How we cite the law — Paybacker LTD

1. In short

A letter is only as good as the law it cites, and an AI that invents statutes is worse than useless — it is actively harmful to the person sending it. So Paybacker does not let the model decide what the law says.

Citations are retrieved from a maintained store of UK legislation and regulator rules and handed to the model. The model selects from that list and applies it to your facts; it is not asked to recall legislation from memory.
Every citation must link to a source on an allowlist of official domains. Trade bodies, law-firm blogs, news sites and consumer aggregators are rejected, not cited.
Before a letter is produced, the references being used are checked for freshness, and after it is written the text is scanned for citations we did not supply, which are replaced or removed.
Changing what a citation says — the name of the Act, the section number — requires a person to approve it. No unattended process does that.
We are not a law firm, we do not give legal advice, and we do not promise outcomes. See section 7.

Our broader approach to sourcing and verification is set out in our Methodology, and the commitments we hold ourselves to are in our Code of Ethics.

2. Where citations come from

Paybacker keeps a store of UK legal references — the Act or regulator rule, the relevant section, a plain-English summary, the source link, the escalation body, and a verification status recording when we last checked it and what we found.

When you ask for a complaint letter, the system first works out the category of your dispute (energy, telecoms, consumer goods, credit, and so on), pulls the references stored against that category, and puts them into the prompt as a fixed list. The model is instructed to cite only from that list and not to invent statute names, section numbers or provisions. The same retrieval happens for the /v1/disputes API used by our business customers.

References whose source link has stopped resolving are excluded from that list before the model ever sees them.

This matters because the failure mode we are designing against is specific and well documented: language models produce citations that look right and are not. Retrieving from a maintained store removes the model's opportunity to guess. It does not remove it entirely, which is why there is also a check on the way out — section 4.

3. The source allowlist

A correctly-stated statute is still unusable if it links somewhere a company's complaints team will not take seriously. So we maintain an explicit allowlist of domains a citation is allowed to point at. A URL must match one of these exactly, or be a genuine subdomain of one.

Accepted:

Primary legislation — legislation.gov.uk
Government guidance — gov.uk and its subdomains, parliament.uk
Statutory regulators — fca.org.uk (including handbook.fca.org.uk), ofcom.org.uk, ofgem.gov.uk, cma.gov.uk, ico.org.uk, caa.co.uk, orr.gov.uk
Ombudsmen and approved ADR schemes — financial-ombudsman.org.uk, lgo.org.uk, spso.org.uk, ombudsman-services.org, ombudsman.wales
Courts — judiciary.uk, supremecourt.uk, bailii.org
Health — nhs.uk

Two consumer-guidance sites — citizensadvice.org.uk and moneyhelper.org.uk — are treated as secondary. A proposal citing one of them is never applied automatically; it is forced to low confidence and flagged for human review, and it never silently replaces an existing citation.

Everything else is refused. Trade associations, bank and insurer industry bodies, law-firm blogs, news and consumer-money media, and Wikipedia are commentary about the law, not the law. A proposal citing one of them is dropped — it is not queued for review, because there is nothing to review. Our discovery process drops them before they can become candidates, and our daily maintenance run automatically rejects any pending correction pointing at one.

The domain matching is done on label boundaries, so a lookalike hostname such as legislation.gov.uk.example.com does not match legislation.gov.uk.

If a genuine citation needs a source we have not allowlisted, the correct fix is to add the domain to the list after checking it — not to wave the citation through. That is a rule we apply to ourselves in the codebase.

4. What runs before a letter

Two checks sit around the writing step. They apply to the complaint letter generator on this website, to the /v1/disputesAPI used by our business customers, and to the dispute-reply engine behind the assistant on WhatsApp and Telegram and the “draft a reply” button in your dashboard.

Before writing — a freshness check. Every reference about to be put in front of the model is tested: does it have an acceptable verification status, has it been checked recently enough, and has it been marked superseded or broken? References that fail are not used blind. The system attempts a live re-check of the reference, and where that does not resolve it, it looks for a fresher substitute in the same legal category, then in legally adjacent categories, before falling back to the pan-sector statutes such as the Consumer Rights Act 2015. Where a reference is usable but older than we would like, the response carries a compliance warning rather than presenting it as fully current.

After writing — a citation check. The finished text is scanned for references to UK statutes and regulators. Anything cited that was not in the list we supplied is treated as unverified: it is either replaced with the closest verified reference we did supply, or removed from the text, and the substitution is recorded as a warning on the result. This is the check that catches a plausible-looking invention such as a wrong year on an Act or a section number that does not exist.

Both checks are designed to fail safe. If our own database is unreachable, the freshness check does not block your letter — it lets it through rather than leaving you stuck, and the post-writing citation check still runs.

This is a check on sourcing and internal consistency. It is not a judgement that the law cited is the right law for your particular circumstances. Nothing automated can make that judgement, and we do not claim it does.

5. How corrections are made

The law moves. Sections are renumbered, guidance is reissued, regulators move pages. A daily maintenance run at 03:00 UTC works through the store of references: it tries to repair links that have stopped resolving, audits every stored source against the allowlist in section 3, looks for recent legislation, gathers supporting evidence for anything already flagged, automatically rejects proposals pointing at non-authority sources, and finally emails a punch list of what needs a human decision.

