APP fraud and the UK PSR reimbursement rules

Authorised push payment fraud, known as APP fraud, happens when a customer is tricked into sending money to a criminal. The customer authorises the payment themselves, often because a fake invoice, a romance scam, or an impersonation of a bank or a supplier convinced them the payment was genuine. Because the customer authorised it, the payment is not unauthorised fraud, and for years the victim had little protection. The bank had followed the customer instruction, so the loss sat with the customer, even when the fraud was sophisticated and the customer had acted in good faith. In the United Kingdom, that changed on 7 October 2024, when the Payment Systems Regulator, the PSR, introduced mandatory reimbursement rules for APP fraud. Under the rules, the sending payment service provider must reimburse the victim in most cases, and the cost is split equally between the sending provider and the receiving provider. The maximum reimbursement is 85,000 pounds per claim. The rules apply to payments made through Faster Payments and CHAPS. The customer must report the fraud promptly, and the sending provider must reimburse within five business days of the claim, unless it needs more time to investigate, in which case it may stop the clock to gather information, but must complete its assessment and close the claim within 35 business days of the claim. Source: PSR APP fraud reimbursement rules, in force 7 October 2024. There are exceptions, and they matter. The rules do not cover payments where the customer acted with gross negligence, for example by ignoring a clear warning that the payment was a scam. They do not cover first party fraud, where the customer makes a false claim. They do not cover civil disputes, where the customer paid for goods that were poor quality but the seller is genuine. They do not cover payments the customer made to an account they control, or payments that were unlawful. A bank that wants to refuse reimbursement must prove the exception applies, and the customer can complain to the Financial Ombudsman Service if they disagree with the decision. The reimbursement rules changed the business case for fraud prevention overnight. Before the rules, a bank that invested in fraud prevention bore the cost while the victim bore the loss. After the rules, the bank bears the loss, so preventing APP fraud became a direct saving. Banks responded with confirmation of payee checks, which warn the customer when the account name does not match the name they entered, with warning messages at the point of payment, with payment limits for new payees, and with friction on first payments to a new beneficiary. The receiving bank also gained a duty, because it shares half the cost, so receiving banks now screen incoming payments for mule accounts and freeze suspicious funds faster. For a business analyst, the reimbursement rules create a full set of requirements. The claim flow must capture the fraud report, the evidence, and the timeline. The investigation must record what checks were done and why the claim was accepted or refused. The reimbursement must be paid within the deadline and recorded with the reason code. The reporting must show the regulator how many claims were received, how many were reimbursed, and how many were refused and why. And the prevention controls, confirmation of payee, warnings, limits and friction, must be designed so that a genuine customer can still pay quickly while a fraud victim is stopped before the money leaves. The rule to carry forward is simple: the bank now pays for APP fraud, so the bank must prevent it, detect it, and reimburse it, and the BA must design all three. Take a victim who is tricked into paying GBP 60,000 to a criminal through Faster Payments. The victim reports the fraud to their bank the same day. The sending bank must reimburse within five business days, and the cost is split equally with the receiving bank, so each pays GBP 30,000. If the sending bank needs more time to investigate, it may stop the clock, but it must complete its assessment and close the claim within 35 business days. If the bank refuses reimbursement, it must prove that an exception applies, such as gross negligence by the customer, and the customer can complain to the Financial Ombudsman Service. The maximum reimbursement is GBP 85,000 per claim, so a victim who lost GBP 100,000 receives at most GBP 85,000. The receiving bank's duty is the part of the rules that is easiest to miss. Because the receiving bank shares half the cost, it has an incentive to detect mule accounts and freeze suspicious funds quickly. Suppose a mule account receives GBP 60,000 and forwards it within an hour. If the receiving bank freezes the funds in time, the money can be returned and the loss is reduced. If it does not, the money is gone and the receiving bank still pays its half. The receiving bank must therefore screen incoming payments for mule activity, monitor new accounts closely, and act on fraud intelligence from other banks. A BA should specify the receiving bank's controls, the freeze process, and the information sharing with the sending bank, because reimbursement is a shared responsibility. The claim flow is a full set of requirements that a BA must design end to end. The claim must capture the fraud report, the evidence, and the timeline. The investigation must record what checks were done and why the claim was accepted or refused. The reimbursement must be paid within the deadline and recorded with the reason code. The reporting must show the regulator how many claims were received, reimbursed and refused, and why. Prevention controls, confirmation of payee, warnings, limits and friction, must be designed so that a genuine customer can still pay quickly while a fraud victim is stopped before the money leaves. The rule is simple: the bank now pays for APP fraud, so it must prevent it, detect it and reimburse it, and the BA must design all three.