If your bank refuses to refund fraud

An unauthorised payment is one you did not make and did not consent to — a card used by someone who stole it, a transfer pushed through after a criminal captured your credentials, a payee added to your online banking by somebody who was not you. The governing law is the Payment Services Regulations 2017, and the structure of those regulations is unusually favourable to you.

An authorised push payment, or APP, is one you made yourself with your own credentials, because you were deceived about who you were paying or why. Fake invoices, safe-account scams, cloned investment platforms, romance fraud and purchase scams all sit here. Since 7 October 2024 these are covered by a mandatory reimbursement requirement imposed by the Payment Systems Regulator under section 72 of the Financial Services and Markets Act 2023.

A card purchase that went wrong — goods never delivered, a trader who took the money and vanished — is neither. It runs through the card scheme's chargeback process or, for credit card purchases over £100 and up to £30,000, through section 75 of the Consumer Credit Act 1974. Our guide to refund rights under the Consumer Rights Act covers that route in detail, and this page does not repeat it.

The boundaries are contested, which is exactly why banks argue about them. The Financial Ombudsman Service says openly that where you are not sure how the scammer tricked you, it can still look at the case — a specialist works out which rules apply. That is worth knowing, because a bank that has mislabelled your claim will not usually volunteer the correction.

One category matters more than most people realise: the ombudsman also has to decide whether what happened was a scam at all, or a civil dispute. If you paid a real, traceable business that then did the job badly or not at all, that is a contract dispute rather than fraud, and the reimbursement rules do not apply — though section 75, chargeback or the small claims court may.

Write your classification down at the start and use it in every letter. "This was an unauthorised transaction within the meaning of regulation 67 of the Payment Services Regulations 2017" is a different opening move from "I have been scammed", and it constrains what the bank can sensibly reply.

Regulation 75 of the Payment Services Regulations 2017 is the provision most refusal letters quietly ignore. Where you deny authorising a payment, it is for the payment service provider to prove that the transaction was authenticated, accurately recorded, entered in its accounts and not affected by a technical breakdown. You do not have to prove a negative.

The regulation goes further. It states that the use of a payment instrument recorded by the provider is not in itself necessarily sufficient to prove either that you authorised the transaction or that you acted fraudulently or with gross negligence. In plain terms: "the correct password was used" is not, on its own, an answer. If the bank alleges fraud or negligence on your part, regulation 75 requires it to provide supporting evidence to you.

Regulation 76 then sets the remedy and the clock. Where a payment was not authorised, the provider must refund it and restore the account to the state it would have been in, as soon as practicable and in any event no later than the end of the business day following the day it becomes aware of the unauthorised transaction. The credit must be value-dated no later than the date the money was debited, so you do not lose interest or trip an overdraft.

There is one carve-out from that deadline, and banks lean on it: it does not apply where the provider has reasonable grounds to suspect fraudulent behaviour and notifies the relevant authority under the Proceeds of Crime Act 2002. That is a real exception, but it is a suspicion of fraud by you, not a general licence to investigate slowly. Ask which it is.

Regulation 77 governs how much of the loss you can be made to carry. The default maximum is £35 where the loss results from a lost, stolen or misappropriated payment instrument. You become liable for all of the losses only where you acted fraudulently, or with intent or gross negligence failed to comply with your obligations under regulation 72 — using the instrument in accordance with its terms, and keeping personalised security credentials safe.

Regulation 77 also draws a hard line at the moment you tell the bank. After you notify under regulation 72(1)(b), you are not liable for any losses at all, unless you have acted fraudulently. If money left your account after your call, note the timestamps: that portion of the loss is not arguable.

Finally, regulation 74 sets your own deadline. You must notify the provider without undue delay and in any event no later than 13 months after the debit date. The exception is where the provider failed to give you the transaction information Part 6 of the Regulations requires — if you were never told the payment happened, the 13 months does not simply run out on you.

