APP Fraud: Reimbursement and Legal Remedies

Since 7 October 2024, banks and other payment institutions (collectively, Payment Service Providers (PSPs)) are subject to a strict regime regarding compensation for customers whose money has been stolen from their accounts by way of Authorised Push Payment (APP) fraud. According to the Mandatory Reimbursement Scheme, introduced by the Payment Systems Regulator and the Bank of England, victims should be able to recover some of the money lost to APP fraud within a week.

What is APP?

According to UK Finance, the banks’ trade body, in 2025 there were a record 248,070 incidents of APP fraud, resulting in nearly £576.4 million stolen by fraudsters. APP fraud operates on an industrial scale and is clearly a serious security threat. So, what is APP?

In a nutshell, APP occurs when you send money from your bank account to one belonging to a fraudster.

Broadly speaking, there are two types of scenarios in which APP is most commonly encountered. Firstly, a fraudster can trick people into believing their money is at risk, promising to protect it and making the account holder transfer the money to an account under its control on the pretext of protecting it. Alternatively, a fraudster will pose as a trusted organisation, business partner or a conveyancing counterparty and will trick a victim into sending the money to an account under its control. In both cases, the money ends up in the fraudster’s account, who will immediately dissipate the money further, very likely putting it beyond the victim’s reach in offshore jurisdictions. The money is also usually split into smaller payments, making it more difficult, and more expensive, for a victim to trace.

The biggest enabling factor for fraudsters in carrying out APP is interception of online data. An example of this is a fraudster hacking into a trading partner’s database and creating false invoices containing the fraudster’s bank details instead of genuine bank details to which a victim usually makes payments. The fraudster will send fabricated invoices from what will appear as a legitimate email address of the trading partner. In reality, because the fraudster is able to intercept legitimate emails passing between the trading partners, they will know the best way to impersonate the trading partner to whom the money appears to be owed under a fabricated invoice. The fraudster will use the same tone and email branding to gain legitimacy. Moreover, they will also include other email addresses in copy, usually those associated with the paying party, which may initially look legitimate but are in reality spoofed addresses, created only for the purpose of bolstering the legitimacy of the email exchange. In reality, even if the emails may look virtually identical, there will be an extra character in the name of the email address or, more likely, in the domain name, making it very difficult for the victim to spot the irregularity. 

A victim will eventually find out about the fraud because the legitimate counterparty may contact it about the missing payment or because the fraudster who posed as a legitimate person/entity suddenly disappears and stops communicating with the victim, alerting the latter to irregular and suspicious behaviour.

If a victim is quick to spot the fraud, it may be possible for the paying bank to either stop the payment or try to recover the payment from the receiving bank

The Mandatory Reimbursement Scheme and how it operates

On 7 October 2024, the government implemented the Mandatory Reimbursement Scheme, making it mandatory for payment service providers (PSPs) that offer Faster Payments, which includes most UK banks, building societies and e-money firms, to refund APP victims. 

The key elements of the mandatory rules are:

• Payments resulting in APP must be made on or after 7th October 2024
• A maximum amount of reimbursement by a PSP is £85,000
• PSPs have 5 working days to reimburse APP victims  
• The reimbursement obligation will apply to consumers, microenterprises and charities
• A £100 excess could apply to any eligible claim
• The sending PSP can seek reimbursement of 50% of the amount paid out to APP victims from the receiving PSP
• A time limit for making claims is 13 months after the last related payment resulting in APP
• There is additional protection for vulnerable customers

What is not covered by the new rules?

• Payments made using cash, cheque, credit, debit, or prepaid card
• Where there is a genuine disagreement with the person or company that was paid the money
• APP scams where the final payment was made more than 13 months before it was reported
• Payments made to another account under APP victim’s control
• International payments
• Instances of behaviour where a victim, through gross negligence, failed to meet one or more of the measures in the Consumer Standard of Caution

Under the new rules, an APP victim is expected to take certain steps before and after making a payment.  The victim must:

• Follow any specific warnings given by PSP, the police or another law enforcement agency that the victim is at risk of being a victim of a scam
• Tell PSP promptly if they think they have been a victim of a scam
• Share any information PSP reasonably asks for to help with a claim
• Report the scam to the police or allow PSP to report it on the victim’s behalf

APP Fraud and Legal Solutions

Unfortunately, the Mandatory Reimbursement Scheme does not guarantee that every victim will get compensation from the PSP. For example, the upper claims limit means that victims of high-value fraud with losses above the cap will not be able to rely on the Scheme. Those who have lost more than £85,000 need to resort to different means of recovery.

Also, the compensation is not guaranteed in all circumstances, especially where the victim has been found to be grossly negligent (i.e. they did not act in line with the Consumer Standard of Caution). 

So, in those circumstances, are there other avenues that the victim can pursue?

