The short answer
Since October 7, 2024, UK payment service providers must reimburse most victims of authorized push payment scams on Faster Payments, up to £85,000 per claim, with the cost split between the sending and receiving firms.
Key takeaways
- Mandatory reimbursement began October 7, 2024.
- The maximum reimbursement is £85,000 per claim.
- Sending and receiving firms share the cost.
What the rules require
From October 7, 2024, payment firms sending Faster Payments must reimburse eligible victims of authorized push payment (APP) scams, up to a maximum of £85,000 per claim.[1] The cost is shared between the firm that sent the payment and the firm that received it.[2]
Why authentication isn’t the answer here
In an APP scam the customer authorizes the payment themselves. Strong authentication confirms it really was the customer, which is exactly the problem. Defenses have to look at the payment’s context: a new payee, an unusual amount, or a customer who is on the phone with someone claiming to be their bank.
What changed for fraud teams
- Receiving firms now pay too, which gives them a reason to spot and freeze mule accounts.
- Friction at the point of payment became easier to justify: confirmation-of-payee warnings, holds and calls.
- Data sharing between firms matters more when both sides carry the loss.
Sources
- Payment Systems Regulator. PS24/7: Faster Payments APP scams reimbursement requirement: confirming the maximum level of reimbursement.
- Payment Systems Regulator. PS25/5: APP scams reimbursement consolidated policy statement.
- Published.