If you made the payment yourself, the Payment Systems Regulator's reimbursement requirement is what you are arguing about. It applies to payments made on or after 7 October 2024 over Faster Payments or CHAPS between UK accounts, and it covers individuals, micro-enterprises and charities with an annual income of less than £1 million. Banks, building societies and e-money firms are all in scope; credit unions, municipal banks and national savings banks are not.

The mechanics are tight. You must report to your bank as soon as possible and within 13 months of the fraudulent payment. The firm must reimburse within five business days. If it needs more information it may stop the clock, but it must reach a final decision within 35 business days. The standard maximum is £85,000 per claim, though a firm may choose to pay more, and the cost is shared 50:50 between the sending and receiving firms — which is why receiving banks now care about who opens accounts with them.

There are four routes out for the firm, and a refusal will be resting on one of them. First, scope: the payment was not over Faster Payments or CHAPS, was international, was made before 7 October 2024, or was between your own accounts. Second, it was not fraud but a civil dispute. Third, the consumer standard of caution exception — the claim that you did not take enough care. Fourth, that you were complicit in the fraud, or grossly negligent.

The excess is separate and smaller than people fear. A firm may apply an excess of up to £100, may set it lower, and may waive it entirely. It cannot apply it to a vulnerable consumer. Neither can it apply the gross negligence or standard-of-caution exception to a vulnerable consumer — that protection is absolute, and it is the reason to tell the bank in writing about ill health, bereavement, a recent diagnosis, low financial capability or anything else that made you more susceptible.

Payments outside the requirement are not automatically hopeless. The ombudsman says plainly that you can still bring the complaint, and it will look at whether the bank should have suspected you were being scammed and done more — whether the payment was out of pattern, whether a warning was shown, whether Confirmation of Payee flagged a name mismatch, whether a human being should have intervened. That is a fairness question, not a rules question, and it survives the scope limits.

One trap worth naming: the "me-to-me" payment, where you moved money into an account in your own name — often a crypto exchange — before the criminal took it. The ombudsman lists this expressly as a scam pattern it sees, and the PSR has said it will consider the treatment of me-to-me transactions in its next consultation. A refusal that treats the first hop as an ordinary transfer between your own accounts is arguable.

Know the numbers you are being measured against. Across the first 18 months of the regime, to 31 March 2026, the PSR recorded 88 per cent of money lost to in-scope APP scams — £316 million — reimbursed to victims, 82 per cent of claims closed within five business days and 98 per cent within 35, and only around 3 per cent of claims rejected because the customer did not take enough care. If you are in that 3 per cent, you are in a small and unusual group.

Phone calls are not evidence. Ask for the refusal in writing and ask for it to identify the specific ground relied on — the exception under the reimbursement rules, or the regulation under the Payment Services Regulations 2017. A letter that says only "we have decided not to reimburse you" has not done that, and saying so restarts the conversation on your terms.

Ask what supporting evidence the bank relies on for any allegation of gross negligence or insufficient caution. Regulation 75 obliges it to provide that evidence where it alleges fraud or negligence in an unauthorised claim, and there is no good reason for a firm to withhold it in an APP claim either. Vague characterisations of your conduct are not evidence.

Ask for the operational record: the exact time you first reported it, what action was taken to attempt a recall of funds and when, whether the receiving bank responded, how much of the money was still sitting in the beneficiary account, and whether any of it was recovered. Firms frequently refuse reimbursement while sitting on a partial recovery.

Ask what warnings you were shown and when, in what form, and whether a Confirmation of Payee check was run and what it returned. If the bank is going to argue that you ignored a warning, it has to be able to produce the warning. If it argues that the name did not match, that cuts both ways — a firm that saw a mismatch and let the payment run has its own questions to answer.

If the bank will not produce documents voluntarily, use a subject access request under the UK GDPR. You are entitled to the personal data the firm holds about you, which in practice reaches call recordings, fraud-team case notes, transaction logs and the internal rationale recorded against your claim. It is free, the response deadline is one month, and our guide to making a subject access request sets out the wording.

