Top Cyber Security Trends for 2026...
As we look towards 2026, the cyber security landscape continues to evolve rapidly. Organisations of all sizes face increasingly sophisticated...
Read More
APP fraud occurs when a victim is tricked into authorising a payment to a fraudster’s account, often via social engineering tactics such as impersonation, romance fraud, or investment scams. These incidents typically involve either malicious payee fraud, where the victim sends money directly to a criminal, or malicious redirection fraud, where a legitimate payment is diverted after communications have been compromised.
As it has now been a little over a year, this presents an opportunity to assess how the mandatory reimbursement regime has affected victims, firms, and the broader challenge of fraud in the UK’s payments ecosystem.
Prior to October 2024, reimbursement for APP fraud was largely governed by the Contingent Reimbursement Model (CRM) Code, which was a voluntary industry standard adopted by many of the UK banks. This resulted in inconsistent protection: many victims received little or no reimbursement, depending on their bank’s policies.
The PSR used its statutory powers to introduce a mandatory regime that applies to payments made via the Faster Payments and CHAPS systems on or after the implementation date. Under this framework, PSPs must reimburse victims up to a cap, generally £85,000 per claim, unless a claimant is shown to have acted with gross negligence or been complicit in the fraud. Costs are typically shared between the sending and receiving PSP.
The £85,000 cap was itself the result of a late-stage regulatory change. The PSR originally proposed a significantly higher limit of £415,000, aligned with the Financial Services Compensation Scheme (FSCS). However, following industry feedback on cost exposure and systemic risk, the cap was reduced shortly before implementation. This last-minute adjustment attracted attention, particularly given the potential impact on high-value fraud cases.
In its one-year review, the PSR reported positive early outcomes for customers:
Taken together, these figures indicate that reimbursement is not only being delivered more consistently, but that operational practices within firms are adapting to the regime’s expectations. Faster resolution times, in particular, help reduce the emotional and financial strain on victims of fraud.
While the reimbursement rates and speed of response have improved, the regime also appears to be influencing firms’ fraud prevention efforts, particularly among the receiving banks. The decline in claims suggests that PSPs are investing in better detection and mitigation processes, driven by both regulatory obligation and financial incentives: under the PSR’s cost-sharing model, receiving firms directly feel the impact of reimbursing fraudulent transactions.
In parallel with reimbursement obligations, the regime introduced enhanced powers for PSPs to delay outbound payments where fraud is suspected. Firms can now pause certain transactions for several days to carry out additional checks, contact customers, and intervene before funds are irretrievably lost. This preventative measure is increasingly being used as part of wider fraud controls.
The requirement for enhanced collaboration between sending and receiving PSPs has also been highlighted. Early data from PSR supervision shows most claims are now reported and acted upon quickly, with firms sharing information to help prevent losses where possible.
However, some industry voices and stakeholder discussions suggest that the information flows between firms can be fragmented, and that improvements in cross-firm communication and fraud analytics are still needed to reduce APP fraud further.
Despite these positive trends, significant challenges remain.
Public awareness of reimbursement rights is low. PSR consumer research indicates that 71 per cent of fraud victims are unaware of their right to reimbursement, and nearly half of victims did not attempt to access it. This highlights an urgent need for better public communication and firm-led outreach.
Fraud continues to evolve. Purchase fraud, where victims are misled into paying for goods or services that never materialise, accounts for a significant proportion of APP losses. Other types, such as impersonation and romance fraud, remain prevalent. Reimbursement alone cannot eliminate these threats; prevention requires co-ordinated action across banks, technology platforms, social media companies, and law enforcement.
Disputes over boundaries and exceptions also persist. The regime’s exception for gross negligence is intended to be applied narrowly, but defining and applying it consistently presents challenges for firms and regulators alike. The limitations on eligibility can also create gaps in protection, for example where claims fall outside Faster Payments or CHAPS, or involve international or non-standard transfers.
The PSR has signalled that it will continue monitoring the regime, including commissioning an independent review expected after the 12-month anniversary.
Key areas of focus will likely include:
One year after implementation, the PSR’s APP reimbursement regime has substantially improved outcomes for victims of authorised push payment fraud. Reimbursements are occurring more consistently, more quickly, and on a larger scale than under previous voluntary models. There is encouraging evidence that the threat of shared financial liability and regulatory oversight is prompting firms to step up prevention efforts.
However, reimbursement is only one part of a broader response needed to tackle fraud at its source. Reducing APP scams sustainably will require ongoing investment in prevention, clearer communication to consumers, and strong cross-sector collaboration. The PSR’s first year of data provides a solid foundation, but the challenge of fraud remains dynamic and multi-faceted.
As the APP reimbursement regime moves from implementation to ongoing supervision, PSPs must demonstrate not only compliance, but effective, sustainable fraud controls. AJC supports firms in strengthening APP fraud prevention and reimbursement processes, including regulatory interpretation, control design, operational readiness, and ongoing assurance. We help PSPs navigate supervisory expectations, manage reimbursement risk, and embed proportionate, defensible approaches to APP fraud detection and claims handling.
Contact us on 020 7101 4861 or email us at info@ajollyconsulting.co.uk if you think we can help.
Sources:
https://www.psr.org.uk/our-work/app-scams/
https://questions-statements.parliament.uk/written-questions/detail/2025-07-17/68720/
https://finreg.aoshearman.com/UK-PSR-publishes-one-year-impact-of-APP-reimburse
Image accreditation: David Dvořáček (October 2019) from Unsplash.com. Last accessed on 16th February 2024. Available at: https://unsplash.com/photos/two-persons-hands-holding-turned-on-phones-QiPe0UpC0_U
As we look towards 2026, the cyber security landscape continues to evolve rapidly. Organisations of all sizes face increasingly sophisticated...
Read More
Fraud increases sharply during the festive season. The combination of busy shopping, increased travel and higher levels of online activity...
Read More
A significant cyber-security incident struck multiple local authorities in London, forcing council systems offline, disrupting services for residents, and prompting...
Read More