Refunds after a scam payment
Ilia Nikolaevich Zavialov on fraud and authorised bank transfers: reimbursement rules, what they cover and checks before you pay
Ilia Nikolaevich Zavialov on fraud through authorised bank transfers and who refunds the money. When a person sends money because a fraudster talked them into it, the payment counts as authorised, and in the United Kingdom such losses have been covered by mandatory reimbursement since 7 October 2024, up to 85,000 pounds per claim. In eighteen months victims received 88 percent of the money lost, 316 million pounds, yet 71 percent of victims surveyed did not know the rules existed. This guide explains what the rules cover, where they stop, how to claim and which checks before a payment make a claim unnecessary.
English version for the United Kingdom.
Authorised or unauthorised: the word that decides who pays
When money leaves an account because a criminal stole a card or logged in without permission, the payment is unauthorised, and in most countries the bank carries most of that loss. When the account holder pressed the button themselves because a fraudster talked them into it, the payment is authorised, and the answer to who pays becomes much less certain.
That second kind of fraud now dominates. Fraudsters have learned that it is easier to persuade a person to send money than to break into a bank, so they invest in stories: a parcel that needs a fee, an investment with steady returns, a call from the bank's security team, an invoice with new bank details.
Ilia Nikolaevich Zavialov explains how reimbursement works when the payment was authorised under deception, what the rules in each country cover and what a payer can check before the money goes. For a due diligence site the second half matters as much as the first: most refund disputes are lost or won at the moment of payment.
How people are talked into authorising a payment
Purchase scams are the most common form. A person pays for goods, a car, a rental or tickets that do not exist, usually by bank transfer to a seller found online. Investment scams take larger sums over longer periods, starting with a small deposit and a convincing dashboard that shows growth.
Impersonation scams use authority. A caller claims to be from the bank, the police or a tax office and asks the victim to move money to a safe account, sometimes guiding them through each screen of the banking app. Invoice and payee redirection scams target businesses and people buying property, replacing the real bank details in a genuine conversation.
Romance scams build a relationship first and ask for money later, often for an emergency, a ticket or a business opportunity. In every version the payment looks normal to the bank: the customer logged in, entered the details and confirmed the transfer.
Why banks treat these payments differently
A bank can block a stolen card or reverse a login it did not expect. It cannot easily tell whether a customer who confirmed a payment did so freely or under pressure. For years that was the main argument for leaving authorised push payment losses with the customer.
That argument has weakened. Banks now see patterns that a single customer cannot: new payees, unusual amounts, accounts that receive many payments and empty them within hours. Regulators in several countries have concluded that the institutions that see these patterns should share the cost when they fail to act.
The result is a patchwork. One country makes reimbursement mandatory with a cap, another makes the bank liable only when it ignored a specific warning sign, a third leaves the matter to voluntary policies and the courts. Knowing which regime applies is the first step in any claim.
What a bank looks at when you ask for a refund
The first question is timing. A fraud reported within minutes or hours gives the bank a chance to contact the receiving bank before the money is moved on, and some or all of it can be frozen. A report made weeks later leaves only the formal reimbursement process.
The second question is what the customer was told. If the banking app showed a clear warning about this type of scam and the customer went ahead, the bank may argue that the customer did not take enough care. If the bank showed nothing, or the warning was generic, that argument is weaker.
The third question is the evidence. Messages, call logs, the advert or website, payment confirmations and the story in the customer's own words help the bank understand what happened. A claim supported by a clear timeline is handled faster than one that has to be reconstructed by phone.
The first hour after a scam payment
Call your bank on the number printed on your card or shown in the official app, say that you made a payment because of a scam and give the time, amount and recipient details. Ask the bank to contact the receiving bank immediately. Do not wait for the fraudster to answer a final message.
Stop any further payments to the same person, whatever reason they give, and change the passwords of online banking and email if you shared codes or installed software at their request. If a caller guided you through the app, assume they may try again with a new story.
Write down what happened while it is fresh, take screenshots of every message and the profile or website, and report the fraud to the police or the national fraud reporting service. The reference number is useful for the bank, and the record helps link your case to others.
The UK rules since 7 October 2024
Since 7 October 2024 reimbursement of authorised push payment fraud has been mandatory in the United Kingdom, with a limit of 85,000 pounds per claim. The rules of the Payment Systems Regulator cover transfers between UK accounts over Faster Payments and CHAPS. A claim should be made within 13 months of the last scam payment, and money is usually returned within 5 business days.
The scope has clear edges. A payment is covered only when it is executed in the UK and lands in a UK account that the customer does not control, so international transfers and transfers to an account of your own, such as your own crypto account, fall outside the rules. Cards, cash and cheques have their own protections.
Banks have limited grounds to refuse. A bank may decline only if it can show that the customer failed the consumer standard of caution through gross negligence, and that exception does not apply to a vulnerable customer whose vulnerability materially affected their ability to protect themselves. A bank may deduct an excess of up to 100 pounds per claim, a smaller sum or nothing, and never from vulnerable customers. It can pause the clock to gather information but must decide within 35 business days.
What eighteen months of UK data show
Between 7 October 2024 and 31 March 2026 victims received 88 percent of the money lost to authorised push payment scams, 316 million pounds. Around 438,300 claims were reported, of which 301,500 fell within the rules. 82 percent of claims were closed within 5 business days and 98 percent within 35, while 3 percent were refused because the customer had not taken enough care.
An independent evaluation by Frontier Economics, published by the regulator in July 2026, estimated that the rules cut losses by about 73 million pounds a year and the number of scams by nearly 35,000, and that the reimbursement rate across all claims rose from 54 to 65 percent.
