Authorised Push Payment Fraud: The UK Reimbursement Rules, EU Verification of Payee, and Where Identity Checks Fit

For information; not legal advice.

Most of the identity fraud that identity verification is built to stop has an impostor in it: a forged document, a stolen identity, a face that is not the face on the card. Authorised push payment fraud is different. The victim is who they say they are, logs in with their own credentials, passes every authentication step, and sends the money themselves. The deception is not of the bank. It is of the customer. That changes what identity checks can do, and it is why this kind of fraud deserves a careful reading before anyone claims that a verification step prevents it.

This article explains what the term means, how the United Kingdom has made banks and payment firms reimburse victims, what the regulator publishes about the results, how the European Union approaches the same problem through a payee name check, and where identity verification does and does not fit. It states the rules as the regulators wrote them, with their dates, and it says when something is still a proposal. It does not give legal advice, and it does not claim that any product reduces the number of scams.

It follows identity fraud statistics: how to read the numbers, which compares the sources of fraud data, and it leads into the article on money mule accounts, because the account that receives the money is where identity checks meet this kind of fraud.

What the term means

The Payment Systems Regulator (PSR), the United Kingdom's regulator of payment systems, describes authorised push payment scams (APP scams) as cases where someone is tricked into sending money to a fraudster posing as a genuine payee. Its page lists impersonation and romance scams among the types. In the direction that makes reimbursement binding, the regulator defines the scams as cases where a person uses a fraudulent or dishonest course of conduct to manipulate, deceive or persuade someone into sending money to an account outside of their control.

Three features set this apart from other payment fraud.

The payer authorises the payment. In unauthorised fraud, an attacker takes over an account or a card. In an APP scam, the genuine account holder gives the instruction.
The money goes to an account the victim does not control, and is usually moved on quickly.
The deception can be run entirely by talking. A call from a person claiming to be the bank, a message from a person claiming to be a relative, or an advertisement for an investment can produce the payment without any technical intrusion.

Because of the first feature, strong authentication of the payer does not prevent the loss. The login, the one-time code and the biometric unlock all confirm that the right person is present, and the right person is the one who has been deceived.

The UK reimbursement requirement

The legal path

The Financial Services and Markets Act 2023 gave the PSR a duty to impose a requirement for reimbursement in qualifying cases of payment orders made following fraud or dishonesty; section 72 sets out the duty. The PSR then published its policy in stages. A June 2023 policy statement, PS23/3, set the position on the requirement. A December 2023 policy statement, PS23/4, finalised the parameters. A July 2024 amended Specific Direction 20 directs participants in the Faster Payments Scheme that provide relevant accounts to reimburse these payments and to comply with the reimbursement rules. The rules themselves are written by Pay.UK, the operator of Faster Payments, under what the PSR calls Specific Requirement 1. A parallel direction, Specific Direction 21, applies the CHAPS reimbursement requirement to participants in CHAPS. The start date for the requirement was 7 October 2024.

The main rules

Element	What the PSR's documents say
Who pays	The sending payment service provider reimburses the victim. Sending and receiving firms split the cost of reimbursement 50:50
Maximum per claim	£85,000 per claim from 7 October 2024, reduced from the £415,000 the December 2023 statement had set; the Bank of England set the same level for CHAPS
Excess	A sending firm may apply an excess of up to £100 to a claim, except for claims by vulnerable consumers
Who is covered	Consumers as Specific Direction 20 defines them: individuals; microenterprises, meaning enterprises that employ fewer than ten persons and have either an annual turnover or an annual balance sheet total that does not exceed €2 million; and charities with annual income below £1 million
Time	The PSR's page says most victims are reimbursed within five business days; the sending firm must reach an outcome after 35 business days, however often it has stopped the clock
Exception	The consumer standard of caution exception, which does not apply to vulnerable consumers

The 50:50 split, the five-day aim and the vulnerable-consumer protections appear on the PSR's page on APP scams. The maximum of £85,000 and its date are stated in policy statement PS24/7, of 2 October 2024, which also says that the Bank of England set the same level for CHAPS. The statement gives the PSR's expectation that this level would mean 99.8% of Faster Payments APP scams by volume and 90% by value are fully reimbursed, provided they fall within the scope of the policy. The excess and the original £415,000 level are in PS23/4. The 35-business-day outer limit, which applies however many times the clock is stopped, is described in PS23/4. The definition of who is a consumer comes from the definitions in Specific Direction 20 itself, which is the binding text; the PSR's dashboard page gives a shorter summary of it, and a reader who needs the scope should use the direction.

The consumer standard of caution

The exception most relevant to product design is the consumer standard of caution. In PS23/4 the PSR set the exception to consist of four requirements.

Regard to interventions. The consumer should have regard to interventions by the sending firm or by a competent national authority such as the police, and those interventions must clearly communicate the firm's or the police's assessment of the probability that an intended payment is an APP scam payment.
Prompt reporting. The consumer should report promptly on learning or suspecting that they have been a victim and in any event not more than 13 months after the last relevant payment was authorised.
Information sharing. The consumer should respond to reasonable and proportionate requests for information from the firm.
Police reporting. The consumer should, on request, consent to the firm reporting to the police on their behalf or report directly to a competent national authority.

