APP fraud and other scams involving authorised payments or withdrawals

The Faster Payments Scheme (FPS) and the CHAPS reimbursement rules came into force on 7 October 2024. The rules cover:

• faster payments and CHAPS transfers – the PSR has also said that it expects PSPs to consider payments made between accounts at the same PSP under the new rules
• consumers, micro-enterprises and charities with an annual income of less than £1 million.

The rules don’t cover:

• larger companies and charities
• international payments, card payments and cash withdrawals
• civil disputes
• payments in cryptocurrency
• payments to an account under the consumer’s control
• claims made more than 13 months after the last scam payment

Under these rules, you must reimburse your customer up to a maximum of £85,000 for each scam if they:

• are vulnerable to the specific APP scam, and
• in all other cases, unless they don't meet one or more of the 'requirements' set out in the PSR's guidance with ‘gross negligence’

See more about APP reimbursement and the Consumer Standard of Caution Exception Guidance on the PSR's website

Find policy clarifications for the new rules on the PSR website

The Contingent Reimbursement Model (CRM) Code is a voluntary scheme. Several firms, including most high street banks have signed up to it because of the rise of APP fraud.

If your firm has signed up to the CRM Code – and the Code covers the payment made in this case – we expect you to reimburse the customer in most cases.  The CRM covers:

• faster payments, CHAPS transfers and payments made between a PSP’s own accounts – known as ‘internal book transfers’
• consumers, micro-enterprises and charities with an annual income of less than £1 million

It doesn’t cover:

• larger companies and charities
• international payments, card payments and cash withdrawals
• private civil disputes
• payments in cryptocurrency
• payments that weren’t made to a person other than the consumer

Find out more about CRM code on the Lending Standard Board’s website.

It’s likely that your customer will be covered by the Faster Payments Scheme or CHAPS reimbursement rules. And, if your customer was particularly vulnerable to the specific type of APP scam, you must reimburse them.

Gross negligence

In all other cases, if you turn down their claim for reimbursement, you must demonstrate that they acted with ‘gross negligence’.

The PSR’s guidance states that – to have acted with ‘gross negligence’ in this context – “the consumer needs to have shown a significant degree of carelessness”.

To prove ‘gross negligence’, you will have to show that your customer failed to do one or more of the ‘requirements’ set out in the PSR’s guidance.

If you believe your customer "failed to have regard for an intervention with gross negligence", we’ll look at what happened.

We’ll assess both the nature and quality of the intervention. And we’ll consider why the customer moved past it.

Each case is unique, so we’ll need to look at what happened to decide whether a consumer’s actions were grossly negligent. You need to ensure you give us all the relevant information we need so we can make that decision.

Reimbursement and the £100 excess

The maximum amount you must reimburse your customer under these rules is £85,000 for each scam claim. If you do reimburse your customer, you may deduct an excess of up to £100 for each scam claim, unless they were vulnerable.

That means you won't have to reimburse your customer under the rules where all the following apply:

• the claim is for less than £100, and
• your customer wasn't vulnerable, and
• you apply the excess to the value of the claim

Let’s say, for example, your customer believed they were buying trainers online, sent £56 by faster payment and then discovered they’d been scammed.

1. You accept that they have been scammed
2. You apply an excess of up to £100 to their claim
3. The claim is for less than £100, so you don’t reimburse the customer
4. The complaint comes to us
5. We see that you’ve applied the excess fairly and haven’t made any other errors
6. We don’t uphold the complaint

However, if we think you could, and should, have prevented the customer falling for the scam, we might ask you to fully or partially reimburse your customer. 

So, you still need to consider whether you could have done more to prevent your customer's loss.

Reimbursement and the £85,000 limit

We’d apply the same principles to the £85,000 limit.

For example, let’s take a scenario where your customer falls for an investment scam and sends £120,000 to an account controlled by a fraudster.

1. You accept that your customer has been scammed
2. You reimburse them £85,000 but deduct an excess of £100 – a total of £84,900
3. The customer is unhappy and comes to us
4. We find that:
   • you could, and should, have prevented the customer falling for the scam, and
   • the customer hasn’t been careless
5. For those reasons, we’ll tell you to reimburse your customer the additional £35,100.

If the rules don't apply

If neither the Faster Payments Scheme (FPS) or the CHAPS reimbursement rules apply to their case, we’ll tell your customer why not.  

However, we’ll still investigate whether your firm is in any way responsible for allowing the scam payments leaving your customer’s account.

If your firm has signed up to the CRM Code – and the Code covers the payment made in this case – we expect you to reimburse the customer in most cases.

If you’ve declined, or only partially reimbursed a claim under the CRM Code, we'll want to know your reasons and to see any relevant evidence.

We’ll look at whether any of the exceptions to reimbursement apply. For example, whether your customer:

• didn’t pay attention to effective warnings
• had reason to suspect they were falling victim to a scam

We'll want to understand why the consumer took the actions they did – whether that was moving past a warning or making a particular payment. So you will have to provide enough evidence to demonstrate any exception that you wish to rely on.

If the CRM Code doesn’t apply in your customer’s case, we’ll tell them why not.

However, we’ll still check whether your firm is responsible for allowing the scam payments to leave their account.

Find out more about CRM code on the Lending Standard Board’s website.

In these cases, we’ll investigate whether you could have done more to prevent your customer from falling victim to a scam – even if your customer made a:

• payment to their own account – including payments to cryptocurrency providers
• card payment to a genuine merchant – for example, for the purchase of cryptocurrency
• payment to a payee overseas
• a withdrawal of cash from one of your branches

In practice, that means we’ll consider whether the payments your customer made should have alerted you, because they were suspicious or unusual. If they did, we'll want to know what steps you took to warn your customer that the payments might be part of a scam.

We’ll also consider what you did to try and recover your customer’s money once you were made aware of the scam.

If we find that you could – and should – have prevented your customer’s loss but didn’t, we may ask you to reimburse your customer.

We’ll also look at:

• the role of the customer in what happened, and
• the part played by any other firms that were involved in the scam – for example, another of the customer’s account providers

If you’ve decided not to reimburse your customer, you’ll need to tell us:

• the specific exception you’ve relied on, and
• why you don’t think your customer is eligible for reimbursement

You may receive a complaint from someone who isn’t your customer, because your firm received money as part of an APP scam. We can consider these complaints and will investigate:

• the steps you took when you were made aware of the scam
• whether there was anything that might have alerted you, or given you concern about, your customer or the activity on their account