Bank Refused to Refund Fraud Authorised Push Payment UK: Your Rights 2026

In July 2026, the Payment Systems Regulator published a landmark independent report revealing that the UK's mandatory authorised push payment (APP) fraud reimbursement rules, now in force for nearly two years, have cut fraud losses by an estimated £73 million per year. Yet the report also flagged a critical gap: victims are still being left out of pocket because banks are not consistently applying these rules.

If you've been the victim of APP fraud - where you were tricked into transferring money to a scammer - and your bank has refused to refund you, you need to know this: you have legal rights, and a bank's first refusal is rarely the end of the matter. Under rules that came into force on 7 October 2024, your bank is now legally required to reimburse you for APP fraud losses, up to £85,000, unless you acted with gross negligence. This guide walks you through those rights, what "gross negligence" actually means in law, and the steps to take when your bank says no.

Understanding Your Legal Rights: The APP Fraud Reimbursement Rules

Authorised push payment fraud is one of the fastest-growing financial crimes in the UK. Unlike card fraud, where a criminal uses your card without permission, APP fraud happens when you are deliberately deceived into authorising the payment yourself. You might be impersonated as your bank, tricked in a romance scam, or convinced you're paying a legitimate business or service. The money leaves your account with your apparent consent - but that consent was obtained through deception.

For decades, victims had almost no protection. Banks argued the money had been sent by the account holder, so the transaction was "authorised" - even though it was authorised by a lie. That changed on 7 October 2024, when mandatory reimbursement rules came into force, replacing the voluntary Contingent Reimbursement Model (CRM) Code that only some banks had subscribed to.

The Legal Framework: Payment Systems Regulator Rules

The Payment Systems Regulator (PSR), which oversees Faster Payments System (FPS) - the mechanism used for most UK bank transfers - introduced legally binding rules requiring all payment service providers (PSPs) that send or receive payments via FPS to reimburse customers who fall victim to APP fraud. This is not optional; it's a regulatory requirement.

The rule applies to:

• Individuals (all bank customers)
• Microenterprises (businesses with fewer than 10 employees and annual turnover under €2 million)
• Charities

If you fall into any of these categories and you were the victim of APP fraud on or after 7 October 2024, your bank is legally obliged to reimburse you - subject to specific exceptions explained below.

Maximum Reimbursement: £85,000 per Claim

The maximum amount your bank must reimburse you is £85,000. This limit applies regardless of whether you are a vulnerable consumer. However, there is no minimum claim amount; even if you lost £50, your bank should reimburse it (though may charge an excess, see below).

The 50:50 Split Between Banks

The reimbursement cost is split 50:50 between the sending PSP (your bank) and the receiving PSP (the scammer's bank). This arrangement creates an incentive for both banks to implement fraud prevention measures. Your sending bank cannot simply pass the full cost back to you; they must absorb 50% of the loss (minus the excess they've charged you).

The Excess: Up to £100 (Sometimes Waived)

Your sending bank may charge you an excess of up to £100 per claim. However, this excess is waived for vulnerable consumers. The PSR defines a vulnerable consumer as someone who, due to personal circumstances such as age, health, disability, or lack of financial literacy, is particularly susceptible to fraud.

If your bank has charged you the full £100 excess but you consider yourself vulnerable, this is a ground for complaint.

When Can Your Bank Legally Refuse to Refund APP Fraud?

Your bank can only refuse reimbursement if one of these conditions applies:

1. You Acted Fraudulently

If you knowingly participated in a scheme to defraud your own bank or another party, reimbursement can be refused. This is rare and would require clear evidence of your deliberate dishonesty.

2. You Acted With Gross Negligence

This is the key exception your bank will cite. But "gross negligence" has a strict legal definition. It is not mere carelessness or failing to spot a convincing scam. Gross negligence means such a high degree of negligence that it amounts to recklessness - a deliberate disregard of the risks involved.

