Advanced: push payment scams and reimbursement.

When the victim presses send

In an authorised push payment (APP) scam, the customer is tricked into sending money themselves, usually by bank transfer, to an account the criminal controls. Because the customer authorised the payment, traditional fraud rules often left them to bear the loss: in the EU in 2024, customers bore about 85% of credit transfer fraud losses, against 38% for cards.

Common types, from the UK Payment Systems Regulator (PSR) and the FBI:

• Purchase scams: paying for goods or services that never arrive. The PSR found these were the most common type in UK data for 2023.
• Investment scams: fake investments, often in crypto-assets. In the PSR's 2023 data they were 6% of cases but 23% of losses. In the US, investment fraud was the largest category of losses reported to the FBI in 2025, at about US$8.6 billion.
• Romance scams: a fake relationship built over weeks, then requests for money.
• Impersonation scams: callers posing as the bank, police or a government body, telling the victim to move money to a "safe account".
• Invoice and business email compromise scams: a supplier's bank details changed by a criminal who has hijacked or imitated an email account.

How criminals reach victims. The PSR's December 2024 analysis found social media and messaging platforms involved in more than half of UK APP scam cases, while phone calls and texts were 12% of cases but over 31% of losses.

Why these scams are hard to stop. The payment is genuine in every technical sense: the right customer, on their own device, passing strong authentication. Detection has to rely on context: a new payee, an unusual amount, a customer under pressure, a receiving account that behaves like a mule. That is why recent rules focus on three things: name checks before payment, sharing the cost of losses, and involving the receiving bank and other sectors.

The UK mandatory reimbursement regime

From 7 October 2024, the PSR required payment firms to reimburse victims of APP scams made over Faster Payments and CHAPS. It replaced a voluntary industry code that had applied since May 2019, under powers given by the Financial Services and Markets Act 2023.

The main rules:

• Who is covered: individuals, microenterprises and charities, for UK-to-UK payments. Card, cash and cheque payments, unauthorised fraud and civil disputes are not covered.
• Maximum: £85,000 per claim. Firms may pay more. The PSR said this limit would fully cover 99.8% of Faster Payments APP scam claims by number and 90% by value. It had first proposed £415,000 but cut the limit before go-live.
• Cost sharing: the sending and receiving firms split the cost 50:50, giving the receiving firm a direct reason to stop mule accounts.
• Excess: firms may apply an optional excess of up to £100, but not to vulnerable consumers.
• Time limits: claims within 13 months of the last payment; firms must decide within 5 business days, or within 35 business days in total where they need more information.
• The consumer standard of caution: firms can refuse only if the customer, with gross negligence, failed to have regard to warnings from the firm or police, failed to report promptly, failed to respond to reasonable information requests, or did not consent to the matter being reported to the police. The PSR says gross negligence is a higher standard than ordinary negligence, needing a significant degree of carelessness. This exception never applies to vulnerable consumers, defined as people especially susceptible to harm because of their circumstances.

What happened. The PSR's reimbursement dashboard reported that from October 2024 to March 2026, 88% of money lost in in-scope cases, about £316 million, was returned; 82% of claims were closed within 5 business days and 98% within 35; and 3% were rejected for failing the consumer standard of caution. These figures cover Faster Payments only, come from sending firms and may be revised.

What is changing. In 2025 the government announced that the PSR would be merged into the Financial Conduct Authority, and that the reimbursement rules would carry over. As at October 2026, the legislation to do this was still before Parliament. Check the current position.

Name checks before payment

Many APP scams and honest mistakes have one thing in common: the name the customer thinks they are paying does not match the account. Checking the name before payment catches both.

UK: Confirmation of Payee. When a customer sets up a new payee or changes one, the bank checks the name against the account's sort code and number and tells the customer if it is a match, close match or no match, before any money is sent. The PSR first required the six largest banking groups, covering about 90% of transfers, to offer it by March 2020, then extended it to around 400 more firms in 2023 and 2024.