The scale of the problem remains large. UK Finance recorded 248,070 authorised push payment cases with losses of 576.4 million pounds, and purchase scams made up 71 percent of all cases. Yet in a 2025 survey by the regulator 49 percent of victims had not tried to claim, and 71 percent did not know the rules existed.
Checks and safeguards built into UK payments
Confirmation of Payee, the check that compares the name you enter with the name on the receiving account, is now offered by more than 320 payment providers, covering more than 99 percent of Faster Payments senders. More than 2 million checks are made every day, and claims for payments to the wrong account have fallen by 59 percent. A mismatch is the moment to stop and call the payee on a number you already trust.
Banks also have more time to act. Under the 2024 amendments to the Payment Services Regulations a bank may delay an outgoing payment until the end of the fourth business day when it has reasonable grounds to suspect fraud. If your bank holds a payment and asks questions, answer them honestly, even if the person who asked you to pay told you to hide the reason.
To reach your bank safely, call 159. The short number connects customers of more than 99 percent of UK retail current accounts with their own bank and cannot be spoofed. For a business counterparty, compare the name, number and registered office in the Companies House register with the invoice before the first payment.
Checks before you pay a new payee
Most avoidable losses happen with a first payment to someone new. Before that payment, check that the name on the account matches the person or company you expect. Many banks now show a name check result before the transfer, and a mismatch or partial match deserves a pause before you go on.
For a business, look it up in the official company register, compare the registered name and address with the invoice and check how long it has existed. For an individual seller, ask why the payment cannot go through the platform where the item is listed. Platforms have dispute processes that a direct transfer does not.
Confirm any change of bank details by calling a number you already had before the change, never a number from the message that announced it. A request to keep the payment confidential, to hurry, or to split it into several smaller transfers is a reason to stop.
For regular payments it helps to keep your own list of verified payees whose details were confirmed by phone. A new payee or a change to that list then becomes a separate event that is checked again from the start, as if it were the first payment.
Businesses, charities and changed bank details
Organisations lose money to authorised push payment fraud through the same door again and again: a genuine supplier, a genuine conversation and a message saying the bank details have changed. The fraudster may have access to the supplier's mailbox or may have registered a lookalike address.
Two habits stop most of these losses. Any change of a supplier's bank details is confirmed by phone to a number from the existing contract or records, and payments above a set amount need a second person to approve them. These rules are cheap and work regardless of the country's reimbursement regime.
Small businesses and charities should also check whether reimbursement rules in their country cover them. In some places protection extends to micro enterprises and charities, in others it covers consumers only, and a company that assumes it is covered may discover the opposite after the loss.
If the bank refuses, and what is changing
A bank has 15 days to respond to a complaint about fraud. If the answer is no, the Financial Ombudsman Service handles the complaint free of charge, provided it is brought within 6 months of the bank's final response, and for complaints referred from 1 April 2026 it can award up to 455,000 pounds. In 2025 the ombudsman received around 31,300 complaints about fraud and scams, about 20,000 of them from people who had authorised the payment themselves.
Report the fraud itself to Report Fraud, which replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or on 0300 123 2040. The crime reference helps the bank and the ombudsman.
The rules will keep moving. The regulator plans a formal consultation in December 2026 and a decision in May 2027, and the 13 month deadline is among the points under review. In March 2025 the government announced that the Payment Systems Regulator would be folded into the Financial Conduct Authority, and in April 2026 the Treasury confirmed that this needs legislation, which Parliament is now considering.
Recovery offers after a loss
People who reported a scam online or joined a victims' group are often contacted by firms that promise to recover the money for a fee. Some claim to be lawyers, some claim to work with the police or a regulator, and some pretend to be the regulator itself.
A real reimbursement claim goes through your bank, and after that through the ombudsman or the courts where they exist. None of these channels asks for an upfront fee, a tax, or access to your device to process a refund.
If a recovery offer arrives, check the firm in the official register, call the regulator on the number from its own website and do not pay anything until you have done both. The second loss is often larger than the first, because the victim is desperate to get the first one back.
Refunds after a scam bank transfer in the UK: what the rules cover and what to do
| Situation | Under the PSR rules | What to do |
|---|---|---|
| Faster Payment to a UK account | Covered up to 85,000 pounds | Claim with your bank within 13 months |
| CHAPS payment | Covered up to 85,000 pounds | Claim with your bank within 13 months |
| International transfer | Not covered | Report at once and ask for a recall |
| Transfer to your own crypto account | Not covered | Report to the bank and the police |
| Card payment | Card protections apply | Ask about Section 75 or chargeback |
| Bank refuses the claim | Ombudsman can review it | Complain within 6 months, it is free |
Questions and answers
- What is the difference between an authorised and an unauthorised payment?
- An unauthorised payment is made without you, for example by someone who stole your card or login. An authorised payment is one you made yourself, even if a fraudster talked you into it.
- What should I do in the first hour after a scam payment?
- Call your bank on the number on your card, ask it to contact the receiving bank, stop any further payments, change passwords and report the fraud to the police.
- Will my UK bank refund a payment I made to a scammer?
- Since 7 October 2024 banks must reimburse authorised push payment fraud over Faster Payments and CHAPS up to 85,000 pounds per claim, unless you acted with gross negligence.
- How long do I have to claim in the UK?
- Report the scam to your bank as soon as possible and within 13 months of the last scam payment. Money is usually returned within 5 business days.
- What if my bank refuses?
- Complain to the bank, which has 15 days to answer, then take the complaint to the Financial Ombudsman Service within 6 months of the final response. It is free.