The PSR's guidance sets out a "Consumer Standard of Caution" that you must meet to qualify for reimbursement:

1. Heed warnings: If your bank or the police issued a clear warning that the intended payment was likely a scam, and you ignored it, you may fall short of the standard. However, vague warnings or pop-ups that don't specifically identify the risk will not count against you.
2. Report promptly: Once you realised (or should have realised) you were a victim, you had to report it to your bank. The absolute deadline is 13 months from the last fraudulent payment. If you report after 13 months, reimbursement can be refused - though your bank should still investigate, and if they could have prevented the fraud with better controls, they may still be liable.
3. Share information: When your bank asks for information to investigate your claim, you must provide it. Refusing to cooperate can result in a refusal of reimbursement.
4. Manage credentials securely: You should not have written down your PIN, shared your passwords, or left your phone unattended in circumstances that made fraud likely. However, merely being fooled by a convincing impersonation is not negligence.

The critical point: being deceived by a scam is not gross negligence. Scammers are sophisticated; they impersonate banks, use social engineering, and exploit human psychology. The standard recognises this. To refuse reimbursement on grounds of gross negligence, your bank must show you acted in a way that betrayed a reckless disregard for your own security - not that you simply fell for a convincing lie.

How Many Victims Are Getting Reimbursed? The Latest Data

Since the mandatory rules began on 7 October 2024, the scheme has recovered substantial sums for victims. Over the 18 months from October 2024 to March 2026, £316 million (88% of losses) was reimbursed to victims across approximately 301,500 eligible claims. That's a massive improvement on the 61% reimbursement rate in 2024 under the voluntary system.

In Q1 2026 alone, reimbursement reached £72.6 million - the highest quarterly figure since the rules began. The PSR estimates that these mandatory rules have reduced annual APP fraud losses by an estimated £73 million per year and prevented an estimated 34,800 fraud cases annually through improved bank controls.

However, the PSR's July 2026 report warned that banks are not consistently applying the rules. Some are rejecting valid claims, delaying responses, or charging inappropriate excesses. This is why understanding your rights and escalating a refusal is so important.

Step-by-Step Guide: How to Claim When Your Bank Refuses Refund

Step 1: Check You Are Within the 13-Month Reporting Window

You must report the fraud to your bank within 13 months of the last fraudulent payment. If more than 13 months have passed, your bank can refuse reimbursement on the grounds that you failed to report promptly. However, if you did report within 13 months, your bank must continue to investigate even if they're slow to respond.

If you reported within 13 months but your bank is now claiming you've missed a deadline, push back: the 13-month clock starts from the last fraudulent payment, not from when you first realised you were a victim.

Step 2: Gather Evidence of the Scam and Your Bank's Initial Refusal

Collect:

• Screenshots or records of all communications with the scammer (emails, texts, phone records, social media messages)
• Bank statements showing all fraudulent transactions
• Your bank's refusal letter or email, including the reason for refusal
• Any warnings or alerts your bank sent you before the fraud (to assess whether you ignored them)
• Evidence of when you first reported the fraud to your bank (emails, call logs, in-branch records)
• A detailed timeline of the scam: when you were first contacted, how the fraud escalated, when you realised it was a scam

Step 3: Assess Your Bank's Stated Reason for Refusal

Your bank's initial refusal letter should explain why they're refusing. Common (often invalid) reasons include:

• "You authorised the payment, so it's not fraud" - This is wrong under current law. The rules specifically cover authorised push payments.
• "You were negligent" - They must prove gross negligence, not mere carelessness. Were you specifically warned and ignored it? Did you deliberately ignore security advice?
• "You didn't report promptly" - Check you reported within 13 months. If you did, this is not valid.
• "The money can't be recovered" - This may be true, but it's not grounds for refusing reimbursement under the rules. The bank must still pay you (and they recoup 50% from the receiving bank).

If your bank's reason doesn't fit the legal exceptions (fraud, gross negligence, failure to report within 13 months, or failure to cooperate with investigation), their refusal is likely invalid.

