation. I did not find a change to the limit, and the PSR consumer page still shows £85,000 at the time of writing. Check it before you rely on the number.

What are the exceptions to APP fraud reimbursement in the UK?

There are only a few exceptions. The PSR's consumer page lists them:

Rule What the PSR says
Complicit or grossly negligent "You won't get your money back if you're found to have been complicit in the fraud or grossly negligent."
Vulnerable customers "Gross negligence is a high bar and this exception does not apply to vulnerable consumers."
Excess "There is an optional £100 excess that firms can apply." It cannot be applied to vulnerable consumers.
Time limit Report "within 13 months of making the fraudulent payment."
Civil disputes Not APP fraud. The PSR points to protections under the Consumer Rights Act.

A civil dispute is a disagreement with a real seller about quality or delivery. A scam is a fake seller who never intended to deliver. The line can be hard to draw, and it is the point where many disputed claims will land.

The PSR's own data shows how rarely the "caution" exception is used. Over the first 18 months, 3% of claims were rejected for insufficient consumer caution (PSR dashboard).

How fast should you be reimbursed, and what has happened in practice?

The PSR says you can expect reimbursement within 5 business days of claiming. A firm may "stop the clock" to gather information, but it "must arrive at an outcome within 35 business days."

The PSR's reimbursement dashboard, updated on 30 July 2026, covers 7 October 2024 to 31 March 2026:

  • 88% of money lost reimbursed, worth £316 million over 18 months.
  • About 438,300 claims reported, of which about 301,500 were in scope.
  • 82% of claims closed within five business days, and 98% within 35 business days.
  • 3% of claims rejected for insufficient consumer caution (about 1,700, or 2%, in Q1 2026).

The PSR's earlier one-year review found 88% reimbursed in the first nine months, against 66% for the same period in 2023/24. It also found claim volumes about 15% lower, which it says suggests firms are preventing fraud earlier. It notes that direct comparisons with pre-policy data are not possible because the methodology changed.

Two honest limits on these numbers. The dashboard covers claims reported to firms and closed in the period, so it is not the whole market. And the 88% (PSR, value of claims) and 61% (UK Finance, share of all APP losses) measure different things, so one does not contradict the other.

What should customers do after an APP scam?

The PSR's advice is short, and I would add one point of my own on speed.

  1. Contact your bank immediately. Use the number on your card or the bank's official app, not a number in a message.
  2. Make the claim within 13 months of the payment. Do not wait.
  3. Answer the bank's information requests promptly, after confirming the request is genuine.
  4. Report to the police, or consent to your bank reporting on your behalf.
  5. Keep evidence: messages, emails, the account details you paid, and the date and time.
  6. Pay attention to warnings your bank shows before you pay. Ignoring a clear warning is the sort of thing that can be raised against you.

If you are refused, you can complain to the firm and then to the Financial Ombudsman Service. Cases above £85,000 can go to the Ombudsman as well.

What should UK banks and payment firms do about APP fraud?

The rules turned fraud from a customer problem into a cost line for both ends of a payment. The 50:50 split is the part that changes behaviour.

For sending firms, that means better friction at the right moment: clear warnings, delays on high-risk payments, and staff trained to ask questions. For receiving firms, it means stopping mule accounts, the accounts that criminals use to receive and move stolen money.

The next section is for the people who build and run those controls. For firms that also have EU operations, the operational resilience side is a separate regime, covered in DORA requirements for financial entities.

Going deeper: for security and IT teams

This section is for fraud, security and engineering teams at payment firms, and for IT managers at businesses that make large transfers. It sticks to what the primary sources say, and flags what I could not verify.

The regime as a control objective. The reimbursement rules do not tell firms which controls to run. They create a financial incentive: sending and receiving firms each bear half of the reimbursement cost (PSR), and reimbursement runs to a 5-business-day expectation with a 35-business-day outer limit. Your fraud controls are therefore measured against loss, not just against a rule.

Confirmation of Payee (CoP). CoP checks the name a payer enters against the name on the recipient account before the payment is sent. UK Finance's guidance on Confirmation of Payee describes the outcomes as match, close match (the real account name is shown), no match, and unavailable (for example a timeout, an opt-out or a missing account). Treat the response as a risk signal, not a pass or fail:

  • "No match" and "unavailable" on a new payee, followed by the user proceeding, are strong signals worth scoring.
  • Log the CoP response with the payment instruction so a later claim can show what the customer was told.
  • For corporate payments, check that your payment tooling surfaces the CoP result to the approver, not just the initiator.

Transaction risk signals. Because a legitimate user authorises the payment, device and session checks matter less than behaviour. Signals worth combining:

  • A new payee plus a high amount relative to the account history.
  • A payee added shortly after a change of contact details or device.
  • An active phone call during the session, where the platform can detect it, which is the pattern in "safe account" scams.
  • Account drain: a large share of the balance sent in one payment, often after savings are moved in.
  • Repeated attempts after a warning or a held payment.

Test the control, not only the model. Replay known scam journeys against your staging environment and confirm the warning shows, the payment holds, and the analyst queue receives the case.

Mule detection (receiving side). With a 50:50 liability, inbound monitoring pays back directly. Useful indicators on a receiving account:

  • A new account receiving many first-time credits from unrelated senders.
  • Funds leaving within minutes of arrival, to a new payee, to an exchange or to several accounts in sequence.
  • Credits that do not fit the stated account purpose or the customer's declared income.
  • Shared devices, addresses or phone numbers across several newly opened accounts.

Alert on the pattern, then hold and review inbound funds when your process allows. Keep the audit trail for each decision, as you will need it for disputes between firms about liability.

What to verify. I did not open the PSR's full consolidated policy statement (PS25/5) or the legal directions behind Confirmation of Payee, so check the exact reimbursement criteria, the consumer standard of caution and the CoP technical requirements against those documents before you design controls or write customer terms. Ask your fraud vendor how it scores a CoP result, how fast it can hold an outbound payment, and how it evidences a decision for a claim.

Business customers. The protections apply to individuals, microenterprises and charities. A larger company does not get the same cover, so its protection rests on approval rules: call-back verification of changed bank details, two-person approval above a threshold, and a check of any CoP mismatch before release.

Learn more

Key takeaways

  • Since 7 October 2024, UK Faster Payments and CHAPS APP fraud is covered by mandatory reimbursement, up to £85,000 per claim.
  • Individuals, microenterprises and charities can claim. Report within 13 months.
  • The exceptions are complicity and gross negligence, a high bar that does not apply to vulnerable customers. Firms may apply an optional £100 excess.
  • Sending and receiving firms split the cost 50:50, which is why mule-account detection now has a direct cost.
  • PSR data to 31 March 2026 shows 88% of money lost reimbursed, with 82% of claims closed in five business days.
  • If you are scammed, call your bank at once, answer its questions, report to the police and keep the evidence.

Sources