What is APP fraud, and can you get the money back?
Every security control worked perfectly. That is the problem. You authorised it.
Nothing was bypassed. The deception happened before the payment began.
Why it is different from card fraud
Card fraud is a pull. Someone takes money using your details, you did not authorise it, and there is a well-developed machinery for getting it back: chargebacks, reason codes, liability rules, a network that arbitrates.
APP fraud is a push. You sent it. There is no chargeback for a bank transfer, because a transfer is not a claim against a merchant; it is an instruction you gave and the bank carried out correctly. Once the funds land and are moved on, usually within minutes through a chain of accounts, there is nothing to reverse.
This is why the fraud migrated. As card security hardened, deceiving the customer became easier than defeating the controls, and impersonation of banks, police, delivery companies, employers and family members became the dominant pattern. The technical defences were never the target.
What changed
`[verified Aug 2026]` The UK introduced mandatory reimbursement on 7 October 2024, covering Faster Payments and CHAPS. The core of it:
- Reimbursement is required for most victims, with a cap of £85,000, aligned with the deposit-protection limit. This was lowered from an originally proposed £415,000 during consultation, and stale sources still quote the higher figure. - The cost is shared fifty-fifty between the sending and the receiving provider, which is the structural innovation. Receiving banks now carry liability for accounts opened on their books, which gives them a direct financial reason to care about who they onboard. - Refunds within five business days, extendable to 35 where investigation is needed. - A firm may apply an excess of up to £100, and may decline where the customer fell below a standard of caution. Neither applies to vulnerable customers. - Civil disputes are excluded. A purchase that went badly is not a scam.
An independent evaluation published by the regulator in July 2026 found APP losses over Faster Payments fell by roughly a fifth after the rules came in.
Other jurisdictions are moving along similar lines with different structures, including Australia's Scams Prevention Framework and Singapore's Shared Responsibility Framework. India, the EU and the US handle this differently again, and none of the above applies outside the UK, so the practical answer to "can I get it back" depends entirely on where the payment was made.
What actually helps
Speed. Report it to the bank immediately, not after gathering evidence. Funds are sometimes still recoverable in the first hour and rarely after that.
Confirmation of payee. The check that warns you the account name does not match what you typed exists specifically for this fraud. It is worth reading rather than clicking through, and a mismatch is close to conclusive.
Recognising the shape rather than the story. The stories are endlessly inventive. The shape is always the same: urgency, a reason not to hang up or verify independently, and a request to move money to safety. No bank, tax authority or police force asks anyone to transfer money to a safe account. That single fact defeats most of it.
The difference between having your wallet lifted from your pocket and handing it to someone who convinced you they were a police officer. In one case the lock failed. In the other you opened the door yourself, and for a long time that meant you bore the loss alone.
Where you meet it
Every warning screen your bank added between typing an account number and sending. Every "does this name match" prompt. Every story about someone sensible who lost money to a call that sounded exactly right.