The cruellest kind of bank fraud is not the one where a criminal steals your card details. It is the one where they convince you to send the money yourself — to a builder who turns out not to exist, to a "bank security team" warning you that your account is compromised, to a partner you met online who needs help with a flight. You type in the sort code, you approve the transfer in your banking app, and the bank does exactly what you told it to. This is Authorised Push Payment fraud, and for years the maddening answer to "can I get my money back?" was, in effect, "you authorised it, so no".
That answer has changed. Since late 2024 the UK operates a mandatory reimbursement scheme for APP fraud, run under the Payment Systems Regulator, and it shifts the default from "tough luck" to "the banks pay you back" in most cases. The rules are real, they have teeth, and they are also more conditional than the headlines suggested — which is exactly why it is worth knowing where you stand before, not after, something goes wrong.
What the scheme actually covers
The reimbursement rules apply to APP scams where you were deceived into authorising a payment to a fraudster, sent over Faster Payments between two UK accounts. Crucially, the cost is split fifty-fifty between the bank that sent the money and the bank that received it — which gives the receiving bank, for the first time, a hard financial reason to shut down the "mule" accounts criminals use to collect stolen funds. That shared liability is the quiet structural change that makes the whole thing bite.
If you are caught by a convincing scam — a fake invoice from what looks like your solicitor mid-house-purchase, an "HMRC" caller, a too-good marketplace listing — and you transfer money in good faith, you are within the scope of the scheme. The starting assumption is now that you should be reimbursed, usually within five business days, sometimes with a short extension while the bank investigates.
The limits the headlines skipped
Two limits matter and both surprise people. First, there is a cap. The maximum mandatory reimbursement was set at £85,000 per claim — high enough to cover the overwhelming majority of scams, but a real ceiling for someone defrauded of, say, their entire house deposit in one transfer. If you are moving a very large sum, the protection is not unlimited, and that is worth holding in mind precisely at the moments — buying a property, paying a big contractor — when APP fraud is most likely to strike.
Second, banks are allowed to apply an excess of up to £100 per claim, which they can choose to charge or waive. So a £600 scam might be reimbursed at £500. The excess does not apply to customers classed as vulnerable, which is a deliberate carve-out — but for everyone else, expect that the first slice may be yours to bear.
Where reimbursement claims actually fail
This is the part that gets glossed over, and it is the part that decides real cases. Reimbursement is not automatic and not unconditional. The rules include a consumer standard of caution, and a bank can refuse or reduce a payout if you acted with what they call gross negligence. That is a high bar — ordinary carelessness is not enough, and the scheme is explicitly meant to protect people who were genuinely deceived — but it is not nothing.
In practice, claims run into trouble when the customer ignored a specific, clear warning from their own bank at the moment of payment. UK banks now show "Confirmation of Payee" name-check results and increasingly throw up scam warnings tailored to the payment type — a purchase scam alert, an impersonation warning. If your app told you in plain terms that the account name did not match and you pressed on regardless, or you were coached by a "fraud team" to ignore the warnings and you did, the bank has grounds to argue you fell below the standard. The lesson is uncomfortable but practical: when your banking app interrupts a transfer to warn you, that interruption is doing a job. Stop.
What to do the moment you realise
Speed is everything, because stolen money moves through mule accounts within minutes. The instant you suspect a scam, contact your bank — most now have a 159 short-code service that connects you safely to your bank's fraud line without you having to trust a number a caller gave you. Dialling 159 should be a reflex; it is built specifically so a panicked person cannot be redirected to the scammer. Report it, and the bank can try to freeze the receiving account before the funds are drained onward.
Then report the fraud to Action Fraud, keep every message and screenshot, and if your bank rejects or under-pays a reimbursement claim, take it to the Financial Ombudsman Service, which is free and can overturn the bank's decision. The Ombudsman has a long record of siding with deceived customers where the bank leaned too hard on the negligence argument. You are not at the bank's mercy on the final answer.
The protection is real, but prevention is still yours
It is genuinely good that the UK now treats a scammed transfer as something the banking system shares responsibility for, rather than a private misfortune. The fifty-fifty liability split, the five-day turnaround, the vulnerable-customer carve-out — these are meaningful, and they put pressure on exactly the receiving banks that used to wave mule accounts through. If you are defrauded, you have a real claim and a real route to escalate it.
But a reimbursed scam is still a horrible week of stress, a possible £100 excess, an £85,000 ceiling, and a negligence test you would rather not have to argue you passed. The cheapest version of this protection is the one where you never need it: treat any unexpected request to move money urgently as suspect, verify a new payee through a channel the other person did not give you, and when your own app stops you mid-transfer to ask if you are sure — read the warning before you tap through it.