Bank fraud refunds: what are your rights?

Everything you need to know to help get your money back

Fraud is huge. It represents more than 40% of all reported crime and the impact can be devastating. Not just financially, but emotionally too. 

With fraud so rife, we’re going to go through your rights to give you the best chance of getting your money back. 

Some articles on the blog contain affiliate links, which provide a small commission to help fund the blog. However, they won’t affect the price you pay or the blog’s independence. Read more here.

The two types of fraud

Banks tend to split fraudulent transactions into two types – authorised and unauthorised. 

It’s important to know what fraud you’ve suffered as the refund rules are different for each.

Unauthorised fraud

This is where someone takes your money without you realising. For example, if someone stole your debit card and went on a spending spree, this would be considered as unauthorised fraud. 

Similarly fraudsters can access your banking details through data breaches or through scam texts and emails, that often look like they’re from legitimate sources, that encourage the receiver to click on a link and enter their information. These can then be used to access your accounts and steal your money.

Authorised fraud

If you’ve been the victim of authorised fraud – also known as an authorised push payment (APP) scam – it usually means you’ve been tricked into making a payment or handing over security details which enables the criminal to take money from your account. 

The scope is wide. With these scams, fraudsters often pose as legitimate authorities, such as HMRC, the police, solicitors, energy companies or your bank, to con people into transferring money to accounts they control. 

Fake HMRC staff have been known to threaten prison if money is not transferred for an ‘unpaid bill’, while bogus bank employees or police may tell you your account is under threat and you need to move the money to a ‘safe account’. 

Authorised fraud also covers lots of other types of scams. This includes purchase scams, where you’ve bought something from a fake website or by clicking on a bogus advert on social media that never arrives. 

Romance scams are another type, where victims are convinced to send money to someone they believe wants a relationship with them, and investment scams where you transfer money to buy investments that don’t exist. 

With authorised fraud, there’s usually some sort of deception involved and it can be really sophisticated and believable.

Will I get my money back?

It all depends on the type of fraud and the circumstances.

Unauthorised fraud

If you’ve been the victim of unauthorised fraud, you’re more likely to get your money back. In fact, 98% of people are refunded by their bank in these cases, according to UK Finance. 

You should be reimbursed as long as you haven’t acted fraudulently or with ‘gross negligence’. This is loosely defined as being beyond careless and could mean you’ve shared your PIN with someone else or left your passwords lying around.

You have 13 months to report unauthorised transactions. If your bank refuses to refund you, it must be able to prove you did something wrong. 

Authorised fraud

However, with authorised push payment scams, it’s a lot trickier. Just 62% of victims are reimbursed by their provider and the rules are a lot more complicated.

Before 28 May 2019, if you were tricked into transferring money to a fraudster, the banks were not obliged to refund you. They would argue as you made the payment, it was your responsibility. 

For years, campaign groups and media put pressure on the industry to change this. They argued that people were victims of sophisticated scams that even fraud experts would struggle to identify and that if banks were forced to reimburse customers they would invest more in preventative measures. 

Finally, a new code was introduced that promises to refund customers who’ve taken reasonable care to protect themselves. However, the code’s not particularly clear and there are a number of caveats. 

For example, customers will not be refunded if they ‘ignore effective warnings’. These pop up at different times in the payment journey, such as when you transfer money to a new payee – your bank may ask you the nature of the payment and if you are sure you know the recipient. 

However, there is no definition of ‘effective’ and some banks have better warnings than others. Fraudsters may also give really good reasons to why customers should ignore the warnings.

You’ll also not be refunded if you make a payment after getting a negative Confirmation of Payee result. This system matches up the account name and number to reassure customers they’re paying a genuine company or person. Not all providers are signed up to Confirmation of Payee and in those cases, you can still get a negative result with a legitimate recipient. 

However, the Payments System Regulator (PSR) is working with 400 providers who must introduce Confirmation of Payee by 31 October this year.

Another reason banks can deny reimbursement is if customers made the payment without a ‘reasonable’ basis for believing that the payee was who they were expecting to pay or the payment was for legitimate goods or to a genuine company.  

