Scammed into a bank transfer? Your refund rights

Which right is yours?

You made the payment, because you were deceived. A fake seller, an “account in danger” call, an invoice with swapped bank details, a romance or investment that never existed. That’s an authorised push payment scam, APP fraud, and the mandatory reimbursement rules are yours. They cover Faster Payments and CHAPS transfers between UK accounts made on or after 7 October 2024. The rest of this guide is about these.

You didn’t make the payment at all. Someone got into your account or used your stolen card. That’s an unauthorised payment, and under the Payment Services Regulations your bank must refund it promptly, usually by the end of the next business day, unless it can show you authorised it or were grossly negligent. At most you can be liable for £35 where a lost or stolen card was used before you reported it, and nothing after you’ve reported it. If the bank drags its feet on an unauthorised payment, skip straight to the complaint stage below.

What the reimbursement rules give you

Up to £85,000 per scam. Related payments to the same fraud count together as one claim. The bank must reimburse within five business days, though it can pause once to investigate, to a hard maximum of 35 business days for a decision. It may deduct an excess of up to £100. Its choice, not an entitlement, and it cannot take one from a customer who was vulnerable when the scam happened. Vulnerability here is practical, not a label: a health condition, a bereavement, anything that materially affected your ability to protect yourself — say so when you claim, because it also switches off the “you should have been more careful” argument entirely.

Outside the rules: payments before 7 October 2024, transfers to accounts abroad, card payments (different rights: see the questions below), cash and cheques, payments to an account you control, and genuine commercial disputes. A real company doing bad work is a complaint, not a fraud claim.

How to claim

Then cooperate quickly: answer their questions, hand over the messages and screenshots, and consent to the police report.

“You should have spotted it”

The rules let a bank refuse only where it can show you were grossly negligent. The burden is the bank’s, and gross negligence is a high bar: significantly beyond careless, judged against how sophisticated the scam actually was. A generic “beware of fraud” pop-up doesn’t clear it either. The caution standard is built around specific, tailored warnings about your actual payment, and the rules say boilerplate isn’t enough. And if you were vulnerable, the exception doesn’t apply to you at all.

Worth knowing before you accept a no: in the rules’ first year, how often banks used this exception varied wildly between firms. Some invoked it in a quarter of claims by value, others never. A refusal often reflects your bank’s habits more than your conduct, which is precisely what the ombudsman exists to referee.

If they refuse, or the money was outside the rules

A refusal, or a claim the rules don’t cover, like an international transfer or a pre-2024 scam, becomes a complaint, and payment complaints run on the fast track. The bank gets 15 business days for its final response, not the usual eight weeks. Then six months to take it to the Financial Ombudsman, which looks beyond the reimbursement rules at whether the bank did enough, the warnings it gave or didn’t, the interventions it skipped, how it treated you throughout. Scams outside the mandatory rules still win at the ombudsman on exactly those questions.

Common questions

I was scammed before October 2024. Am I out of luck?

No, you’re outside the mandatory rules, not out of rights. Most big banks were signed up to a voluntary reimbursement code before then, and the ombudsman judges old cases by the standards of their time, including what the bank should have spotted and stopped. Complain, escalate, and don’t let “the new rules don’t apply” end the conversation.

I paid the scammer by card, not transfer.

Different tools, often better ones. A credit card purchase over £100 brings in section 75 — the card company is liable with the “seller”. Any card payment can also be disputed through chargeback. And if the card payment wasn’t made by you at all, that’s an unauthorised transaction with the near-automatic refund described above.

The money went abroad, or into crypto.

Outside the mandatory rules, but the complaint route stays open. The ombudsman regularly examines whether the bank’s warnings and interventions matched the risk of the payment you were making. A £8,000 first-ever transfer to a crypto platform with a limp pop-up warning is an argument, not a dead end. Report it, complain, escalate.

Sources: Payment Systems Regulator — APP fraud reimbursement protections (the cap, deadlines, excess and vulnerability protections); Payment Services Regulations 2017 (unauthorised payment refunds); Financial Ombudsman Service (where refusals go). The reimbursement rules are under formal review, with findings due during 2026/27 — the figures on this page are checked against the rules as they stand.