Scam payments and your business: what UK bank reimbursement covers

If a fraudster tricks you into sending a bank transfer, can you get the money back? For many small businesses the answer is now yes, but only if you know the rules before it happens. Since October 2024, UK banks have had to reimburse most victims of authorised push payment (APP) scams. This guide explains who is covered, what the limits are and what a small business should do this week.

What an APP scam looks like for a business

An APP scam is one where you authorise the payment yourself, because someone has deceived you. Typical business versions include a fake invoice from a "supplier" who has supposedly changed bank details, a message that looks like it comes from your own director asking for an urgent transfer, or a caller pretending to be your bank and asking you to move money to a "safe account".

Because you approved the payment, banks used to treat these cases as your problem. That has changed for payments that fall inside the Payment Systems Regulator (PSR) rules.

What the rules say

The PSR's reimbursement requirement has applied to payments made from 7 October 2024. According to the PSR, it covers payments sent by Faster Payments or CHAPS from one UK bank account to another, and the sending and receiving firms share the cost of reimbursement 50:50. The PSR says most victims are reimbursed within five business days.

The main points for a business owner, taken from the law firm Hogan Lovells and from Santander's published guidance for business customers:

• The cap: up to £85,000 per claim.
• Time limit: you must report the scam within 13 months of the final payment to the fraudster in that scam.
• Speed: a refund is due within five working days, unless the bank needs more information. In that case the bank can pause the clock, but it must give a final decision within 35 working days.
• Excess: banks may apply an optional excess of £100 per claim. Santander, for example, deducts a fixed £100, so a £1,000 claim would be refunded as £900 and a claim of £100 or less would receive nothing. Other banks may handle this differently, so check yours.

Is your business covered?

This is the part owners most often miss. Hogan Lovells describes the in-scope customers as consumers, micro-enterprises and charities. Santander says the rules apply to business customers that are micro-enterprises, and it does not define the term on that page, so you would need to ask your own bank. The PSR's own dashboard describes small businesses and charities with annual income under £1 million as in scope under its direction, and it does not mention larger businesses.

The practical conclusion is simple: do not assume. Very small businesses are the most likely to be covered, and larger or growing companies may fall outside the rules. Ask your bank in writing whether each of your business accounts counts as a micro-enterprise for these rules.

What is not covered

Santander lists several types of payment that sit outside the PSR rules:

• Payments made by cheque, cash or card, or sent outside the UK.
• Payments to your own account at another bank.
• Payments for unlawful purposes.
• Payments that are part of a civil dispute, for example a disagreement with a supplier over poor goods.

The last one matters. If you paid a real supplier who then failed to deliver properly, that is a dispute rather than a scam, and it is not treated in the same way. Santander also says it reviews all APP fraud claims case by case, even where the PSR rules do not apply.

When a bank can refuse

Hogan Lovells explains that a bank need not reimburse if the customer committed fraud, or if, through gross negligence, they failed to meet the "standard of caution". That standard covers four things: paying attention to specific interventions or warnings from the bank or a competent authority, reporting promptly (no later than 13 months), responding to reasonable information requests, and agreeing to share details with the authorities after a claim. The bank has to prove gross negligence, not just assume it.

In practice, this means the warnings your bank shows when you make a payment are not a formality. Santander's guidance tells customers to pay attention to warnings, report the scam as soon as possible, provide information when asked and report to the police or let the bank do so.

How well is it working?

The PSR's reimbursement dashboard covers the 18 months from 7 October 2024 to 31 March 2026. Over that period, 88% of the money lost to APP scams (£316 million) was reimbursed, and the first quarter of 2026 reached 89%, which the PSR describes as the highest since the policy began. 82% of claims were closed within five business days, and 98% within 35 business days. Only 3% of claims were rejected for insufficient consumer caution. The PSR notes that its figures are not directly comparable with the 61% that UK Finance reported for 2024 on personal accounts.

So the headline picture is positive. The mood in the commentary I read is that customers are clearly better off, though banks carry a real cost and results are not perfectly consistent. Burges Salmon, summarising PSR data for the first year, also notes that Financial Ombudsman Service figures reported by The Guardian show the Ombudsman overturning a bank's refusal to reimburse in around 30% of cases at several major banks, across fraud claims generally. If a bank refuses your claim, it can be worth challenging.

What to do this week

• Ask your bank: confirm whether your business accounts count as in scope, what the excess is and how to report a scam out of hours.
• Write down the reporting route: keep the fraud phone number and process where every person who makes payments can find it. Speed matters, and the 13 month limit is a long-stop, not a target.
• Verify changes of bank details: phone the supplier on a number you already hold, not the one on the new invoice or email.
• Add a second pair of eyes: for larger or first-time payments, require a second person to approve them where your banking setup allows.
• Read the warnings: train staff not to click past payment warnings, because ignoring them can count against a claim.
• Keep evidence: save the emails, messages and call details, since the bank can ask for information and expects a prompt reply.
• Check your wider security: many of these scams start with a hacked email account, so strong sign-in protection matters. Our cloud and security team can help with that.

The bottom line

Mandatory reimbursement is a genuine safety net, and the regulator's data suggests it is working for most people. It is not a reason to relax. The cap, the excess, the in-scope definition and the standard of caution all affect what you would actually get back, and card payments, international transfers and disputes with real suppliers sit outside it. Spend ten minutes this week confirming your position with your bank, and make sure everyone who can move money knows what to do the moment something feels wrong.