And if the bank decides you’ve been ‘grossly negligent’ it will also refuse to pay your money back. 

Issues with the code 

There are a few problems with the code that is why less than two-thirds of scam victims are being reimbursed. 

Firstly, the code is voluntary and not all providers have signed up – the current count is 21. These include:

• Bank of Scotland
• Barclays
• Britannia
• Cahoot
• Cater Allen Limited
• Co-op Bank
• First Direct
• Halifax
• HSBC
• Intelligent Finance
• Lloyds Bank
• M&S Bank
• Metro Bank
• Nationwide Building Society
• NatWest
• Royal Bank of Scotland 
• Santander
• Smile
• Starling Bank
• Ulster Bank
• Virgin Money

If you’re tricked into making a payment from one provider, who’s part of the code, to another who’s not, it becomes even more complex. 

TSB hasn’t joined the code, but instead launched its own Fraud Refund Guarantee in April 2019 and has reimbursed 91% of customers since then.

Secondly, the code is really vague and leaves a lot to interpretation. It means banks can take the payment instruction at face value rather than looking at the wider circumstances – such as customer vulnerability which should also cover whether they were in a vulnerable situation at the time. When a bank refuses to refund, it’s essentially holding the customer responsible. 

The way I see it, no one wants to lose their money to a scam and most people are incredibly careful with their money. So if they are tricked into making a payment to a fraudster, it’s because the criminal was extremely convincing and they shouldn’t be blamed or shamed for that. 

New reimbursement requirements

From 7 October 2024 there will be new rules that mean payment providers must reimburse scam victims. These measures will be mandatory and will cover almost 1,000 firms so we’ll hopefully see the refund rates improve. 

However, there are some things to be aware of with the new requirements. 

You won’t be refunded if you’ve acted fraudulently (obviously, but I want to make sure we’re all on the same page) or if you’ve been ‘grossly negligent’. The PSR assures there will be a high bar to this and vulnerable customers won’t be assessed under this exemption.

However, as per its ‘standard of caution’ customers should:

• Pay attention to interventions or scam warnings made by your bank or the police
• Report suspected scams or fraud ‘promptly’
• Share information with your bank
• Agree to your bank reporting the scam to the police

Where you don’t meet one or more of the above requirements, with gross negligence, your bank may not refund you. However, simply failing to meet one of these requirements is not enough of a reason for your bank to refuse reimbursement but it must look at the reason why and whether you were grossly negligent.

Credit unions, municipal banks and national savings banks are not covered by the new policy. 

What should I do if I think I’ve been scammed?

Report it to your bank immediately. 

If you dispute an unauthorised transaction the refund should be in your account by the end of the next working day.

If you think you’ve been tricked into making a payment or giving a fraudster your one-time passcode, contact your bank as soon as you can. 

If you have the account details of the recipient, you can check which bank they belong to using fasterpayments.org.uk/sort-code-checker. You should try and contact the recipient bank to try and stop your money leaving the account.

What can I do if the bank refuses to refund?

Make a complaint to your bank.

For unauthorised payments, the onus is on the bank to provide evidence that you were at fault. So ask them to prove it. 

With authorised push payment scams, try and reflect the points in the code. 

Explain what happened and why you think you were paying a legitimate person or company. What made it plausible? Did they know your personal information? Did their copycat website look identical to a real one? Did you get a text that appeared to come from your bank? Make it clear how sophisticated and believable this scam was. 

Consider whether your bank showed you any ‘effective warnings’. If they didn’t, include it in your complaint.

If you consider yourself vulnerable, you should say. Under the code, banks must take extra measures to protect vulnerable customers. 

Vulnerability isn’t defined in the code, but the FCA describes it as ‘Someone who, due to their personal circumstances, is especially susceptible to harm – particularly when a firm is not acting with appropriate levels of care.’ 

So, if you’re older, have health issues or are going through a stressful time such as a bereavement, divorce, new baby, job loss, you could be considered as such.

It may be that you’ve got an unusually large sum of money in your account – following a divorce or house sale – which makes you vulnerable too.If your bank still refuses to refund you following your complaint, your next step is the free Financial Ombudsman Service (FOS), which handles disputes between financial providers and customers.