Recovering Money Lost to Online Fraud

Authorised Push Payment (APP) fraud occurs when you are deceived into authorising a bank transfer to a fraudster — for example, by a fake invoice, impersonation of your bank, or a romance scam. From October 2024, the Payment Systems Regulator's mandatory reimbursement scheme requires:

• Your bank (the sending bank) must reimburse you for most APP fraud losses up to a maximum of £85,000 within 5 business days of your claim being assessed.
• Banks can apply a maximum excess of £100 — meaning the first £100 of any loss may not be reimbursed. Vulnerable customers are exempt from the excess.
• The sending bank recovers 50% of reimbursed funds from the receiving bank (where the fraudster's account was held), incentivising both banks to prevent fraud.
• Banks can refuse reimbursement where the victim acted fraudulently or with gross negligence — a high bar that requires the victim to have taken an exceptional and unreasonable level of risk.

If you realise you have been the victim of online fraud:

1. Contact your bank immediately on their fraud line (usually a 24-hour line on the back of your card). Ask them to recall the payment and freeze any remaining funds. Speed is critical — many fraudsters move money within minutes.
2. Report to Action Fraud at actionfraud.police.uk or 0300 123 2040. Get a crime reference number — you will need this for your bank claim and any insurance claim.
3. Preserve all evidence: Screenshots of emails, messages, websites, payment confirmations, and any other communications with the fraudster.
4. Do not engage further with the fraudster — do not make additional payments or provide more personal data.
5. If you were tricked into downloading remote access software, run a security scan on your device and change all passwords from a different device.

To claim reimbursement from your bank:

1. Submit a formal APP fraud claim to your bank's fraud team in writing (email or online form), including your crime reference number, details of the payment(s), and all available evidence of the fraud.
2. Your bank must assess your claim within 5 business days (or 35 business days in complex cases, with notification). They must either reimburse you or give reasons for refusal.
3. If your bank refuses your claim or offers less than you believe you are entitled to, you can escalate to the Financial Ombudsman Service (FOS) — the FOS resolves bank disputes free of charge and can order reimbursement.

Keep records of all communications with your bank about the fraud claim, including the dates and names of any call handlers.

Unauthorised fraud — where a fraudster uses your payment details without your authorisation (e.g., card cloning, account takeover, SIM swap fraud) — is subject to different rules. Under the Payment Services Regulations 2017 and the FCA's rules:

• Your maximum liability for unauthorised fraud is £35 where your card was used without a PIN or biometric authentication (unless you acted fraudulently or with gross negligence).
• Your liability is £0 for unauthorised transactions made after you notified your bank of the loss or theft of your card.
• Banks must reimburse unauthorised transactions within one business day of a valid report, pending investigation.

If your bank disputes liability and you believe the transaction was genuinely unauthorised, escalate to the FOS. SIM swap fraud is particularly complex — report to your mobile network as well as your bank.