Authorised push payment (APP) scams, in which victims are manipulated into sending money themselves, have become the defining fraud problem of instant payments. Because the customer authorises the payment, traditional authentication does not stop it, and until recently the loss usually stayed with the victim. That settlement is breaking down. Regulators are reallocating liability to payment providers and, increasingly, to the telecoms and technology platforms where scams begin.
The UK: two years of mandatory reimbursement
Since 7 October 2024, UK payment firms sending or receiving Faster Payments and CHAPS have been required to reimburse victims of qualifying APP scams, with costs split between sending and receiving firms. The first year's data are encouraging for consumers. Between October 2024 and September 2025, 88% (£173 million) of money lost to reimbursable APP scams was returned; about 269,000 claims were made, of which 188,000 were in scope, around 15% fewer than the year before3. Firms resolved 84% of claims within five business days2.
The deeper question is whether liability changes prevention. The regulator's evaluation, published in mid-2026, estimated that APP losses over Faster Payments fell by about 21% after the requirement was introduced, equivalent to around £73 million a year, and that reimbursement rates rose from 54% to 65% on the broader measure it used; it also found inconsistent outcomes for some victims and plans a formal consultation in December 20264.
Yet the headline numbers are moving the wrong way. UK Finance reports that APP fraud losses rose 19% to £576.4 million in 2025, across 248,070 cases, while unauthorised fraud fell 5%; banks reimbursed £354.3 million, or 61% of APP losses. Investment scams accounted for £221.5 million, up 40%1. The pattern is consistent: as bank controls harden, criminals move further upstream, to the platforms and phone lines where persuasion happens.
Scams start outside the bank
UK APP fraud by channel of origin, share of cases and of losses, 2025, % (%)
Note: Remaining cases and losses originated through other channels.
Online channels account for two-thirds of APP cases but under a third of losses; telecoms account for fewer cases but, at 28% of losses, a disproportionate share of value, consistent with high-value impersonation and investment scams run by phone1. A reimbursement regime that binds only payment firms asks banks to pay for failures they cannot fully see.
Our view: reimbursement shifts who pays for scams. Only shared data between banks, telcos and platforms shifts how many scams happen.
The EU: verify first, refund impersonation
The EU has started with prevention at the point of payment. Under the Instant Payments Regulation, payment providers in the euro area have had to offer verification of payee, checking that the name and IBAN match, before every credit transfer since 9 October 2025; providers outside the euro area follow by 9 July 20275. The PSD3/PSR package agreed in November 2025 goes further: providers must refund customers in full when a fraudster impersonates the provider's own staff, provided the victim reports it to the police; online platforms become liable to providers that have reimbursed victims if they were told about fraudulent content and failed to remove it; and the rules reach electronic communications providers in some cases6. Formal adoption of the package was still pending as of August 20267.
The EU and UK approaches are converging from opposite ends. The UK started with liability and is now pushing prevention upstream; the EU started with prevention at the point of payment and is adding targeted liability. Both leave banks carrying most of the direct cost while the channels where scams originate remain lightly obligated. That imbalance is the next policy battleground.
Australia: shared duties by statute
Australia has taken the most explicit shared-responsibility approach. The Scams Prevention Framework Act 2025 places obligations on banks, telecommunications providers and digital platforms to prevent, detect, disrupt and respond to scams, with consumers able to seek redress from businesses that fail to meet them. Treasury's May 2026 exposure drafts proposed that the SPF rules commence on 1 September 2026 and the sector codes by 31 March 2027; the draft banking code requires payee confirmation before electronic funds transfers, controls on high-risk transactions and recall requests for suspected scam payments8. The backdrop: Australians reported A$2.18 billion of scam losses in 2025, up 7.8% on 2024 but about 30% below the 2022 peak, with investment scams alone costing A$837.7 million9.
Investment scams dominate losses
Top five scam types by reported loss, Australia, 2025, A$ million (A$m)
Note: Combined reports to Scamwatch, ReportCyber, IDCARE, AFCA, banks and payment providers.
Globally the problem is vast, if hard to measure. The Global Anti-Scam Alliance's 2025 survey of 46,000 adults in 42 countries estimated $442 billion lost to scams in the previous year, and found that 64% of scams concluded within a day of first contact10. Speed is the attacker's advantage; data sharing is the defender's.
What banks should do now
- Score the payee, not just the payer. Receiving-side analytics, mule detection and verification-of-payee outcomes are as important as sender authentication under 50:50 cost-sharing.
- Engineer friction by risk. Targeted delays, confirmations and conversations for high-risk first-time payments, rather than blanket warnings customers ignore.
- Build the data bridges. Structured intelligence exchange with telcos and platforms on numbers, domains, accounts and adverts, as Australia's framework will require.
- Industrialise claims. Fast, consistent decisions, with evidence captured for cost-recovery from receiving firms and, in future, platforms.
The UK experience offers a clear lesson for other markets. Liability shifted behaviour quickly: faster claims decisions, more intervention on risky payments and more attention to the receiving side of the transaction. But it did not reverse the growth in losses, because the scam economy adapts faster than any single sector's controls. Reimbursement is a floor for consumer protection, not a strategy for reducing fraud.
For banks, the practical agenda is to be excellent at the parts they control, to evidence that excellence in every claim, and to push hard, commercially and through policy engagement, for the telecoms and platform obligations that Australia has legislated and the EU has begun to adopt. The banks that do this well will turn scam prevention from a rising cost into a source of customer trust.