A firm may refuse reimbursement only where a consumer who is not vulnerable has, with gross negligence, not met one or more of these standards. The PSR interprets gross negligence as a higher standard than negligence under common law, meaning the consumer must have shown a significant degree of carelessness. For a product team, the first requirement matters most: an intervention can support the exception only if it clearly says how likely the firm thinks the payment is a scam. A generic warning that appears on every payment does not meet that description.

What the PSR publishes

The PSR publishes a dashboard on the results of the policy, based on data that Pay.UK collects from sending firms. The version for the first quarter of 2026 was updated on 30 July 2026. Its statements, with the definitions the PSR attaches to them, are these.

For the 18 months from 7 October 2024 to 31 March 2026, 88% (£316 million) of the money lost to APP scams has been reimbursed to victims.
Consumers reported around 438,300 claims over the period, of which 301,500 were in scope for reimbursement.
82% of claims were closed within five business days, and 98% within 35 business days.
3% of claims were rejected because the customer did not take enough care over the transaction or their claim.

The PSR draws a conclusion from these figures: reimbursement rates for in-scope claims remained high, firms responded promptly, and there was no indication of people being significantly less cautious. That is the regulator's assessment, not a finding of this article.

The dashboard is explicit about what its data does and does not include, and a reader quoting it should keep the same limits.

It covers Faster Payments APP scams in the United Kingdom where the reported victim is a consumer in the sense of Specific Direction 20.
It includes only claims that were reported to firms and closed within the reporting period.
It excludes scams where both accounts are within the same firm.
Its accuracy depends on information from sending firms, and the PSR has no information from receiving firms to validate it.
The reimbursement rate is the value reimbursed divided by the value of reimbursable claims, and the page explains that the denominator includes amounts below the excess and above the cap, which it says could mean actual rates are higher.
The PSR compares its rate with a 61% reimbursement rate that UK Finance reported for personal accounts in 2024, but says it cannot make direct comparisons because of differences in scope, in the definition of APP scams, in the calculation and in the number of firms.

Do not put the 88% beside a figure from a different source as if both measured the same thing.

A change of regulator

HM Treasury has published its response to a consultation on the Payment Systems Regulator. The page, last updated on 21 April 2026, says that the government plans to consolidate the functions of the PSR within the Financial Conduct Authority and will bring forward primary legislation when parliamentary time allows. As of the fetch date, therefore, the rules above are the PSR's, and the institutional arrangement is expected to change. A reader should check the current position before citing the PSR as the regulator.

The European Union: verification of the payee

Regulation (EU) 2024/886

The European Union has not copied the British reimbursement design in its instant payments law. Regulation (EU) 2024/886 of 13 March 2024, published on 19 March 2024, amends the earlier regulation on credit transfers in euro and adds an Article 5c on verification of the payee. The article requires a payer's payment service provider to offer a service ensuring verification of the payee to whom the payer intends to send a credit transfer. The service must run immediately after the payer provides the payee information and before the payer is offered the possibility of authorising the transfer, whatever the payment initiation channel.

When the payer has entered an account identifier and the payee's name, the provider matches the two, and the payee's provider checks them on request. If they do not match, the payer's provider must notify the payer and inform them that authorising the transfer might lead to the funds going to an account not held by the payee indicated. If they almost match, the payer's provider must show the payer the name associated with the identifier. The article has parallel rules for legal persons identified by data such as a fiscal number, and for accounts held on behalf of several payees.

The article is also specific about consequences. A provider is not liable for executing a transfer to an unintended payee on the basis of an incorrect identifier, provided it has fulfilled the article's requirements. Where the payer's provider fails to comply and that failure results in a defectively executed transaction, it must refund the payer without delay, and a payee's provider whose failure caused the problem must compensate the payer's provider. Providers must also inform users of the implications for liability and refund rights if a user ignores a notification. Users that are not consumers must be given a means to opt out of the check when they submit payment orders as a package, and may opt in again at any time.

The article applies from 9 October 2025 to providers in Member States whose currency is the euro, and from 9 July 2027 to providers in Member States whose currency is not the euro. The regulation adds that the services must be provided to all users without charge.

Where it stops

The payee check addresses a specific class of loss: the money going to an account whose holder is not who the payer thinks. It protects against a mistyped identifier and against some redirection frauds, such as an invoice with changed bank details. It does not address the case where the name and the account match because the fraudster owns the account, which is the usual situation in an investment scam or a romance scam. In that case the check returns a match and the money goes to the person the payer intended, who is a fraudster or a mule.

