United Kingdom · consumer

How to Challenge a Bank Refusal of APP Fraud Reimbursement in the UK

If your bank refused to reimburse money lost to an Authorised Push Payment (APP) scam, that refusal is often legally vulnerable. Under mandatory Payment Systems Regulator rules in the United Kingdom, banks must reimburse eligible APP fraud victims up to £85,000 unless they can prove you acted with gross negligence. This guide explains how to dismantle the bank's refusal, demand your evidence file, and escalate to the Financial Ombudsman Service.

The Law on APP Fraud Reimbursement in the United Kingdom

In the United Kingdom, payment service providers (PSPs) operate under mandatory Authorised Push Payment (APP) scam reimbursement requirements introduced by the Payment Systems Regulator (PSR) under Specific Directions 19 and 20 (pursuant to the Financial Services (Banking Reform) Act 2013). Under this regime, UK banks and payment firms are legally obligated to reimburse consumers, micro-enterprises, and small charities who lose money to APP fraud via the Faster Payments system, up to a mandatory limit of £85,000.

Reimbursement is the statutory default. A bank cannot refuse your claim simply because you authorised the transaction or fell for convincing social engineering. A bank can only withhold reimbursement if it can formally prove that you acted fraudulently ('first-party fraud') or that you breached the Consumer Standard of Caution through 'gross negligence'. In UK regulatory law, gross negligence is an exceptionally high legal bar requiring a severe degree of carelessness; it is not established simply because you were deceived.

Crucially, the gross negligence standard cannot be applied to any customer who was vulnerable at the time of the transfer if that vulnerability materially impacted their ability to protect themselves from the scam. Furthermore, while banks may apply an excess of up to £100, this excess cannot be deducted from vulnerable customers.

Why Bank Refusal Letters Are Frequently Unlawful

Banks routinely issue standardized refusal letters claiming that a customer 'failed to heed warnings' or 'did not take sufficient care'. However, generic pop-up screens inside banking apps do not satisfy the legal requirements for gross negligence. For a bank to rely on an ignored warning, that warning must have been specific, targeted, and clear regarding the exact risk you faced.

Under the Financial Conduct Authority (FCA) Consumer Duty (Principle 12 and PRIN 2A), banks must act to deliver good outcomes for retail customers, avoid foreseeable harm, and provide balanced communications. When a bank reflexively rejects an APP fraud claim without properly investigating how the scammer manipulated you, or ignores clear contextual indicators of vulnerability (such as acute stress, bereavement, illness, or coercive control), the bank may be in direct breach of FCA rules.

Additionally, the UK Supreme Court in Philipp v Barclays Bank UK PLC [2023] UKSC 25 affirmed that the primary mechanism for customer redress in APP fraud lies in regulatory standards and ombudsman determinations, meaning the bank cannot shield itself behind strict contractual payment mandates if it fails to meet PSR and FCA standards.

How to Challenge the Decision and Escalate to the Ombudsman

If your bank refuses your claim, you must initiate a formal complaint under the FCA Dispute Resolution: Complaints (DISP) rules. Under DISP 1.6.2A, for complaints involving payment services and fraud, the bank must provide a comprehensive Final Response Letter within 15 business days (or up to 35 business days in exceptional, documented circumstances).

If the bank maintains its refusal or misses the statutory deadline, you have the statutory right to escalate the dispute free of charge to the Financial Ombudsman Service (FOS). The FOS is legally binding on financial institutions and overturns roughly one-third of bank fraud rejections. The FOS examines whether the bank's gross negligence assertion stands up to scrutiny and whether the bank's own fraud detection algorithms should have flagged or halted the abnormal transaction.

To prepare the strongest possible challenge, you can use Caunsel to research relevant regulatory rules, organize your transaction records and evidence into a structured case file, or consult an independent legal professional before submitting your dispute.

Steps

• Request your complete case file and SAR disclosure: Submit a formal Subject Access Request under the UK GDPR for your bank's internal fraud investigation notes, call recordings, risk-score logs, and the exact rationale used to refuse your claim.
• Formally refute 'gross negligence' in a written complaint: Respond to the bank's decision letter by citing PSR Specific Direction 19. Emphasize that being deceived by sophisticated criminal deception does not meet the legal threshold for gross negligence under PSR guidance.
• Evidence any vulnerability factors: If you were experiencing stress, fatigue, illness, age-related pressure, or coercive intimidation during the scam, detail this in writing to trigger the vulnerability exemption under the PSR Consumer Standard of Caution.
• Escalate to the Financial Ombudsman Service: Once 15 business days have passed without resolution or upon receiving a Final Response Letter, submit a formal complaint online at financial-ombudsman.org.uk within six months.

Common mistakes

• Conceding to the bank's assertion that you were 'negligent'—ordinary civil negligence is not the legal standard under the PSR rules; the bank must prove gross negligence, which requires extreme recklessness.
• Failing to mention personal vulnerabilities or pressure tactics used by the fraudster that impaired your decision-making.
• Letting the six-month time limit expire from the date on the bank's Final Response Letter before lodging your claim with the Financial Ombudsman Service.
• Accepting a partial 'goodwill gesture' from the bank without checking whether signing their settlement agreement waives your right to claim the remaining statutory reimbursement.

Questions people ask

What is the maximum reimbursement amount for APP fraud in the UK?

Under the mandatory PSR rules for Faster Payments, the standard maximum reimbursement limit is £85,000 per claim. Banks may voluntarily pay more, and claims above this amount can still be assessed on fairness grounds by the Financial Ombudsman Service up to its higher statutory compensation limits.

Can my bank refuse to refund me just because I sent the money myself?

No. The entire definition of an Authorised Push Payment (APP) scam is that the victim was deceived into authorising the transfer themselves. The bank cannot refuse reimbursement on the grounds of authorisation alone; it must prove first-party fraud or gross negligence.

How long does the bank have to answer my fraud complaint?

Under FCA DISP 1.6.2A, financial institutions must issue a Final Response Letter within 15 business days for payment service disputes. In exceptional circumstances, they may extend this to 35 business days, but they must inform you of the delay and explain the specific reasons.

General information only, last updated 2026-10-16. Caunsel is not a law firm and does not practise law. AI answers and this guide are not legal advice. Verify filings, deadlines, and statutes with a licensed lawyer in United Kingdom.