Keep everything in one chronological file as you go: dates, times, reference numbers, names, screenshots of the scammer's messages, bank statements, and your own note of what you were told on each call. The ombudsman will ask for correspondence with the scammer, a detailed description of events, contracts and invoices, and in some cases older statements to understand the source of the funds. Assembling that after a refusal is far harder than assembling it as you go.

Start with the standard itself, because it is much higher than banks imply. The Financial Ombudsman Service defines gross negligence as much more than not being careful: it means you acted extremely carelessly, or gave the details away on purpose. Ordinary carelessness, being busy, being tired, being trusting or being persuaded by a convincing story does not reach it.

The most effective rebuttal is usually a detailed account of the manipulation, not a defence of your own care. Set out the sequence: the spoofed number that displayed your bank's real name, the caller who knew your last three transactions, the instruction not to discuss it with branch staff because the investigation was confidential, the time pressure, the fake case reference. The ombudsman explicitly weighs how you may have been manipulated into sharing information.

Evidence beats assertion. Call logs showing the inbound number, screenshots of the text thread that appeared in the same conversation as genuine bank messages, the cloned website URL, the fake FCA registration the criminal quoted, the letterhead on a fraudulent invoice — each of these converts "I was careless" into "this was a professionally constructed deception."

Deal with the warnings directly rather than hoping they are not raised. If a warning was generic, appeared after you had already been coached to expect it, or was contradicted by something a member of staff said on the phone, say so. A bank arguing that a warning was effective has to show it was specific and that it was capable of interrupting the story you were being told.

Raise vulnerability early, in writing, and be specific. The exception cannot be applied to a vulnerable consumer at all, so this is not a plea in mitigation — it removes the ground the bank is standing on. Bereavement, serious illness, a recent diagnosis, caring responsibilities, a mental health crisis, English as an additional language, or simple isolation are all relevant, and the firm has to consider them.

Finally, put the bank's own conduct in issue. Was the payment wildly out of pattern for the account? Was it the first payment to a new payee for a large sum? Did the account holder call to ask a question and receive reassurance? A firm that did not intervene where intervention was obviously warranted has weakened its own case, and this is the ground on which the ombudsman most often finds for consumers even where the strict rules do not apply.

This is the most commonly misstated deadline in UK consumer finance, and getting it right buys you weeks. Under the Financial Conduct Authority's complaints rules in DISP 1.6, the general deadline for a final response is eight weeks — but complaints about payment services and electronic money run to a shorter timetable of 15 business days, extended to 35 business days only where exceptional circumstances beyond the firm's control require a holding response first.

The Financial Ombudsman Service states it in the same terms: for most complaints a business has up to eight weeks, but only 15 days for complaints about fraud and scams, payment services such as bank transfers or direct debits, and electronic money including online transfers, Apple Pay and travel money cards. A fraud refund complaint is squarely in the shorter category.

Make the complaint explicitly a complaint. Firms distinguish internally between a query and a formal complaint, and only the latter is logged, tracked and reported to the regulator. Use the word, ask for a complaint reference number, and state that you expect a final response within 15 business days as required by DISP 1.6.

The final response letter is the document that unlocks everything else. Under the FCA's rules it must accept the complaint and offer redress, offer remedial action, or reject it with reasons — and it must tell you that you may refer the matter to the Financial Ombudsman Service. Read it closely and keep it. The ombudsman will ask to see it.

If the deadline passes with no final response, you do not have to wait. The right to refer arises either when you receive a final response you are unhappy with, or when the firm has had the time it is allowed and has not replied. Both the FCA and the ombudsman say so, and a firm that lets the clock run has handed you the escalation without an argument.

The Financial Ombudsman Service is free, and it is designed to be used without a lawyer. It says so directly: you do not need to pay anyone to represent you, including a claims management company. A CMC will take a percentage of a recovery you could have obtained yourself, and the ombudsman even asks you not to lean on AI-drafted legal argument, because what helps its investigators most is your own account of what happened in your own words.

