New fraud refund rules: everything you need to know

There’s going to be some big changes to bank scam refunds

Millions of people in the UK are scammed every year – but not everyone gets their money back.

However, new rules being introduced this month promise to improve fraud prevention and give us all a better chance of getting our money back if we are tricked into sending money to criminals.

Some articles on the site contain affiliate links, which provide a small commission to help fund our work. However, they won’t affect the price you pay or our editorial independence. Read more here.

The new fraud reimbursement requirements

Under the new rules, from 7 October 2024 payment providers must reimburse customers (subject to certain requirements) when they fall victim to an ‘authorised push payment’ (APP) scam. 

APP fraud is when you’re convinced to transfer money under false pretences. It’s different from unauthorised fraud, where someone takes money from your account without you realising, which isn’t covered by these new rules. 

Common APP scams include fake bank staff calling customers and tricking them into moving their money into a ‘safe’ account or fraudsters posing as legitimate, including HMRC and utility firms, requesting payment.

The new measures are mandatory and will cover almost 1,000 firms. However, credit unions, municipal banks and national savings banks are not included.

Campaigners have been calling for better protection of scam victims for years. In May 2019, a voluntary code was introduced which was better than nothing – but didn’t go far enough. 

Just 23 providers signed up to the code and it left a lot to interpretation. As a result, the fraud refund rate was just 67% in 2023.

Can my bank refuse to refund me under the new rules?

Yes, it can – in certain circumstances.

You won’t be refunded if you’ve acted fraudulently – it goes without saying but I’m putting it out there, just in case –  or if you’ve been ‘grossly negligent’. The Payment Systems Regulator (PSR) assures there will be a high bar to what it considers ‘gross negligence’ – you’d have to have been significantly careless – and vulnerable customers will be exempt from this requirement. 

However, the new rules require you to be careful when making payments. So under the ‘Consumer Standard of Caution’ you should remember to:

• Pay attention to interventions or scam warnings made by your bank or the police
• Report suspected scams or fraud ‘promptly’ to your bank
• Share information with your bank when requested, to help the investigation
• Report the scam to the police or agree for your bank to do it 

Simply failing to meet these requirements is not enough of a reason for your bank to refuse reimbursement, but where you don’t meet one or more of the above requirements, with gross negligence, your bank doesn’t have to refund you. 

What payments are covered?

The new rules only apply to Faster Payments or CHAPS sent to an account in the UK.

So international payments, cash withdrawals, loans, and cheques won’t be covered. Neither will civil disputes – for example, if you buy something from a legitimate company that doesn’t show up – or payments made for unlawful purposes. But that won’t be you guys, obviously.

What’s the maximum refund amount?

The most you’ll be refunded is £85,000. Previously the top limit was £415,000, which is a huge difference.

The PSR says the reduced limit will cover 99% of cases. However, it still means hundreds of people will be losing life-changing amounts above that threshold with no chance of getting it back. 

This is especially the case with high-value scams such as investment fraud, where fake brokers convince you to transfer money for investments that don’t exist, and property purchase scams, where emails are intercepted between buyers and law firms, and the deposit is diverted to the fraudster, posing as the solicitor.

Will I be reimbursed fully?

Not necessarily. Banks and other payment providers are allowed to charge an £100 excess to each claim – although some are saying they’ll waive this.

TSB, Nationwide/Virgin Money, Clydesdale and Yorkshire Bank and AIB have said they won’t charge the £100 fee, while NatWest said it might.

Meanwhile Metro Bank, HSBC, First Direct, Lloyds, Halifax and Bank of Scotland plus smaller payment providers, Modulr and Zempler, have confirmed they will apply the £100 excess to scam victims. 

Barclays, Monzo, Starling, the Co-Operative Bank and Danske Bank have said they are yet to decide.

The PSR says this £100 excess won’t apply to vulnerable customers.

However, this excess is still controversial as £100 is a lot of money to many people. And if we look at last year’s fraud figures, 32% of scam losses were £100 or less meaning 58,000 people wouldn’t have been due any refund at all.

And if you lose more than £100, why should you then have to pay to get your money back?

When will I be refunded?

Your bank (the sending provider) must reimburse you within five business days after you report the scam. In some cases, where the case takes longer to resolve, the bank must make a decision whether to refund you within 35 days.

To reduce the uncertainty and worry, your bank should provide an initial indication of whether your claim falls within the scope of the new reimbursement requirement. This should happen at the time of the claim, where possible. 

Is there a time limit to make a claim?

Yes, you need to report the scam to your bank within 13 months or the bank could deny your claim.

This is something to be mindful of, especially in longer-term fraud, like some investment scams, which victims may not be aware of until it’s too late.

What about vulnerable customers?

Some vulnerable customers may be more susceptible to scams so under the Financial Conduct Authority’s (FCA) guidance, firms ‘should consider consumers’ vulnerability and capacity to make decisions when deciding how to treat consumers who have been victims of scams or fraud”.

A vulnerable customer, as per the FCA’s definition, is someone who “due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care”. 

The rules say that providers should assess each customer’s circumstances on a case-by-case basis to decide whether their vulnerability may have led them to be defrauded and whether they meet the definition. 

The definition of vulnerability is broad – so, if you’re older, have health issues or are going through a stressful time such as a bereavement, divorce, new baby or job loss, you could be considered as such.

It may be that you’ve got an unusually large sum of money in your account – following a divorce or house sale – which could make you vulnerable too.

What should I do if I think I’ve been scammed?

Report it to your bank – the one you used to make the payment – as quickly as possible. Remember, if it’s been longer than 13 months, your bank can refuse to assess your case under the new rules. 

You should also report the APP scam to the police, get a crime reference number and give it to your bank, if requested. 

Make sure you gather any evidence you have. This could include screenshots of the fake website, correspondence between yourself and the fraudster and other details that could be useful. 

For example, what made you think the person or company you were paying was legitimate? Did they know your personal information? Did their copycat website look identical to a real one? Did you get a text that appeared to come from your bank? 

What if my bank refuses to refund me under the new rules?

You can complain to the bank in the first instance, explaining why you think you should be reimbursed with regards to the new requirements. If you don’t get anywhere, you can contact the Financial Ombudsman Service, which handles disputes between customer and financial service providers, for free.