Most fraud rules were written for payments the customer did not make. A stolen card, a hijacked account: the customer never agreed, so the customer is refunded. Authorised push payment scams break that logic. The customer is tricked, but the customer presses send. For years that meant the customer carried the loss. That is now changing, and the change reaches well beyond the UK.

The fraud that passes every check

In an authorised push payment (APP) scam, a criminal persuades someone to transfer money, usually by bank transfer, to an account the criminal controls. The criminal might pose as the bank's fraud team, a builder, a romantic partner or an investment adviser.

From the payment system's point of view, nothing is wrong. The right customer, on their own phone, passes strong authentication and sends a payment they meant to send. That is why the losses fall so differently. When a card is stolen, the customer is usually refunded. When a customer is tricked into sending a transfer, the customer has often carried the loss alone.

It is also why APP scams are growing as other fraud gets harder. The FATF now describes fraud as the leading source of criminal proceeds worldwide. In the US, investment fraud was the largest category of losses reported to the FBI in 2025, at about US$8.6 billion.

The UK experiment: make the banks pay

Since 7 October 2024, UK payment firms must reimburse victims of APP scams sent over Faster Payments and CHAPS. Three choices in the design matter most.

  • Reimbursement is the default. Individuals, microenterprises and charities are covered up to £85,000 per claim. A firm can refuse only if the customer was grossly negligent, a deliberately high bar, and never if the customer is vulnerable.
  • The cost is split 50:50 between the sending and the receiving firm. Before, the receiving bank, whose account the criminal used, paid nothing. Now it pays half, which gives it a direct reason to find and close mule accounts.
  • Decisions are fast. Firms must normally decide within 5 business days.

The results so far are striking. The Payment Systems Regulator's dashboard reports that from October 2024 to March 2026, 88% of money lost in cases the rules cover, about £316 million, was returned. 82% of claims were closed within 5 business days, and only 3% were rejected for gross negligence. These figures cover Faster Payments only, come from the sending firms and may be revised.

When the bank that received the money pays half the loss, finding mule accounts stops being someone else's problem.

Checking the name before the money moves

Many scams, and many honest mistakes, share one feature: the name the customer thinks they are paying does not match the account. A name check before payment catches both.

  • UK: Confirmation of Payee. When a customer adds or changes a payee, the bank checks the name against the account and reports a match, a close match or no match before any money moves.
  • EU: Verification of Payee. Under the Instant Payments Regulation, payment providers must check the payee's name before the customer authorises a credit transfer, free of charge. It has applied in the euro area since 9 October 2025 and applies from 9 July 2027 in other EU states.
  • Global: FATF Recommendation 16. Revised in June 2025, it requires the institution receiving a cross-border payment to use at least one way of spotting payments that may be going to the wrong person, such as checking that the name and account align. The FATF expects this in effect by the end of 2030.

A name check is one layer, not a cure. It stops misdirected payments and many impersonation scams, but not a scam where the victim knowingly pays an account in the criminal's own name, as in many investment and romance scams.

Responsibility for push payment scam losses is moving from the victim alone to a shared model: the sending bank, the receiving bank, and increasingly the telecoms and online platforms through which criminals reach victims. WHO CARRIES THE LOSS The victimthe old default Sending bankwarnings · name checks Receiving bankmule accounts Telecomscalls · texts Platformssocial · messaging FROM THE VICTIM ALONE TO EVERYONE IN THE CHAIN
The trend across the UK, the EU, Australia and Singapore: each party in the chain carries part of the duty.

Beyond the banks

The UK regulator found that social media and messaging platforms were involved in more than half of UK APP scam cases, and phone calls and texts in 12% of cases but over 31% of losses. Banks see the payment. They do not see the conversation that led to it.

Other countries are starting to share the duty more widely:

  • Australia's Scams Prevention Framework Act 2025 places duties to prevent, detect, report, disrupt and respond to scams on designated sectors. In May 2026 the government designated banking, telecommunications and key digital platforms, with firms to be ready by 31 March 2027.
  • Singapore's Shared Responsibility Framework, in force since December 2024, gives banks and telecoms duties against phishing scams. It covers unauthorised transactions, so it is not an APP reimbursement scheme, but it puts telecoms in the chain.
  • The EU reached provisional agreement in November 2025 on payment rules that include full refunds for some bank-impersonation scams and liability for online platforms that leave reported fraudulent content up. As at October 2026 these still needed formal adoption.

What it means for a payments business

Whatever a country's rules say today, the direction is clear, and the operational lessons are the same:

  1. Warn at the moment of payment, and make it specific. A customer paying a new payee for an "investment" needs a different warning from one paying a plumber. Generic warnings are easy to ignore, and under the UK rules a refusal depends on the warning having been meaningful.
  2. Check the name on every new or changed payee.
  3. Detect on context, not credentials. The login is genuine, so look at what is unusual: a new payee, a first large payment, a payment soon after a new device or password reset, a customer who seems to be on the phone while paying.
  4. Watch what arrives, not only what leaves. Accounts that receive many unrelated payments and empty quickly look like mules. Freeze where the law allows, and answer recall requests fast.
  5. Decide claims fairly and quickly, with reasons the customer can understand and particular care for vulnerable customers.
  6. Measure it: how much is reimbursed, how fast, why claims are refused, and how many customers are scammed twice.

In Kenya, the National Payment System Regulations, 2014 make a transfer instruction generally irrevocable once the payee's provider receives it, unless reversed under the provider's dispute process. In 2026 Kenya's financial regulators published, for comment, a draft consumer protection framework that would let consumers verify the beneficiary's name before paying where feasible, and would require providers to help reverse mistaken payments. These were drafts as at October 2026.

Our free course Authorised Push Payment Scams and Reimbursement covers the UK rules, name checks and the other models in depth, with a knowledge check and a certificate.

Sources