What is authorised push payment fraud, and can you get your money back?

#What makes a payment 'authorised' but still fraud?

A push payment is one you send from your own account, such as a bank transfer, rather than one a shop pulls from your card. The UK Payment Systems Regulator (PSR), which oversees UK payment systems, describes authorised push payment fraud as being tricked into sending money to a fraudster via bank transfer⁠^[1]. The word authorised matters: you logged in, you passed every security check and you pressed send. The bank's systems saw a genuine customer making a genuine payment.

The PSR separates this from unauthorised fraud, where someone steals your card to make payments, and from civil disputes, where you pay a legitimate supplier for goods that are defective or never arrive but there was no intent to defraud⁠^[1]. That distinction decides which rules protect you. Our page on account takeover fraud covers the unauthorised side, and chargebacks explain how card disputes work.

#How do APP scams usually work?

Almost every APP scam has the same shape: the criminal builds trust or urgency, then gets you to push money to an account they control. Instant payment systems make the money arrive in seconds, which is good for honest users and also for criminals, as our guide to instant payments explains. Common stories include fake investment opportunities, where UK Finance reported losses rising 40% year on year in 2025⁠^[2], fake sellers online and people pretending to be from a bank or another trusted organisation.

Regulators see this pattern clearly. The US Federal Trade Commission (FTC) said in June 2026 that some of the costliest impersonation scams start with a fake security alert, often from a bank, and that people are convinced to move money to 'protect' it⁠^[3]. In the UK, UK Finance, the banking trade body, reported that 66% of APP cases in 2025 originated online, accounting for 32% of losses⁠^[2].

#How big is the problem?

The figures are measured differently, so they cannot be added together or compared directly. UK Finance counts losses reported by its member firms; the FTC counts losses people report to it across all fraud types, which it called the highest on record for 2025⁠^[3]. The European Banking Authority and the European Central Bank found that, for credit transfers, users bore about 85% of fraud losses in 2024, mainly as a result of scams that tricked them into initiating payments⁠^[4].

#Can you get your money back in the UK?

Since the Financial Services and Markets Act 2023, the PSR has been required to set a reimbursement requirement for payments over the Faster Payments Scheme that were executed after fraud or dishonesty⁠^[5]. The resulting protections apply to payments made on or after 7 October 2024⁠^[1]. Under them:

• The maximum you can claim is £85,000⁠^[1].
• You should report as soon as possible and within 13 months of the fraudulent payment⁠^[1].
• You can expect reimbursement within 5 business days of your claim, although a firm can take up to 35 business days to reach an outcome⁠^[1].
• Firms may apply an optional £100 excess, but not to vulnerable consumers⁠^[1].
• You will not be reimbursed if you were complicit or grossly negligent, which the PSR calls a high bar that does not apply to vulnerable consumers⁠^[1].

The PSR publishes how this is working. Over the 18 months from 7 October 2024 to 31 March 2026, it reported that 88% (£316m) of the money lost to APP scams had been reimbursed to victims, and that 82% of claims were closed within five business days⁠^[6]. Before paying, UK banks can also use Confirmation of Payee, a check of the name on the receiving account against its sort code and account number that tells you whether there is a match, a close match or no match⁠^[7].

#What about the EU and the US?

In the EU, a provisional agreement on a new Payment Services Regulation reached in November 2025 would require payment providers to check an IBAN against the account name before any transfer, to share fraud information with each other and to address 'spoofing' fraud, where criminals impersonate a customer's own payment provider⁠^[8]. When announced it still needed formal adoption. By October 2026 the European Parliament's Legislative Observatory listed the file as awaiting the Council's first-reading position, with an indicative plenary date of 14 December 2026⁠^[9], so its final form and start date should be checked before you rely on it. The current EU framework is explained in our guide to PSD2.

In the United States, the main federal rule for electronic transfers, Regulation E, limits consumer liability for unauthorised electronic fund transfers. Its definition excludes, among other things, transfers initiated by the consumer with fraudulent intent and transfers by someone the consumer gave access to⁠^[10]. A payment you made yourself because a scammer lied to you generally does not look like an unauthorised transfer, so you should not assume a US bank must refund it.