UK introduces mandatory reimbursement rules to combat APP fraud

The UK's new mandatory reimbursement rules (the Reimbursement Rules) came into force on 7 October 2024. They aim to protect victims of authorised push payment fraud (APP Fraud). APP fraud is the most prolific financial scam in the UK and occurs where a fraudster tricks a victim into authorising payments to an account controlled by the fraudster. With £459 million lost in 2023, fraudsters often adopt sophisticated methods which are difficult to detect including using fake websites, intercepting email chains and, more recently, via the use of deepfake technology. The issue impacts both businesses and private individuals. 

Whilst there is a pre-existing voluntary code of reimbursement, that has not yielded consistent results, and for a number of years, there has been a debate as to who should bear responsibility for the cost of this type of fraud – should the cost be borne by the victims, the banks (and if so – whose bank – the victim's or the fraudster's), or should there be a centralised compensation fund? The reality has been that in many cases the costs have been borne by the businesses or individuals who have been targeted by the fraud, and in some cases by their banks or payment service providers, but often only after lengthy legal processes. 

In response, the Payment Systems Regulator (the PSR) has introduced a series of new, mandatory safeguards for payments made by Faster Payments and CHAPs made within the jurisdiction. The key changes under the Reimbursement Rules include: 

• UK in-scope Payment Services Providers (PSPs) will be required to reimburse all eligible customers who fall victim to APP fraud, subject to a consumer standard of caution.
• The sending PSP is responsible for determining whether the customer is entitled to reimbursement, and for payment of the reimbursable amount, but may seek a contribution of 50% from the receiving PSP.
• The reimbursements must be made within five business days, unless the PSP requires further information.
• There will be a maximum mandatory reimbursement amount of £85,000.
• There will be no minimum threshold for claims, but there will be a claim excess of £100 at the discretion of the PSP.
• Vulnerable customers will not be subject to the standard of caution nor the excess. 

The maximum mandatory reimbursement threshold was originally proposed as £415,000 in June 2024 but this was reduced following a PSR consultation in September 2024. This change came amid reports of lobbying, with opponents arguing (among other things) that the original amount might actually encourage fraudsters, as they may consider it less likely that steps would be taken to pursue them directly for an amount under the threshold. In its announcement, the PSR stated that the lower limit would cover 99% of claims (as the vast majority of APP frauds relate to values below £85,000) and reduce prudential risks for smaller PSPs. The revised limit also notably aligns with the government-backed Financial Services Compensation Scheme's compensation level for deposits and insurance policies.

The Reimbursement Rules aim to offer stronger protection against APP fraud by ensuring faster and fairer reimbursement processes whilst considering the needs of vulnerable individuals. However, international transactions, those exceeding the cap and/or those made by larger enterprises or organisations with annual income exceeding specified limits would be excluded from these protections. 

Victims of APP fraud that fall outside the Reimbursement Rules may instead have recourse under common law. The Quincecare duty established a bank's duty not to execute a payment instruction without checking its validity where it has grounds to believe that instruction is not a valid instruction. This typically arises where an agent is making a payment instruction on behalf of a principal (eg a company director giving an instruction on behalf of the company), but applies to businesses and individuals alike. The Supreme Court in Philipp v Barclays Bank UK plc clarified that this duty does not extend to APP fraud claims where the payment has been authorised by the account holder as that is a valid payment instruction which the bank must execute in accordance with its duty to carry out customer instructions. However, Philipp left open the possibility of PSPs being subject to a "retrieval duty" to take reasonable steps to retrieve misappropriated funds where they have been put on notice of relevant facts. 

The High Court recently dismissed an application to summarily dismiss a retrieval duty claim against a PSP in CPP v NatWest and Santander. So, whilst the Reimbursement Rules mark a significant step forward in protecting victims of APP fraud, it is likely that those falling out of scope will continue to focus on steps that can be taken to recover their funds through the courts, and we are likely to continue to see further case law in this area.