Submit through the online complaint form. You will be asked what happened, which firm you are complaining about, what you have already done and what outcome you want, and the case is set up within about seven days with a reference number and a named investigator.

Send the evidence the ombudsman has told you it wants. For a scam where you were tricked into paying: all correspondence with the scammer in every format, a detailed chronology, any contracts or invoices, older bank statements where the source of funds matters, whether anyone else's money was involved, and what was said if you spoke to anyone at the bank at the time. For an unauthorised payment or identity theft: how you became aware money had gone, and whether any identity documents went missing and how you discovered it.

Understand what the ombudsman is weighing. It decides on the evidence from you, the firm and any third party, and it considers the relevant law, the regulations that applied at the time, any industry codes of conduct in force at the time, and the account terms. For a disputed unauthorised payment it asks whether you made the payment at all and, if not, whether you acted with gross negligence.

Expect a two-stage process. An investigator reviews the case and issues a view; the ombudsman aims to answer within 90 days, and to resolve 90 per cent of cases within six months of accepting them. Most cases settle at the investigator stage. If either side rejects the view, an ombudsman reviews it and issues a final decision.

The remedies are broader than a refund. The ombudsman can direct the firm to put you back in the position you would have been in, with interest, and can make a separate award for distress and inconvenience. Under DISP 3.7 a money award may cover financial loss including consequential loss, pain and suffering, damage to reputation, and distress or inconvenience, whether or not a court would award it.

The award limits are index-linked and rise each April. For complaints referred on or after 1 April 2026, the maximum money award is £455,000 where the act or omission occurred on or after 1 April 2019, and £205,000 where it occurred before that date. A final decision binds the firm if you accept it. It does not bind you — reject it, and your right to sue is intact.

Watch the six-month deadline above all others. Under DISP 2.8 the ombudsman cannot normally consider a complaint referred more than six months after the date the firm sent its final response, nor more than six years after the event complained of, or three years from when you became aware — or ought reasonably to have become aware — that you had cause for complaint. Letting a final response sit in a drawer is the most common way a good case dies.

There are two exits from those limits. The ombudsman may still look at a late complaint where the failure to comply was the result of exceptional circumstances, and it may look at one where the firm consents to it being considered — and a firm that has consented cannot later withdraw that consent. Serious illness or bereavement during the window is the classic exceptional circumstance, and it is worth arguing rather than assuming.

If the ombudsman route is genuinely gone, the courts remain. In England and Wales the small claims track handles most consumer disputes up to £10,000 without lawyers, and Money Claim Online files in about twenty minutes; Scotland uses the simple procedure through the sheriff court, and Northern Ireland has its own small claims process through the county court. Our guide to the small claims court sets out the mechanics.

Report the crime as well as pursuing the money, because banks, insurers and credit reference agencies routinely ask for a crime reference number. In England, Wales and Northern Ireland that is Report Fraud, the national reporting centre operated by City of London Police, on 0300 123 2040. In Scotland, fraud goes to Police Scotland on 101. Reporting does not recover funds — the ombudsman is explicit that solving the crime is a police matter and the complaint is about how the firm behaved — but the reference number unlocks other doors.

The old voluntary regime is genuinely gone, which matters if you are reading older advice. The Contingent Reimbursement Model Code, which ran from May 2019 to October 2024, was overseen by the Lending Standards Board, and the LSB itself wound up in 2025 after providing independent oversight of the sector from 2009. If a bank is applying CRM Code reasoning to a payment made after 7 October 2024, that is a point to take.

The rules are under active review, so check before you rely on a figure. Frontier Economics published an independent evaluation of the APP scams policies in July 2026, and the Payment Systems Regulator has confirmed it will consult formally in December 2026 on, among other things, the treatment of claims that cannot be resolved within 35 business days, guidance on the consumer standard of caution, civil disputes, me-to-me transactions and the 13-month reporting requirement, with a decision and revised legal directions expected in May 2027.