New bank refund rules finally land – but are you protected?

UK banks must now refund authorised push payment (APP) fraud victims within five business days, up to the value of £85,000 per claim, following the introduction of new rules on 7 October. 

Until now, banks have not been legally required to refund victims of APP fraud, although some had signed up to a voluntary code, the Contingent Reimbursement Model (CRM), which required banks to reimburse victims subject to certain specific exceptions. 

This approach resulted in a ‘reimbursement lottery’ for those defrauded, with the chances of getting their money back largely dependent on who they banked with - the best reimbursing 88% of total losses to customers, and the worst just 9%. 

The new rules, set out by the Payments Systems Regulator (PSR), will help address this disparity by replacing voluntary action with mandatory reimbursement. 

Charlie Shillito, Senior Associate at law firm Penningtons Manches Cooper LLP, says the new regulations will help, especially those who are less adept with new technology and more likely to fall victim to fraud. 

“The new PSR rules are unquestionably a step in the right direction in terms of providing greater consumer protection to those targeted by fraudsters,” he says. 

What is APP fraud? 

APP fraud occurs when a victim is tricked into sending money from their bank account to another, one they believe to be for a legitimate payment but is actually controlled by a fraudster.  

According to UK Finance there were 232,429 cases of APP fraud in 2023, a 12% increase on 2022. 

They’re called “authorised” scams because at some point the victim will have to approve the transaction with their bank, but they're carried out in many ways. 

Many APP scams start with someone pretending to be someone else – therefore, these are often referred to as ‘impersonation’ scams. Criminals typically imitate banks, police, utility providers, HMRC - even friends or family - to steal money.  

UK Finance says that a third of those aged over 55 had been contacted by impersonation scammers. 

A common examples of this is when a fraudster phones and pretends to be someone from your bank or the police, informing you that you’ve been a victim of fraud.  

They’ll ask you to move money into a 'safe account' or to authorise a transaction for some spurious reason.  

Another example is romance fraud, where victims are tricked over a long period of time into believing they’re in a relationship with someone online and are manipulated into ‘helping’ them with cash payments. 

Once they’ve followed their instructions, they’ll be unwittingly paying money to a fraudster. The criminal will then quickly transfer the money to other accounts, making it hard to trace or recover. 

• Common types of scam – and how to protect yourself 

The new refund limit 

One bone of contention regarding the new rules is that the maximum reimbursement will be capped at £85,000.  

Following a consultation in 2023, the PSR proposed the highest level of reimbursement per claim would be £415,000, which was how much consumers could receive following a complaint to the Financial Ombudsman Service before 31 March 2024 (but has since risen to £430,000). 

However, after lobbies to lower the limit, the PSR subsequently carried out a second, two-week, consultation at the beginning of September 2024 before announcing the cap would be £85,000 per case. 

The PSR claims this will cover more than 99% of claims, describing it as a “carefully balanced decision”, although when taken by value (the amount claimed compared to the money returned) the reduced limit is only estimated to deliver 90% of the money lost. 

Were the limit increased to £415,000, 98% of fraudulently gained money (by value) would be returned. 

The £85,000 reimbursement limit now applies to both APP fraud carried out via Faster Payments (electronic bank transfers), and CHAPS payments, which are managed by the Bank of England – however, it has promised a review of the CHAPS limit in 12 months. 

CHAPS is the bank-to-bank payment system often used for things like house deposits and mortgage advances, as well as by corporates and financial firms.  

However, these rules are only for payments sent within the UK, which could mean many fraudulent payments are not eligible for a refund. 

Shillito adds: “Finally, it’s important to note that the mandatory reimbursement rules do not apply to international payments, and these are generally the types of payment where higher value APP frauds occur.  

“Consumers will likely feel, therefore, that while the new rules are a big step in the right direction, further progress is required.”

What does the reimbursement limit mean for you? 

On one hand, the new rules provide a level of surety for consumers. Victims of APP fraud will be treated the same way, regardless of who they bank with, and will know how much of a refund they’ll be eligible for.  

But questions have been raised about the value of the new regime for victims of some larger conveyancing, pension or investments scams, because their losses are more likely to breach the £85,000 cap. 

Alex Somervell, co-founder of free online scam checker Ask Silver, says: “On a top-level, the [reduction of the reimbursement limit] dilutes the regulation, seemingly to protect fintech and smaller financial services companies.  

“The change affects approximately 10% of the value of scams, specifically those over £85,000, which represent only 0.3% of all scams.  

“However, consumers who lose over £85,000 can still appeal to the Financial Ombudsman Service, which can refund up to £430,000. 

“High-value scams predominantly affect those aged 50 and over, as they typically have more assets and are more susceptible to investment and romance scams, which often involve larger sums, compared to purchase scams that are more common among millennials.” 

So while the new rules do add in a layer of protection, it's still important to stay vigilant and follow the guidance on how to stay safe from scammers.

Rules for reimbursement 

The new rules mean any APP fraud reimbursement will be generated via a 50/50 split between the victim’s bank (which sent the money) and the receiving bank (where the fraudster held an account).  

It’s also important to be aware that refunds could be subject to an excess of up to £100, which means the victim may not get back the full amount lost, so an initial loss of less than £100 might mean not getting anything refunded at all. 

However, this excess is at the discretion of the ‘sending’ payment firm and some may decide not to charge.  

Beyond that, the PSR says there are two circumstances where banks are not obliged to refund consumers:  these are if the victim in question acted fraudulently or were “grossly negligent” (beyond the ‘standard of consumer caution’). 

For example, you’re less likely to get your money back if you didn’t pay attention to any bespoke transaction-specific warnings your bank gave you.  

There’s also a requirement for victims to report scams to their bank as soon as possible and share information to help it assess the claim. They’ll also need to consent to fraud details being reported to the police.  

Protection for vulnerable customers 

There is, however, an extra layer of protection for victims deemed as “vulnerable”. They won’t have to pay the excess on their claim, and they’ll also be excepted from the “standard of caution” requirement when banks consider a case of fraudulent behaviour. 

A vulnerable person is defined as "someone who, due to their personal circumstances, is especially susceptible to harm – particularly when a firm is not acting with appropriate levels of care".  

A few criteria are used in the definition of vulnerable, such as health (including low mental capacity or cognitive disability), life events (such as income shocks or retirement), resilience (including low savings or erratic income) and capability (such as low knowledge or confidence in managing finances). 

However, the FCA has recommended that firms don’t refer to customers as vulnerable directly, as they may find the label upsetting – so it might not be visibly used as terminology in some cases. 

The onus will be on banks to assess vulnerability of someone caught in a scam on a case-by-case basis, considering all the facts around any claim, so it’s worth understanding if you, or someone important in your life, would qualify as vulnerable in case the worst were to happen.