APP fraud reimbursement (Authorised push payment fraud)

In plain words

If someone steals your card and spends with it, you did not agree to those payments, and your bank has to put the money back. APP fraud is different. Here the scammer never touches your account. They persuade you to send the money yourself: to a “safe account” your “bank” asked you to use, to a seller who does not exist, or to a supplier whose bank details were quietly changed on an invoice.

APP stands for authorised push payment. Authorised, because you approved it, often passing every security check. Push, because you sent it, rather than someone pulling it from your account. For years this meant victims were largely on their own: the payment was genuine in the eyes of the system, and getting money back depended on the goodwill of the banks involved.

The UK changed that on 7 October 2024. Under rules set by the Payment Systems Regulator (PSR), payment firms must now reimburse most victims of APP scams made through Faster Payments and CHAPS, up to £85,000 per claim, and split the cost equally between the firm that sent the money and the firm that received it. ¹ That last part is what matters most to a fintech: you can be on the hook as the receiving firm even if the victim was never your customer.

Illustration

Anatomy of an APP scam, and who pays it back

Swipe sideways to see the whole diagram.

How it works

How APP fraud reimbursement works

From the scam to the refund, under the UK rules.

1. 1

   The victim is scammed into paying

   They send a Faster Payment or CHAPS payment to an account the scammer controls, usually a mule account at another firm.

2. 2

   They report it to their own firm

   The claim goes to the sending firm, within 13 months of the last scam payment. The firm alerts the receiving firm to freeze what is left.

3. 3

   The sending firm reimburses

   Normally within 5 business days, up to £85,000, unless an exception applies. An excess of up to £100 may be deducted.

4. 4

   The cost is split 50:50

   The receiving firm pays half of the reimbursement back to the sending firm, whether or not it recovers anything from the mule account.

The scams it covers

APP scams work because they look like ordinary life: a parcel, an invoice, a call from the bank. The industry groups them into a handful of types. Knowing them helps you design warnings that match what the customer is actually doing.

The UK rules in detail

Before October 2024, reimbursement rested on a voluntary industry code, the Contingent Reimbursement Model Code, which not every firm signed and which was applied unevenly. The PSR replaced it with mandatory rules that apply to every payment firm sending or receiving Faster Payments, written into the Faster Payments scheme rules run by Pay.UK. The Bank of England applies matching rules to CHAPS. ¹

The exceptions: gross negligence and the consumer standard of caution

A firm can refuse to reimburse a customer who showed gross negligence, which is a high bar. The PSR set out a “consumer standard of caution”: the customer should take account of interventions from their firm or the police, report the scam promptly, share information when asked, and report it to the police if requested. Ignoring a single generic pop-up does not usually count. Ignoring a specific, tailored warning, or a direct conversation with the firm, can.

This is why warnings need to be specific to the payment and recorded. “Are you sure?” protects nobody. “We will never ask you to move money to a safe account. Has someone told you to do this?”, shown when a customer sends a large first payment to a new payee, protects the customer and gives the firm evidence.

Vulnerable customers

If the customer was vulnerable when the scam happened, and that vulnerability affected their ability to protect themselves, the firm must reimburse even if the customer did not meet the standard of caution, and it cannot apply the excess. Vulnerability can be temporary: bereavement, illness or a moment of acute stress all count. This links directly to the FCA’s Consumer Duty, which already expects firms to identify and support vulnerable customers.

The power to delay a payment

Since 9 October 2024, UK payment firms can delay an outbound payment by up to four business days when they have reasonable grounds to suspect fraud, so that they can contact the customer and investigate. Before that, the rules on executing payments quickly left little room to pause. The firm must tell the customer about the delay and still act within the time limit. For a fintech, this power is only useful if the product can actually hold a payment, show it as held, and route it to someone who can call the customer.

Illustration

The clock on a UK claim

Swipe sideways to see the whole diagram.

What is changing

The government has announced plans to fold the PSR into the FCA. The reimbursement rules are expected to continue under the merged regulator, but who supervises them, and how, may change. Build your processes around the obligations, not around the name of the regulator.

What it means for a fintech, on both sides

Most payment firms are both a sending firm and a receiving firm every day. The rules give each side a different job, and a different kind of exposure.

Why EMIs and smaller firms are exposed

The 50:50 split was designed with a specific problem in mind: mule accounts tend to sit at firms with fast, fully digital onboarding. That describes many EMIs, neobanks and small payment institutions. A firm that opens accounts in minutes, with high default limits and instant outbound transfers, is attractive to criminals recruiting mules. Under the old voluntary code, the receiving firm rarely paid. Now it pays half, every time.

The cost logic is simple. One £20,000 scam paid into a mule account at your firm costs you £10,000, plus the cost of handling it, whatever you recover. A handful of these a month can wipe out the revenue of thousands of ordinary customers. That makes mule detection a commercial priority, not only a compliance one.

APP fraud in the UK, EU and Gulf

APP scams happen everywhere instant payments exist. What differs is who carries the loss.

European Union

The EU’s first big step was prevention. Under the Instant Payments Regulation, payment firms in the euro area must offer Verification of Payee on euro transfers since October 2025: before a customer sends money, their firm checks that the payee’s name matches the IBAN and tells them if it does not. ² It is the EU’s counterpart to the UK’s Confirmation of Payee, and it applies to regular and instant euro transfers alike.

Reimbursement is the next step. The proposed Payment Services Regulation, part of the PSD3 / PSR package, would make firms refund customers in some cases: where the payee check failed, and where a scammer impersonated the customer’s own payment firm. It also proposes fraud data sharing between payment firms. These are proposals, not yet rules in force, so check the final text before you design around them.

Practice already varies by country. A Lithuanian EMI serving customers across the EU deals with complaint rules and fraud expectations in every country it reaches, while a Dutch or Spanish bank customer is used to instant domestic payments with strong name checks. For a fintech, the safe assumption is that EU rules are moving towards the UK model, and that controls built for the UK will be needed in the EU soon.

United Arab Emirates

The UAE has no mandatory APP reimbursement scheme that we are aware of. The Central Bank of the UAE sets consumer protection rules for the banks, wallets and payment firms it supervises, including fair treatment, clear disclosures and complaint handling, and it expects firms to run strong fraud controls. ³ With instant payments growing through Aani, impersonation calls and fake investment schemes are a real risk, and whether a victim gets money back depends on the firm’s own process and on how fast the receiving firm freezes the funds.

Scenario: a Dubai wallet notices customers receiving calls from someone posing as its support team. It cannot rely on a reimbursement rulebook, so it adds a banner in the app, a short hold on first transfers to new payees above a set amount, and a direct line to the fraud teams of the main receiving banks. The goal is the same as in the UK: stop the money before it leaves the country.

Saudi Arabia

The picture is similar. SAMA sets consumer protection and anti-fraud expectations for banks and payment firms, and Saudi firms commonly apply checks and limits around new beneficiaries and large transfers. ⁴ There is no UK-style mandatory reimbursement that we know of, so a fintech entering Saudi Arabia should design its fraud controls for prevention first, and treat its complaint process as part of the product.

Fraud controls to have before launch

Whether or not your market has mandatory reimbursement, these controls decide how much APP fraud costs you. Most of them are product features, not policies.

For practical detection rules, read tips for transaction fraud detection and prevention. For how to show held and returned payments so customers understand them, read why most neobank MVPs fail at money clarity.

Example: one scam, two firms

Common misconceptions

FAQ