The APP fraud rules changed. Here is what that means if your bank said no.

Until recently, whether you got your money back after being tricked into a transfer depended largely on which bank you were with. Some were signatories to a voluntary code, some were not, and outcomes varied enormously on identical facts.

That changed on 7 October 2024. The reimbursement requirement makes reimbursement the default for in-scope authorised push payment scams sent between UK accounts over Faster Payments or CHAPS.

What actually changed

• Reimbursement became the default. Firms must reimburse in-scope claims unless a specific exception applies.
• Both banks pay. The cost is split equally between sending and receiving firms, which gives receiving banks a direct financial interest in not hosting mule accounts.
• There is a deadline. Claims must be assessed and paid within five business days, with a limited ability to pause the clock for more information.
• The burden shifted. A firm that wants to refuse must justify it, rather than the customer having to prove entitlement.

The exceptions, and why refusals often fail

Gross negligence

The main ground firms rely on, and deliberately a high bar. Gross negligence means significantly more than being careless or trusting. It is a serious disregard for an obvious risk.

Being deceived by a caller who has spoofed your bank's real number, knows your recent transactions and gives you a plausible reason to act quickly is not a disregard for an obvious risk. It is the intended effect of a professional deception.

When we review refusals, the most common failing is a firm asserting gross negligence without setting out what specifically the customer did that met the standard. An assertion is not an assessment.

Vulnerability

The exception firms handle worst. Where a customer is vulnerable, the gross negligence exception cannot properly be applied to them, and neither can the excess.

Vulnerability is broader than people assume. It includes bereavement, ill health, a recent relationship breakdown, low financial capability, and situations where somebody is managing money alone for the first time.

Firms routinely fail to identify it because they never ask. If your circumstances at the time were relevant and nobody enquired, that is a serious gap in the assessment and worth raising explicitly.

Warnings

Firms rely heavily on having shown an on-screen warning. The weight it carries depends on whether it addressed the scam that actually happened.

A generic caution about paying people you do not know does not speak to someone who believed they were transferring to their own bank's safe account. Where the warning did not match the deception, its evidential value is limited.

What is not covered

The requirement applies to in-scope payments between UK accounts. It does not cover international transfers, payments you made to yourself, or civil disputes with a legitimate business that simply performed badly.

Purchases from a seller who never intended to supply anything are generally covered. A trader who did a bad job is a contract dispute, not a scam, and a different route applies.

If you have been refused

1. Get the final response in writing and read the stated reason carefully.
2. Test whether that reason is evidenced or merely asserted.
3. Consider whether vulnerability was relevant, and whether anybody asked.
4. Check whether the warning shown actually addressed your scam.
5. Refer it to the Financial Ombudsman within six months. It is free.

Our free guide to referring a complaint covers doing that yourself.

Two things worth saying plainly

Report it fast. Some money is still recoverable in the first hours, and the receiving bank can sometimes freeze what remains.

And if anyone contacts you offering to recover what you lost, it is a scam. Read the recovery scam guide and pass it to anyone you know who has been defrauded.