Civil Route – Norwich Pharmacal Order disclosure and civil claim in fraud

A victim may be able to make an application for a Norwich Pharmacal Order. This is a court order which directs the receiving bank to disclose the name of its customer (usually in this scenario the alleged fraudster) without fear of breaching customer confidentiality/GDPR.

There are various types of Norwich Pharmacal Order that a party can apply for, including identification of a wrongdoer, identification of the full nature of the wrongdoing, tracing assets, recovering assets or bringing a proprietary claim. In the case of APP, the most common type of Norwich Pharmacal Order a victim will seek is to identify a wrongdoer.

In a typical scenario, an application will be brought against the PSP who has received the funds in the first instance. Such a PSP is under a duty to assist a victim by giving it full information or documentation to disclose the identity of the fraudster. Such information will usually involve details of the bank account holder, full name, address, contact information and information about onward transactions, including details and locations of bank accounts where the misappropriated money was subsequently sent.

There is no need for the victim to have a definite intention to bring legal proceedings against the fraudster, provided that seeking information via Norwich Pharmacal Order is for a legitimate reason (Ashworth Security Hospital v MGN Ltd [2002] UKHL 29).

In order to succeed with its application for a Norwich Pharmacal Order and therefore to obtain the necessary information to track the fraudster, a victim/applicant has to satisfy the following:

• It has to demonstrate a “good arguable case” that a form of legally recognised wrong has been committed against the applicant
• The respondent (PSP) must be involved in it so as to have facilitated the wrongdoing, whether innocently or not. This will usually involve the PSP receiving the funds into the fraudster’s bank account opened with the PSP
• The respondent PSP must be able, or likely to be able, to provide the information or documents necessary to enable the ultimate wrongdoer to be pursued. This is usually easily satisfied on the basis that the PSPs are under an obligation to keep certain KYC information on file
• Requiring disclosure from the respondent is an appropriate and proportionate response in all the circumstances of the case

Due to their obligations of confidentiality, banks cannot voluntarily disclose such information, but it is highly unlikely that they will contest an application for a Norwich Pharmacal Order. Therefore, if the court is satisfied that a fraud has taken place, it will usually grant the application.

Once in receipt of the information, a victim should be in a position to pursue a civil claim in fraud against the fraudster. That said, because the fraudster will usually remove the funds to foreign jurisdictions, a victim will often be forced to bring a legal action in the courts of the jurisdictions where the funds have been traced to.

Criminal Route - Report the fraud to Action Fraud

Simultaneously, to a civil route, a victim can consider reporting the fraud to Action Fraud, which is a national reporting centre for fraud and cybercrime. Action Fraud collects reports about fraud on behalf of the police in England, Wales and Northern Ireland. A report can be made online.

Experts at Action Fraud will examine the information provided in support of the report. Where possible, the information is also matched against other available data in order to enrich and corroborate the details of the fraud. Action Fraud then assesses whether there are viable lines of enquiry that would enable a law enforcement body, such as the police service, to investigate.

It is not uncommon for Action Fraud to decide against pursuing the complaint if there are extant civil proceedings. Also, Action Fraud may take a view that it has not been possible to identify a line of enquiry which a law enforcement organisation in the United Kingdom could viably pursue. Finally, it is worth remembering that even if Action Fraud decides to investigate the fraud and is ultimately successful in charging the fraudster, this will not result in a monetary award for a victim. Nonetheless, the information obtained during the police investigation may prove useful in strengthening a claim in civil courts.

Regulatory Route

There are a number of regulatory and statutory obligations that apply to PSPs. For example, the Payment Services Regulations 2017 (which implements the Payment Services Directive 2015 (EU 2015/2366)) imposes obligations on PSPs for the purposes of authenticating transactions, although they do not deal expressly with APP fraud. Whilst a breach of regulatory and/or statutory obligations may not give rise to a direct cause of action that a victim can rely on, it may give rise to a complaint to the PSP’s regulatory body.

Also, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 apply to banks and other financial institutions. The obligations include exercising proper due diligence in relation to all customers and deploying adequate policies and procedures in order to prevent financial crime.

Conclusion

The Mandatory Reimbursement Scheme is undoubtedly aimed at incentivising institutions to prevent APP fraud and focus their efforts on protecting their consumers rather than curing the effects of the fraud. Whilst it is comprehensive when it comes to payments made via Faster Payments and CHAPS, there are gaps in coverage which fraudsters can exploit. For example, according to a PSR (Payment Systems Regulator) report, a notable increase in APP fraud took place between UK and international accounts, which are out of scope of the Scheme.  

Therefore, the Mandatory Reimbursement Scheme will not determine every victim's ability to recover their losses. For many victims of APP fraud, a civil claim may offer an alternative route to seek compensation, particularly where the Scheme does not apply or provides only limited redress. Obtaining early legal advice can help victims understand the options available and determine which course of action is most appropriate in their individual circumstances.