EU: Verification of Payee. The Instant Payments Regulation (EU) 2024/886 requires payment providers to check the payee's name against the account identifier immediately after the customer enters the details and before they authorise a credit transfer. If the name does not match, the payer must be warned that the money might go to an account not held by the intended payee; if it almost matches, the provider shows the actual name. The check is free, and the customer can still choose to pay. A provider that fails to carry out the check properly must refund the payer. It has applied since 9 October 2025 in the euro area and applies from 9 July 2027 in other EU states.

Global: FATF Recommendation 16. The FATF revised its standard on payment transparency in June 2025. For cross-border payments, the receiving institution must use at least one way to detect payments that may be going to the wrong person: checking that the beneficiary name and account in the payment message align with its records, ongoing risk-based monitoring, or a pre-payment check such as confirmation of payee where both sides take part. The FATF expects the changes to be in effect by the end of 2030. It describes fraud as now the leading source of criminal proceeds worldwide.

Limits. A name check stops misdirected payments and many impersonation scams, but not a scam where the victim knowingly pays the criminal's own named account, as in many investment and romance scams. It is one layer, not a cure.

Other countries, other models

Different countries are sharing scam losses in different ways.

Australia: the Scams Prevention Framework. The Scams Prevention Framework Act 2025 (assented 20 February 2025) sets principles for designated sectors on governance and on preventing, detecting, reporting, disrupting and responding to scams, with sector codes and dispute resolution. In May 2026 the government designated banking, telecommunications and key digital platforms, with firms to be ready by 31 March 2027. It is notable for placing duties on telecoms and platforms, not only banks. A government proposal to automatically reimburse some smaller verified losses was a policy position, not law, as at October 2026.

Singapore: the Shared Responsibility Framework. In force from 16 December 2024, it gives financial institutions and telecoms duties to counter phishing scams that lead to unauthorised transactions, with payouts if they breach those duties, the financial institution first and the telco second. It does not cover authorised scams such as investment or romance scams, so it is not an APP reimbursement scheme.

European Union: the payments reform. The EU reached provisional agreement in November 2025 on new payment rules. They include full refunds where a scammer impersonates a payment provider's employee and tricks a customer into approving a payment, if the customer reports to the police and the provider; treating payments initiated or changed by a fraudster as unauthorised; requiring receiving providers to freeze suspicious transactions; and making online platforms liable to providers that reimbursed customers if the platforms were told of fraudulent content and did not remove it. As at October 2026 they still needed formal adoption.

The trend. Responsibility is moving from the victim alone to a shared model: the sending bank, the receiving bank, and increasingly the telecoms and platforms through which criminals reach victims.

Running an APP scam programme

Whatever the rules in your country, the operational lessons are similar:

• Warnings at the moment of payment, specific to the payment's purpose. A customer paying a new payee for an "investment" should see a different warning from one paying a builder. The UK standard of caution depends on the warnings being meaningful.
• Name checks for every new or changed payee.
• Context-based detection: new payees, first large payments, payments after a new device or a password reset, and signs of coaching, such as a customer on the phone during the payment.
• Receiving-side controls: monitor incoming payments for mule patterns, freeze where allowed, and respond quickly to recall requests. Under the UK's 50:50 split, the receiving bank pays for missed mules.
• Fast cooperation between sending and receiving institutions, and with law enforcement.
• Fair claims handling: clear decisions within the deadlines, careful treatment of vulnerable customers, and reasons that a customer can understand.
• Measurement: reimbursement rates, time to decide, rejection reasons and repeat victims.

In Kenya: under the National Payment System Regulations, 2014, a transfer instruction cannot be revoked once the payee's provider receives it, unless the provider reverses it under its dispute resolution process. Providers must have a clear mechanism for complaints about loss of funds through fraud; customers must complain within 15 days, providers must resolve complaints within 30 days, and customers can appeal to the Central Bank. In 2026 Kenya's financial regulators published, for comment, a draft financial consumer protection framework that would let consumers verify the name of the intended beneficiary before paying where feasible, and would require providers to help reverse mistaken payments; the National Treasury and the Central Bank also published a draft National Payment System Bill. These were drafts as at October 2026; check the current law.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.