Automated verifiers propose. They do not decide. A proposed change is written to a corrections queue with the before and after values, a risk score, and the evidence behind it.

Whether a proposal can be applied without a person depends on what it would change:

A link that has moved within the same official site — for example a page on legislation.gov.uk redirecting to its contents page — is applied automatically. The law name is identical, the hostname is identical, and the destination is on the allowlist, so no change to meaning is possible.
Other low-risk mechanical changes — punctuation, capitalisation, an official page moving between government domains — are applied automatically only if all three of these hold: the change is scored low risk with supporting evidence attached; the text actually fetched from the proposed source corroborates both the proposed name and the proposed URL, or a redirect chain proves the old page now leads to the new one; and no semantic change is detected. If any one of the three fails, it goes to a person.
Anything that changes what the citation says — a section number, a year, an Act renamed, a rule superseded, a change of jurisdiction — requires a founder approval click. There is no unattended path that renames a law or changes the section we cite.

Automatically-applied changes are not invisible. They appear in an “auto-applied” panel in our admin dashboard alongside the before and after values, with a one-click revert that restores the previous law name, section and source URL.

Separately from the corrections queue, routine maintenance does update two things unattended: the source link a reference points at, and its freshness status when the source stops responding or is found to have been superseded. Those changes affect where a citation points and whether we are willing to use it, not what it says.

The link is the one an automated verifier could get wrong, so it is gated: a replacement URL is written only if it passes the allowlist in section 3 as a primary official source. A proposed link that is not on that list, including the two secondary consumer-guidance sites, is refused and logged, and the stored link is left exactly as it was. There is no path, attended or unattended, by which a Paybacker citation comes to point at a law-firm blog or a news article.

6. How new citations get added

We look for new UK legislation and regulator material automatically, but discovery is never applied on its own. A discovered reference is written to a candidates queue as pending, and stays there until a person approves it. Candidates whose source fails the allowlist check are dropped at discovery and never reach the queue at all.

When a candidate is approved it enters the reference store marked as needing verification — founder-approved but not yet independently checked — so it carries a lower confidence than a reference that has been through the full verification cycle.

7. What we do not claim

These are limits on what Paybacker is, not marketing caveats.

We are not a law firm. Paybacker LTD is a technology company. No one drafting your letter is acting as your solicitor, and no solicitor-client relationship is created by using the product.
We do not give legal advice. Paybacker helps you write your own correspondence and points you at the law that is likely to be relevant. That is general guidance applied to the information you gave us, not advice on your situation. For complex or high-value disputes, court proceedings, or anything where you are unsure, consult a qualified solicitor or Citizens Advice.
We do not promise outcomes. We never state or imply that a dispute will succeed, that a refund will be paid, or that a particular sum will be recovered. Whether a company or a regulator agrees with you depends on facts and evidence we cannot see from a form.
We do not claim the AI performs a lawyer's work. It retrieves, drafts and cites from a maintained source of law. It does not exercise legal judgement, and we do not present it as equivalent to a qualified adviser.
We take no percentage of what you recover. Paybacker charges a flat subscription and never a success fee.

8. Honest limitations

Things that are true and that we would rather you heard from us.

The law changes between our checks. Our maintenance run is daily. A statute amended today may take a cycle to be reflected, and material that requires human approval waits for that approval.
The right law for you is a judgement call. A citation being current, correctly named and correctly linked does not make it the strongest argument in your circumstances. Read your letter before you send it.
The guardrail is a sourcing check, not a legal opinion. The pre-writing freshness check and the post-writing citation check described in section 4run on every path that drafts a letter for you: this website's generator, the /v1/disputes API, and the assistant on WhatsApp and Telegram. What they confirm is that a citation came from our maintained store and an official source, and that the finished text does not cite something we never supplied. They cannot confirm it is the right law for your circumstances. On the conversational surfaces we cap how long we will spend re-checking a reference live, so a reference we cannot re-check in time is substituted or dropped rather than used unchecked.
Coverage is uneven. Our reference store is strongest in the sectors we serve most — energy, telecoms, consumer goods, air passenger rights, credit and debt. It is thinner elsewhere, and where we have no specific rule we fall back to the pan-sector statutes.
Automated verification uses AI, and AI is fallible. That is precisely why the checks it can trigger on its own are limited to links and freshness status, why anything touching the substance of a citation needs a person, and why automatic changes are logged with a revert.

9. Report a citation

If a citation in a Paybacker letter looks wrong, out of date, or points somewhere it should not, tell us. Email hello@paybacker.co.uk with:

the letter or dispute it appeared in, or a copy of the text;
the citation you are querying — the Act or rule and the section;
what you believe is wrong, and a link to the correct source if you have one.

Reports go into the same corrections queue described in section 5and are reviewed by a person. If we confirm a citation is wrong, we correct the stored reference so it stops appearing in anyone else's letters, not just yours. We will tell you what we found either way.

We would rather hear about a citation you are unsure of than have you send a letter you do not trust.

10. Contact

Questions about anything on this page: hello@paybacker.co.uk. Business and API enquiries: business@paybacker.co.uk.

Related reading: our Methodology covers how we source and score primary material, and our Code of Ethics covers the commitments we hold ourselves to when using generative AI on consumer correspondence.

Paybacker LTD is registered in England & Wales (company no. 17107323).