Step 4: Escalate Within Your Bank: Formal Complaint

You have the right to escalate your case within the bank. Write a formal written complaint to the bank's complaints department (not to customer service). Your complaint should:

1. Reference the rules: "Under the Payment Systems Regulator's mandatory APP fraud reimbursement rules, which came into force on 7 October 2024, I am entitled to reimbursement of up to £85,000 unless I acted fraudulently or with gross negligence."
2. Challenge their stated reason: "Your refusal letter states [reason]. However, [explain why this reason does not meet the legal standard for refusal]. I did not act with gross negligence, and I reported the fraud within the 13-month deadline."
3. Request a substantive review: Ask the bank to review the decision with reference to the PSR rules, not just their internal policies.
4. Set a deadline: Ask for a substantive response within 15 business days (the standard for fraud claims).

You can use Paybacker's AI complaints tool to generate a formal complaint letter in 30 seconds, citing the exact legislation and regulatory framework. This removes the guesswork and ensures your complaint meets the legal standard.

Step 5: Escalate to the Financial Ombudsman Service (FOS)

If your bank maintains their refusal after your formal complaint, you can escalate to the Financial Ombudsman Service (FOS). The FOS is the independent arbiter for complaints against UK banks and is free to use.

Important deadline: You must refer your case to the FOS within 6 months of the bank's final response letter. If you miss this deadline, you lose the right to escalate (unless the bank has failed to issue a final response, in which case the 6-month clock hasn't started).

How to contact the FOS:

• Phone: 0800 023 4567 (free)
• Online: www.financial-ombudsman.org.uk
• Post: Financial Ombudsman Service, Exchange Tower, London E14 9SR

When you contact the FOS, explain:

• You were the victim of APP fraud
• Your bank has refused to reimburse you under the PSR rules
• You believe the refusal is unfounded because [reason]
• You've already complained to the bank and they've refused

The FOS will ask the bank to respond. If the bank's response is still unsatisfactory, the FOS will investigate and make a determination. The FOS can order the bank to reimburse you in full, minus any valid excess, plus interest and compensation for distress caused.

What If The FOS Sides With Your Bank? Small Claims Court

If the FOS upholds the bank's refusal, you have one more option: small claims court. This is a last resort and should only be considered if you believe the bank has fundamentally misapplied the law.

To pursue a small claims case:

1. You'll need to issue a claim in your local county court (or the Money Claims Online portal, if the amount is under £100,000)
2. The case will be fast-tracked and cost-effective
3. You must prove, on the balance of probabilities, that the bank's refusal breached the PSR rules or the Payment Services Regulations 2017 (which implement the PSR rules into law)
4. If you win, the court can order the bank to pay reimbursement plus interest and costs

Many consumers find that the threat of a court case, backed by legal advice, is enough to prompt a bank to reconsider. Once you've escalated to the FOS and they've made a determination, you have strong grounds for a court claim if the FOS decision is in your favour.

Real-World Scenarios: Will Your Claim Be Refused?

Scenario 1: Romance Scam
You met someone online who built a relationship with you over weeks, then asked you to transfer £5,000 "to prove your commitment." You did. Later, you discovered they were a scammer. Your bank refused, saying you "should have been more careful." Likely outcome: Your claim should be upheld. Being deceived by a romance scammer is not gross negligence. Your bank cannot refuse reimbursement simply because the scam was convincing. Unless your bank specifically warned you about this individual and you ignored that warning, refusal is unlawful.

Scenario 2: Impersonation Fraud
Someone phoned you claiming to be from your bank's fraud team. They said your account was compromised and asked you to transfer £8,000 to a "safe account." You did. Your bank later refused, saying you "should have called us back to verify." Likely outcome: This refusal is borderline but likely still invalid. The Consumer Standard of Caution does not require you to proactively verify every caller. However, if your bank's phone system has caller ID that you could have checked, or if they had previously warned you about this specific impersonation tactic and you ignored it, the refusal might stand. Escalate to the FOS - this is a grey area where ombudsman judgment is valuable.

