How APP fraud works
The fraudster persuades the victim to make the payment themselves, usually by an instant bank transfer that cannot be recalled. The money lands in an account opened or rented for the purpose, a mule account, and is moved on within minutes. Common forms are:
- Impersonation of a bank, the police or a tax office
- Purchase scams: goods paid for that never arrive
- Invoice fraud: a real supplier's bank details swapped
- Investment and romance scams, often run over months
The UK's reimbursement rules
Under the Payment Systems Regulator's rules, payment firms reimburse victims of APP fraud on payments sent over Faster Payments or CHAPS between UK accounts. The protection covers individuals, microenterprises and charities, up to £85,000 a claim, normally within five business days. The sending and the receiving firm share the cost equally.
A firm may refuse where the customer was complicit or grossly negligent, and may deduct an excess of up to £100. Victims have 13 months from the payment to claim.
APP fraud in the EU, and for a payments product
In the EU, the Parliament and the Council reached a provisional agreement on 27 November 2025 on a Payment Services Regulation. Under that agreement, a provider refunds in full a customer tricked by a fraudster posing as the provider's own employee, if the customer reports the fraud to the police and tells the provider.
For a firm that sends or receives transfers, APP fraud puts work at both ends: warnings and payee name checks before a payment leaves, and monitoring of incoming funds to find mule accounts.
APP fraud or unauthorised payment?
- Unauthorised payment
- A payment the customer did not make or approve, such as one sent after an account takeover. APP fraud is approved by the customer, who was deceived about who was being paid or why.
- Chargeback
- A card scheme process for card payments. Bank transfers have no chargeback, which is why APP fraud has rules of its own.
Where APP fraud shows up in a platform
Modules that do the work
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- PayoutsMoney out to bank accounts, cards and wallets, on the rail that fits each payment.
- Accounts & IBANsCustomer accounts with their own IBANs, on the partner bank and the rails you choose.
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Payment Systems Regulator, APP fraud reimbursement protections
- Payment Systems Regulator, APP scams
- European Parliament, Payment services deal: more protection from online fraud and hidden fees, 27 November 2025
General information, not legal advice: what applies to you depends on your services and your market.