A supplier emails saying its bank details have changed. The invoice looks genuine, the email thread looks familiar, and your finance team sends the payment.
Only later do you discover that the supplier's email account was compromised and the money went to a fraudster.
That is Authorised Push Payment (APP) fraud: the victim approves the transfer themselves, but does so because they were deceived.
UK Finance reported £576.4 million of APP fraud losses in 2025, across 248,070 cases.
Only later do you discover that the supplier's email account was compromised and the money went to a fraudster.
That is Authorised Push Payment (APP) fraud: the victim approves the transfer themselves, but does so because they were deceived.
UK Finance reported £576.4 million of APP fraud losses in 2025, across 248,070 cases.
TL;DR
- APP fraud happens when someone is tricked into authorising a bank transfer to a fraudster.
- Since 7 October 2024, eligible UK victims of APP scams over Faster Payments and retail CHAPS are generally covered by mandatory reimbursement rules.
- The current reimbursement cap is £85,000 per claim, with most valid claims expected to be resolved within five business days.
- Cross-border transfers are outside this UK reimbursement regime, so businesses still need strong payment-verification controls.
What is APP fraud?
APP stands for Authorised Push Payment.
In an APP scam, the payer genuinely authorises the transaction. The fraud is in why they make it or who they believe they are paying. Unauthorised fraud is different because the account holder did not consent to the payment.
Fraudster gains trust → false payment instructions → victim authorises transfer → funds reach fraudster-controlled account
Common types of APP fraud
Common types include:
- Purchase scams: payment for goods or services that do not exist or never arrive. These made up 71% of UK APP scam cases in 2025.
- Investment scams: money sent to a fake investment; losses reached £221.5 million in 2025.
- Impersonation scams: criminals pose as banks, police, government bodies, suppliers, or senior employees.
- Invoice/payment-redirection scams: genuine-looking instructions redirect a business payment.
- Romance scams: trust is built before money is requested.
What changed in the UK APP fraud rules?
Mandatory reimbursement rules took effect on 7 October 2024.
They apply to qualifying APP scam payments made:
- through Faster Payments
- through qualifying retail CHAPS
- from one UK account to another UK account
- on or after 7 October 2024
The rules cover individuals, microenterprises, and eligible charities.
UK APP fraud reimbursement rules at a glance
| Rule | Current position |
|---|---|
| Maximum mandatory reimbursement | £85,000 per claim |
| Claim deadline | Within 13 months of the final scam payment |
| Typical decision time | Within 5 business days |
| Extended investigation | Can reach 35 business days where stop-the-clock provisions apply |
| Sending/receiving PSP cost split | 50:50 |
| Optional excess | Up to £100 |
| Vulnerable customers | Excess and consumer-caution exception do not apply where the relevant vulnerability test is met |
The £85,000 cap applies to both Faster Payments and qualifying retail CHAPS claims.
Who is protected?
The regime covers:
- individual consumers
- microenterprises
- eligible charities
A microenterprise generally has fewer than 10 employees and turnover or a balance-sheet total not exceeding €2 million. Eligible charities have annual income below £1 million.
When can an APP fraud claim be rejected?
Mandatory reimbursement does not apply to every disputed transfer.
Examples outside the regime include:
- civil disputes, where the payee is legitimate but there is a disagreement about goods or services
- payments where the customer was complicit in the fraud
- cases involving gross negligence, subject to the high threshold in the rules
- international payments
- payments through systems outside Faster Payments and applicable CHAPS
- card, cash, or cheque payments
- payments to an account controlled by the customer
- unauthorised payments, which follow different protections
What does the 50:50 reimbursement rule mean?
The victim normally reports the scam to the sending payment service provider.
Where the claim is reimbursable, the sending PSP pays the customer and the sending and receiving payment firms share the reimbursement cost 50:50.
The split gives both sides a financial incentive to identify suspicious payments and fraudster-controlled accounts.
What is Confirmation of Payee?
Confirmation of Payee (CoP) is a name-checking service used by UK payment firms.
Before a transfer is sent, CoP compares the entered account name with the name linked to the receiving account. It can flag mistyped details or an unexpected payee name, but it cannot prove that the underlying transaction is legitimate.
How can businesses reduce APP fraud risk?
- Verify bank-detail changes independently: call a trusted contact using previously verified details.
- Use maker-checker approvals: require a second approver for high-value or unusual transfers.
- Treat urgency as a risk signal: requests to bypass normal controls deserve extra checks.
- Protect finance accounts: use multifactor authentication and restricted permissions.
- Keep evidence: retain invoices, instructions, approvals, and communications.
- Act quickly: contact the payment provider immediately if a suspicious transfer has been sent.
What do the UK rules mean for Indian businesses?
The UK's mandatory APP reimbursement rules apply to qualifying UK-to-UK Faster Payments and retail CHAPS transfers.
They do not extend to international payments sent from the UK into an Indian account.
Indian exporters should therefore not assume the UK reimbursement regime protects a cross-border transfer. Clear payment instructions, tracking, controlled access, and rapid investigation remain important.
PayGlocal provides Indian businesses with cross-border payment tracking, transaction reporting, multifactor account access, role-based controls, and fraud monitoring across its payment infrastructure.