Scenario 3: Investment Scam (Wilful Blindness)
Someone offered you a "guaranteed 50% monthly return" on an investment. You transferred £10,000. You then discovered it was a scam. Your bank refused, saying you "acted recklessly by investing in something with unrealistic returns." Likely outcome: This refusal may stand if your bank can show you deliberately ignored obvious warning signs. Gross negligence includes wilful blindness to risk. However, the bank must prove you acted with reckless disregard - not merely that the investment was unrealistic. Challenge this vigorously; many investment scams are highly convincing.

Scenario 4: Business Payment to a Fraudulent Supplier
You're a small business and received an invoice (via spoofed email) from what you thought was your regular supplier, asking you to update their bank details. You transferred £15,000. Later, you discovered it was a fraudster who had hacked the supplier's email. Your bank refused, saying "you should have contacted the supplier directly to verify." Likely outcome: For small businesses (microenterprises), the same standard applies. However, if you regularly deal with this supplier and have a procedure for verifying payment changes, failing to follow that procedure could constitute gross negligence. That said, the standard is high - you'd need to have deliberately ignored your own internal controls. Challenge the refusal by explaining your verification process and why it failed despite your efforts.

Why Are Banks Still Refusing Valid Claims?

The PSR's July 2026 report acknowledged that despite the mandatory rules, some banks are still refusing valid claims. Reasons include:

• Outdated systems: Some banks haven't updated their fraud response procedures to reflect the new rules, relying on old CRM Code criteria.
• Cost-cutting: Refusing claims keeps reimbursement costs down in the short term, even if refusals are later overturned by the FOS.
• Confusion about "gross negligence": Some banks interpret the standard too loosely, rejecting claims based on mere carelessness rather than recklessness.
• Lack of training: Fraud teams may not have been properly trained on the new rules.

This is why escalation matters. A bank's initial refusal does not mean you've lost your right to reimbursement. The FOS sees hundreds of these cases annually and has developed clear precedent on what does and doesn't constitute gross negligence.

Key Facts At a Glance

• Maximum reimbursement: £85,000 per claim (no minimum)
• Excess: Up to £100, waived for vulnerable consumers
• Rules apply from: 7 October 2024 (payments made on or after this date)
• Reporting deadline: 13 months from the last fraudulent payment (must report within this window or reimbursement can be refused)
• Bank response time: 15 business days (on fraud claims)
• Reimbursement split: 50:50 between sending and receiving banks
• Who's covered: Individuals, microenterprises (under 10 employees, under €2m turnover), and charities
• Who's not covered: Large businesses
• Grounds for refusal: Only fraud by you, or gross negligence (not mere carelessness)
• FOS referral deadline: 6 months from the bank's final response letter
• FOS phone: 0800 023 4567
• Recent reimbursement data (18 months: Oct 2024 - March 2026): £316 million (88% of losses) reimbursed to victims
• Estimated annual fraud reduction: £73 million per year

Don't Accept a Refusal Without a Fight

If your bank has refused to refund APP fraud you fell victim to, remember this: a refusal is not the end. The PSR's own data shows that 88% of victims are being reimbursed. The rules are clear, the protections are strong, and the FOS has made it clear that banks must apply them fairly.

Your next step is to escalate within your bank with a formal, law-backed complaint. Reference the specific regulation (PSR rules, Payment Services Regulations 2017), explain why the bank's stated reason for refusal doesn't meet the legal standard, and demand a substantive review. If the bank refuses again, escalate to the FOS without delay - and ensure your complaint letter cites the exact legislation so there's no room for the bank to misinterpret your position.

Using Paybacker's AI complaint letter tool, you can generate a formal, law-compliant complaint in 30 seconds. No guessing about legal language, no risk of missing a key regulation. The tool will cite the Consumer Rights Act 2015, Payment Services Regulations 2017, and the PSR's own guidance - exactly what regulators and the FOS expect to see.

You were the victim of a crime. The law now protects you. Make sure your bank knows it.