A further EU step, not yet confirmed as law

On 27 November 2025 the European Parliament published a press release announcing that Parliament and Council negotiators had agreed on a Payment Services Regulation and a third Payment Services Directive. According to the release, a provider that fails to implement appropriate fraud prevention mechanisms will be liable for covering customers' losses, providers must check that the payee's name and identifier match and refuse the payment where they do not, and the receiving provider must freeze any transaction it finds suspicious. The release adds that where a fraudster impersonates a provider's employee, the provider must refund the full amount if the customer reports the fraud to the police and informs their provider, and that online platforms will be liable to providers that reimbursed customers if they were informed of fraudulent content and failed to remove it. This is a provisional political agreement as described by a press release. This article has not verified its formal adoption, its text or its dates, and a reader who needs those should check the Official Journal.

Where identity checks sit

The control points

A payment from a deceived customer passes several control points. Identity checks of the kind this site covers are relevant at some and not at others.

Control point	What happens there	Where identity verification fits
Opening the sender's account	The firm identifies the customer	Standard onboarding checks; they establish who the customer is and say nothing about whether the customer will be deceived later
Logging in and authorising	The customer proves they are present	Authentication of the genuine customer; it passes in an APP scam, because the customer is genuine
The moment of payment	The firm can warn, delay or ask questions	A step-up check can confirm that the person at the screen is the account holder; it cannot read the customer's intent, and whether the customer is being coached is a question for other controls
Checking the payee	The firm matches the name and the account	A form of identity check on the beneficiary account's naming, with the limits described above
Opening the receiving account	The firm identifies the person who will receive the funds	The point where identity verification bears most directly on the scam: a forged, stolen or synthetic identity used to open a receiving account can be caught here
Monitoring the receiving account	The firm watches inflows and outflows	Behaviour, not identity; but a check on a changed device or holder can matter
Recovery	The firms freeze and return funds	Needs a fast route between sending and receiving firms; the EU press release describes a duty to freeze suspicious transactions

The last column carries the point of the article. The UK regime splits the cost of reimbursement between the sending and the receiving firm, which gives the receiving firm a reason to care who it opens accounts for. That reason leads directly to the question of mule accounts, which the companion article takes up.

What an identity check cannot do

An identity check answers the question "is this person who they claim to be, and is the document genuine?". It does not answer "is this person being manipulated?", or "will this person pass the account on to someone else?", or "does this person know what the account will be used for?". A mule who is willing, or who is deceived into thinking the job is legitimate, can pass an identity check with a genuine document and a genuine face. This is not a defect of the check. It is a boundary of what the check measures, and a firm that sells or buys a check as a defence against APP fraud should be asked which control point it means.

What it can do

At the receiving end, identity verification can raise the cost of opening accounts with forged or stolen identities, can detect a document or a face already linked to another account where the firm's records allow it, and can add evidence that supports later monitoring and recovery. At the sending end, a step-up verification at a risky moment can show that the person at the screen is the account holder. Whether that person is being directed by a fraudster is a different question, for behavioural and interaction controls that this article does not assess, and that would need their own sources. The intervention of the clear kind that the standard of caution describes is the firm's own assessment of the payment, and an identity check does not supply it. Neither is a measured reduction in scams, and this article gives no figure for either.

Questions for a firm or a vendor

Which control point does this check serve: the sending account, the payment, the payee or the receiving account?
What does the check do when the genuine account holder is being coached by a fraudster?
If the check raises a warning, what does the warning say, and does it express the firm's own assessment of how likely the payment is to be a scam, as the standard of caution requires of an intervention?
How does the receiving side learn that an account opened with a verified identity has been used for a scam, and how fast does that information flow back?
Which data does the firm keep as evidence of the intervention and the customer's response, and for how long?
Does the firm compare figures about reimbursement or fraud with those of another source without checking the definitions?

Where this sits in a verification flow

A verification session in the NeuroVision platform is built from steps that the scenario defines, such as a document, a selfie and a liveness step. Used when a receiving account is opened, or when an existing account asks for a step-up before a risky action, those steps establish who is behind the account at that moment. They do not decide whether a payment is a scam, and the decision about a payment stays with the firm's own fraud controls. To discuss where a check fits in your flow, read the identity verification product page or contact the team.

Sources

All sources were fetched on 28 October 2026.

APP scams, Payment Systems Regulator.
Faster Payments System (FPS) and CHAPS participants, Payment Systems Regulator.
PS24/7 Faster Payments APP scams reimbursement requirement: Confirming the maximum level of reimbursement, Payment Systems Regulator, 2 October 2024.
PS23/4 Fighting authorised push payment scams: final decision, Payment Systems Regulator, December 2023.
Specific Direction 20 (July 2024): FPS APP scam reimbursement requirement, Payment Systems Regulator, July 2024.
APP scams reimbursement dashboard for Q1 2026, Payment Systems Regulator, updated 30 July 2026.
Financial Services and Markets Act 2023, section 72, legislation.gov.uk.
A Streamlined Approach to Payment Systems Regulation: consultation outcome, HM Treasury, last updated 21 April 2026.
Regulation (EU) 2024/886 of the European Parliament and of the Council of 13 March 2024, Official Journal of the European Union, 19 March 2024.
Payment services deal: more protection from online fraud and hidden fees, European Parliament press release, 27 November 2025.
Create a KYC session, NeuroVision documentation.