APP scam reimbursement: what UK microbusinesses and charities should know

A bank-transfer scam can look like an ordinary supplier payment until the money has already left the account. A criminal may impersonate a supplier, director, accountant or other trusted contact and persuade a business to authorise the transfer itself. That is why authorised push payment, or APP, fraud is different from an unauthorised card transaction.

For qualifying UK payments, there is now a mandatory reimbursement regime. Importantly for Cherry Money's audience, the Payment Systems Regulator says the protections are not limited to private individuals: they also apply to microenterprises and charities. With the second anniversary of the regime approaching on 7 October 2026, it is a useful time for small organisations to understand both their rights after a scam and the controls that can reduce the risk before money is sent.

What the APP reimbursement rules cover

The protections started on 7 October 2024 and apply to qualifying scam payments made on or after that date. They cover UK bank transfers where money moves from one UK account to another through Faster Payments or CHAPS. Card payments, cash and cheques have different protection arrangements.

The PSR says the regime covers individuals, microenterprises and charities. Its latest Faster Payments dashboard describes the covered consumer population as including individuals, small businesses and charities with annual income below £1 million. Whether a particular organisation and payment fall within the legal scope depends on the rules and the facts of the claim, so businesses should report suspected APP fraud to their payment provider rather than assuming they are excluded.

What the latest PSR data shows

The PSR's dashboard, updated on 30 July 2026, contains the latest published Faster Payments reimbursement data through 31 March 2026. Across the first 18 months of the regime, the regulator reports that 88% of the value of reimbursable APP scam losses was returned to victims, representing £316 million. Around 301,500 reported claims were reimbursable.

Speed has also been relatively high. The PSR says 82% of claims were closed within five business days and 98% within 35 business days. In Q1 2026, around 58,400 reimbursable claims were closed. These figures are useful evidence of how the regime is operating, but they are not a guarantee for an individual claim and the dashboard data is for Faster Payments, not every possible fraud or payment method.

What to do immediately after a suspected APP scam

1. Stop any further payments connected with the request. If the fraudster is still communicating, do not send a second payment to 'unlock', 'refund' or 'verify' the first one.
2. Contact your bank, building society or payment provider immediately using a trusted channel. Tell them you believe you have made an APP scam payment and ask them to open a reimbursement claim and attempt recovery.
3. Preserve the evidence. Keep the invoice, email chain, WhatsApp or SMS messages, bank-detail change request, call notes, payment approval record and any Confirmation of Payee result or warning.
4. Respond promptly to reasonable information requests from your payment provider, after checking that the request itself is genuine. The PSR also says claimants should report the matter to the police or consent to their provider doing so on their behalf when required.
5. Do not wait for the 13-month deadline. The rules allow claims to be reported within 13 months of the fraudulent payment, but fast reporting gives the payment firms a better opportunity to trace or freeze funds.
6. Keep the accounting trail clear. Record the outgoing payment, the fraud claim and any later reimbursement as separately traceable transactions. Do not treat a potential reimbursement as certain cash until it has actually been agreed or received; ask your accountant about the appropriate accounting and tax treatment for your circumstances.

When reimbursement can be refused

Mandatory reimbursement is not unconditional. The PSR says a claim will not be reimbursed where the customer was complicit in the fraud. It may also be rejected for gross negligence, although the regulator describes gross negligence as a high bar and says that exception does not apply to vulnerable consumers.

Other situations can sit outside the regime, including private civil disputes, international payments and payments made using payment systems outside the qualifying Faster Payments or CHAPS rules. This is another reason to describe the event accurately to the bank and provide the original evidence rather than trying to decide the legal category yourself.

Five payment controls worth adding before the next supplier run

1. Treat every supplier bank-detail change as a separate risk event. Verify the change through a known phone number or another trusted channel, not the contact details in the change request itself.
2. Use Confirmation of Payee when your bank or payment provider offers it. Pay.UK describes CoP as an account-name checking service that helps show whether the name, sort code and account number correspond to the intended account holder. A mismatch or close match is a reason to investigate, not to click through automatically.
3. Separate invoice approval from beneficiary changes. Someone who can approve a legitimate invoice should not automatically be able to replace the supplier's bank details and release the payment without another check.
4. Add a second approval for high-value payments, new payees and unusual payment requests. A simple maker-checker process can interrupt the urgency and social engineering that many APP scams rely on.
5. Retain payment evidence. Keep supplier details, approvals, bank warnings, payee-check results and payment references together so that the business can investigate quickly if a transaction is challenged.

Confirmation of Payee helps, but it is not a guarantee

Pay.UK says Confirmation of Payee checks the account name and other payment details when a new payee is set up or details are amended. The possible outcomes include a match, close match, no match or an unavailable result. It can reduce misdirected payments and some types of APP fraud, but Pay.UK explicitly says a CoP check does not automatically guarantee that fraud will be detected or that a later claim will be reimbursed.

The practical lesson is to use CoP as one control within a wider payment process. An exact name match cannot tell you whether the person who emailed the invoice is genuine, whether a supplier's mailbox has been compromised or whether a director's urgent payment instruction is authentic.