APP Fraud Reimbursement UK: How to Get Your Money Back After a Bank Transfer Scam

You got a message from someone you'd been chatting to online for weeks. Or an email from what looked exactly like your solicitor, giving you the updated bank details for your property completion. Or a call from "HMRC" threatening immediate arrest unless you transferred £3,000 to clear an unpaid tax bill. You transferred the money. And then you realised.

The conventional wisdom — and what banks told victims for years — was that because you authorised the payment yourself, you bore the loss. The bank didn't send the money to a fraudster. You did. That was their defence, and for a long time, it worked.

That defence is no longer available. Since 7 October 2024, the rules changed fundamentally. Banks are now legally required to reimburse victims of authorised push payment fraud — and most victims still don't know it.

What Is Authorised Push Payment Fraud?

Authorised Push Payment (APP) fraud happens when a scammer tricks you into voluntarily transferring money to an account they control. You authorise the payment — that's the "authorised push" part. The bank processes it correctly. But you were deceived about where the money was going, who was receiving it, or why the transfer was necessary.

This is distinct from unauthorised fraud — where someone hacks into your account and moves money without your knowledge. For decades, banks argued that because APP fraud involved a payment the customer authorised, they had no liability. The customer clicked "confirm." The customer bore the risk.

That argument ignored a simple reality: the customer was deceived. And as of October 2024, the law agrees.

The Old World: Voluntary Codes and Easy Refusals

Before October 2024, the main protection available to APP fraud victims was the Contingent Reimbursement Model (CRM) code, introduced in 2019. Banks signed up voluntarily. They were supposed to reimburse victims who hadn't been "grossly negligent" — but because the code was voluntary and the standards were self-assessed, banks routinely refused claims. The same institution that failed to flag an obvious fraudulent transaction was also judging whether the customer had been careful enough.

Not all banks had even signed up. Refusal rates were high. Victims — often elderly people who had lost life savings, or first-time buyers who had lost their deposits — were left with no recourse beyond the Financial Ombudsman, a process that could take over a year.

The Payment Systems Regulator spent years building the evidence base, consulting, and designing a mandatory replacement. On 7 October 2024, it came into force.

What the New Rules Actually Require

Under PSR Policy Statement PS23/3 and the Payment Services Regulations 2017 (as amended), all Payment Service Providers (PSPs) that process Faster Payments — which means virtually every UK bank and building society — are now subject to mandatory APP fraud reimbursement obligations. The key points:

The Consumer Duty (FCA, 2023) reinforces this further: banks have an obligation to act in customers' best interests, deliver good outcomes, and provide fair treatment. A bank that processes an obviously fraudulent transaction without flagging it, then refuses to reimburse the victim, is on shaky ground against both the PSR rules and the Consumer Duty.

What to Do Immediately After a Bank Transfer Scam

Speed matters. The faster money is reported as fraudulent, the higher the chance some or all of it can be recovered at the receiving end before the scammer moves it on. Here's the sequence:

Under the PSR rules, banks have 35 business days to resolve an APP fraud claim from the point of notification. In cases involving complex investigations, this can be extended — but they must tell you why and when they expect to conclude. If they go silent, that is a reason to escalate.

If Your Bank Refuses or Delays

A bank that refuses your APP fraud reimbursement claim must give you its reasons in writing. At that point, you have two paths: the Financial Ombudsman Service (FOS) and a pre-action enforcement letter.

The FOS has jurisdiction over payment disputes under the Financial Services and Markets Act 2000 and can award compensation of up to £430,000. Since October 2024, the FOS has consistently upheld APP fraud complaints where banks have refused valid claims. A bank that refuses a claim it was legally required to honour faces a high probability of an FOS ruling against it.

Before going to the FOS, a formal pre-action letter to the bank citing its obligations under PS23/3 and the Payment Services Regulations 2017 — and setting out the FOS escalation path — is often the most effective single step. Banks have compliance teams. A letter that demonstrates the customer knows the law tends to be treated differently from a general complaint.

You cannot take a complaint to the FOS until you have a "final response" from the bank, or eight weeks have passed since you first complained. The pre-action letter starts that clock and creates the formal record you need.

Common Scam Types Covered by the PSR Rules

The mandatory reimbursement scheme covers APP fraud regardless of which scam type was used to deceive you. The most common categories:

What the Letter Cannot Do

It is worth being honest about the limits of the new rules and what a formal letter can achieve.

If you knowingly sent money to someone you suspected was a scammer — which is genuinely rare but does occur — a reimbursement claim is unlikely to succeed. The PSR framework is designed to protect people who were deceived, not people who took a known risk.

If a bank can demonstrate gross negligence — meaning you were warned explicitly about the specific risk and ignored those warnings, or your conduct was so far below a reasonable standard that it went beyond being deceived — they may be entitled to reduce or refuse reimbursement. This standard is deliberately high, and the FOS has scrutinised bank refusals on this basis carefully. Being deceived by a convincing scam does not, on its own, constitute gross negligence.

The letter also cannot recover money that has already been moved and dissipated beyond recall — but it can create the legal record that forces the bank to make good on its statutory obligation regardless.