The bank transfer has a safety net now. It still needs a pause

A bank transfer can feel too ordinary for the risk it carries. A name, a sort code, an account number, a confirmation screen, and the money is gone. That smoothness is useful when the recipient is real. It is brutal when the recipient is a fraudster with a convincing story and a little urgency.

The UK now has a stronger public test case for what happens after that kind of scam. The Payment Systems Regulator says its mandatory reimbursement rules for authorised push payment fraud started on 7 October 2024. APP fraud is the awkward category where the customer authorises the payment, but does so because they have been tricked. It is not the same as a stolen card or an unauthorised withdrawal. The victim clicked send.

The first year of data is striking, but not simple. In a dashboard updated on 30 January 2026, the PSR said 88% of money lost to in-scope APP scams was reimbursed between 7 October 2024 and 30 September 2025. That was £173m returned to victims. The regulator recorded around 269,000 consumer claims, of which about 188,000 were in scope for reimbursement. It also said 82% of claims were closed within five business days and 98% within 35 business days.

Those numbers matter because they move scam reimbursement away from a patchwork of goodwill and towards a rulebook. They also show the limits of any rulebook. A reimbursement rate is not the same thing as prevention. It is the financial system repairing a break after the transfer has already happened.

The protections are specific. The PSR says the rules cover eligible UK bank transfers made through Faster Payments and CHAPS on or after 7 October 2024. They are aimed at individuals, microenterprises and charities. The maximum claim is £85,000, which the PSR says covers more than 99% of claims. The regulator says people can generally expect reimbursement within five business days of making a claim, while the Financial Conduct Authority's consumer page notes that some cases may take up to 35 working days and the first £100 of a claim may not be reimbursed.

This is where the public story needs care. The headline version, scam victims get their money back, is too broad. The rules do not cover every financial loss that happens near a transfer. Civil disputes, such as paying a real supplier and later arguing about the work, sit outside the APP fraud category. Card payments, cash and cheques have separate protections. Credit unions, municipal banks and national savings banks are not included in the PSR consumer summary of the reimbursement arrangements. Fraudulent claims are not protected. The PSR also says reimbursement can be denied where a customer is found to have been complicit or grossly negligent, though it calls gross negligence a high bar and says that exception does not apply to vulnerable consumers.

The distinction between authorised and unauthorised fraud is more than legal tidiness. The FCA's fraudulent payments guidance, last updated in May 2026, says an unauthorised payment should be refunded by the end of the next business day if the claim is valid. APP fraud is different because the customer made the payment instruction. That does not make the victim at fault. It means the bank, the receiving firm and the customer are dealing with a social engineering crime that used the payment system as its final step.

That is why the pause has become part of the product. Confirmation of Payee checks, warning screens and delayed decisions can feel irritating when a payment is legitimate. In a scam, those frictions may be the only moment when the story is tested before money moves. The PSR's regime also tries to pull receiving firms into the problem, because the account that receives stolen money is part of the route, not a neutral afterthought.

The same pattern shows up outside the UK, even where the legal protections differ. The US Consumer Financial Protection Bureau warns that scammers often impersonate a government agency, bank, business or family member; ask for money through a wire transfer, payment app, courier, cryptocurrency, prepaid card or gift card; and create pressure to act quickly. Its September 2025 warning page also notes that advances in artificial intelligence can make cloned voices and altered images more convincing.

That last detail is important. Scam prevention is often described as a checklist, but scams work because they are emotional and social. They borrow trust from a familiar institution, a relative, a landlord, a delivery, a romance, a bargain or a crisis. A person does not have to be foolish to respond badly to a convincing emergency. The better question is whether the payment process leaves enough room for doubt before the irreversible part begins.

The PSR dashboard gives a cautiously positive answer for reimbursement. It does not make transfers casual. Around 82% of claims being closed within five business days means many were resolved quickly, not instantly. Around 188,000 claims being in scope also means many reported claims were not. The 3% rejection rate for insufficient consumer caution was low, but it was not zero.

For readers, the useful lesson is unglamorous. Urgency is a risk signal. A bank warning is not just a legal cover note. A payee-name mismatch is not a technical nuisance. A request to move money to a safe account, or to pay through a method chosen by the caller, deserves more suspicion than politeness usually allows. None of that guarantees protection. It simply puts a little air between the story and the transfer.

Financial regulation often looks dull until a household needs it. The new UK reimbursement data suggest the backstop is now more predictable for many APP scam victims. That is real progress. But the safest money is still the money that never has to be recovered, and the most useful feature in a fast payment system may be the least glamorous one: a moment that slows the hand before the screen says sent.