The Outlier Lab

Case Study - UK APP Scam Reimbursement Rules (2024)

Since October 2024, UK payment firms must reimburse APP scam victims up to £85,000, split 50/50 between sending and receiving firms; 88% of losses were repaid in 18 months.

What happened

  • Why it was introduced. Before October 2024, UK reimbursement was largely voluntary, and outcomes varied widely between firms. The PSR used its powers over Faster Payments to make reimbursement mandatory and to give the receiving firm, where mule accounts sit, a direct financial stake.
  • Core rules (Specific Direction 20 for Faster Payments; Specific Direction 21 for CHAPS):
    • Scope: consumers, micro-enterprises and charities, for UK-to-UK Faster Payments and retail CHAPS payments. International payments and civil disputes are excluded.
    • Reimbursement up to £85,000 per claim, confirmed in policy statement PS24/7 on October 2, 2024. The PSR had originally set the maximum at £415,000 and cut it after a short September 2024 consultation that followed pressure from smaller firms. The new level matches the FSCS deposit-protection limit. The PSR said £85,000 fully covers 99.8% of in-scope scams by volume and 90% by value, and it matches the Bank of England's CHAPS limit.
    • Claim window: claims must be made within 13 months of the last payment in the scam.
    • 50/50 liability split between the sending and receiving payment firms. The receiving firm pays its half to the sending firm within five business days of notification.
    • Optional excess of up to £100.
    • Payment generally due within five business days. The sending firm can "stop the clock" to gather information, up to 35 business days in total. The PSR also tracks performance against 35 business days and plans to consult on claims still open at that point.
    • Consumer Standard of Caution exception for gross negligence. Vulnerable consumers (those more susceptible to harm because of their personal circumstances) are exempt from both the caution exception and the excess. In practice, rejections on caution grounds were about 3% of claims.
  • First-year and 18-month results. The reimbursement rate on a value basis rose sharply against pre-policy benchmarks. UK Finance's 2024 figure was 61% for personal accounts, though the datasets aren't directly comparable. 82% of claims were closed within five business days and 98% within 35.
Diagram: Victim deceived into Faster Payment, Claim to sending firm, In scope? Caution exception?, Victim repaid, Cost split 50/50 with receiving firm, Ombudsman route

Timeline

DateEvent
Before October 2024Reimbursement largely voluntary. Outcomes vary between firms.
September 2024PSR consults on cutting the maximum from £415,000 to £85,000
October 2, 2024PSR publishes PS24/7 confirming the £85,000 maximum
October 7, 2024Mandatory reimbursement takes effect (Faster Payments and CHAPS)
March 31, 202618-month mark: 88% of losses (£316M) reimbursed. About 438,300 claims reported, about 301,500 in scope.
April 2026HM Treasury consultation response confirms the government's plan to move PSR functions into the FCA, subject to legislation
July 1, 2026PSR publishes the Frontier Economics evaluation and a roadmap. Consultation planned for December 2026 and revised directions for May 2027.
July 30, 2026Dashboard update for Q1 2026: 89% reimbursed, the highest quarter so far

Mechanisms involved

Control gaps

The regime targets gaps across the payment system rather than one firm's failures:

GapHow the regime addresses it
Receiving firms had little incentive to find mules50% liability (Playbook - Money Mule Detection Members)
Inconsistent victim outcomesMandatory baseline, timelines and a public dashboard
Little visibility into where scams startData collection on online platforms (about 30% of fraud by value) and telecoms (Cross-Functional Partnerships)
Out-of-scope railsNot addressed. International payments and payments to crypto platforms are outside the rules.

Detection and response

Firms responded with more payment-time friction: confirmation of payee, scam warnings, delays and calls for high-risk payments, and blocks or limits on payments to crypto platforms (Payee Confirmation and Payment Friction, Customer Education and Scam Warnings). They also invested in inbound mule detection. The evaluation reports scam transactions fell from about 40,000 to about 35,000 a month, and per-firm reimbursement rates still ranged from 21% to 94%.

Outcome

  • Victims: most in-scope losses are now repaid quickly.
  • Firms: estimated non-reimbursement costs of £44–56M a year. Short-term net benefit estimated at £17–29M a year, falling to between −£4M and +£8M after allowing for displacement and unreported scams.
  • Displacement: international APP scams rose from £21M (2023) to £60M (2025), and APP scams to crypto exchanges rose indicatively from about £59M to £153M. Causation hasn't been quantified.
  • Regulatory: the PSR is to be folded into the FCA. Revised directions are expected in 2027.

Lessons for practitioners

  1. Liability rules shape fraud investment. Once receiving firms paid half, mule detection became a P&L item. US firms should model what a similar split would cost them now (Case Study - Zelle Scam Liability Disputes (2024-2025), Loss Taxonomy and Attribution).
  2. Measure displacement as well as in-scope losses. Fraudsters move to rails outside the rules (international, crypto). Track losses by rail and destination type so you can see the shift (Fraud Metrics and KPIs, Payment Rails Map).
  3. Don't count on the negligence exception. Gross-negligence rejections stayed around 2–3%, so prevention and recovery have to carry the economics (Playbook - Scam Intervention Members).
  4. Speed requirements change operations. A five-business-day standard needs triage, decision rights and evidence templates designed for volume (Alert Review Operations, Case Documentation Standards).
  5. Data sharing with platforms matters. Most scams by volume start on online platforms. Partnerships with marketplaces, social media and telecoms, and intelligence sharing, are now part of loss control (Consortium and Data Sharing, Scam Victim Indicators, Payments and P2P).

Sources