Authorised Push Payment Fraud: The October 2024 Reimbursement Rules

Authorised Push Payment (APP) fraud happens when you are tricked into authorising a payment to a fraudster's account. Common types: investment scams (fake high-return crypto, gold, share schemes); romance scams (a "partner" online who needs money); purchase scams (paying for goods that never arrive); impersonation scams (someone pretending to be your bank, HMRC, or police asking you to "secure" your money in a new account); and CEO/payroll scams (fake email from your boss telling you to redirect a payment).

Unlike unauthorised fraud (where someone stole your password or card), APP fraud has historically had no statutory reimbursement scheme. Banks reimbursed voluntarily under the Contingent Reimbursement Model (CRM) Code from 2019, but inconsistently. The Financial Services and Markets Act 2023 gave the Payment Systems Regulator (PSR) power to make mandatory rules — and those rules came into force on 7 October 2024.

The PSR's rules (PSR/PS24/3, PSR/PS24/4) apply to most Faster Payments and CHAPS payments from a UK consumer account. The key features:

• Reimbursement up to £85,000 per claim. (Earlier consultation considered £415,000; £85,000 was the final figure.)
• 5-business-day decision window from when you report the fraud. The bank can ask for "Stop the Clock" if more investigation is needed, up to 35 business days.
• 50/50 cost split between sending and receiving banks. This gives both banks a strong incentive to prevent fraud — receiving banks must monitor their own accounts more carefully.
• £100 deductible (sometimes called an "excess") — the consumer bears the first £100 of any claim. Vulnerable customers are exempt.
• Exclusions: criminal first-party fraud (you knew it was fraud), claims after 13 months, payments to your own accounts at other banks, international payments (different rules apply to SEPA).

The PSR's Consumer Standard of Caution sets out the behaviours expected of consumers. A breach can lead to reduced or no reimbursement. The Standard requires you to:

• Have regard to specific warnings given by your bank during the payment journey (the "warning friction" most banks now show before high-value or new-payee payments).
• Promptly notify the bank when you realise you have been defrauded.
• Respond to information requests from your bank about the suspected fraud.
• Consent to the bank reporting the case to the police (this is automatic via the Action Fraud / National Fraud Intelligence Bureau system).

"Gross negligence" is the standard — much higher than ordinary carelessness. Falling for a sophisticated impersonation scam is not gross negligence. Ignoring a bright red warning that this exact payment is likely a scam might be. The Financial Ombudsman has consistently held that the bar is high.

Customers defined as "vulnerable" under the PSR's standards are protected from the gross negligence exception entirely — they get full reimbursement regardless. Vulnerability includes: physical or mental ill-health that affects financial decision-making; learning difficulties; bereavement; abusive relationships (coercive control fraud); recent significant life events (redundancy, divorce) that affect decision capacity; and language or literacy barriers that affect understanding bank warnings.

Tell your bank if any of these apply. Banks have a duty under FCA Consumer Duty (in force July 2023) to identify and support vulnerable customers — keep a written record of having flagged your vulnerability.

The process:

1. Tell your bank immediately — use the official fraud reporting channel (in-app, phone fraud team, or branch). Get a reference number. The 5-business-day clock starts from this report.
2. Report to Action Fraud at actionfraud.police.uk or 0300 123 2040 — this is also required.
3. Provide any information the bank requests — emails, screenshots, the fraudster's contact details, transaction references.
4. Wait for the decision — full reimbursement, partial (citing the £100 deductible or a specific behaviour), or refusal (citing first-party fraud, gross negligence, or out-of-scope).
5. If refused, escalate — formal complaint to the bank citing the PSR rules; if still refused, complaint to the Financial Ombudsman Service within 6 months of the bank's final response.
6. If the FOS upholds your claim, the bank must reimburse and may pay additional compensation for distress.

FOS decisions on PSR APP fraud cases consistently favour consumers where the bank refused on weak grounds. The bar for gross negligence is high — you only fail it if a reasonable person would have realised the payment was almost certainly fraud.