Scam reimbursement: who bears the cost of fraud in the UK, the EU and Australia
In short: payment firms bear the cost of scam reimbursement in the UK, and the platforms and networks where scams begin do not contribute. Since 7 October 2024 the sending and receiving payment service providers split each authorised push payment (APP) scam refund 50:50, up to £85,000. Under the EU’s agreed Payment Services Regulation an online platform would repay a refunding payment firm in defined cases. In Australia one scams regime applies to banks, telecoms providers and digital platforms, with most obligations applying from 31 March 2027.
When a consumer in the UK is tricked into sending money to a fraudster, the payment firm that sent the money and the payment firm that received it refund the victim in equal shares. The social media platform, website or phone network where most of these scams begin does not contribute to that refund. In the EU and Australia the cost is allocated differently. The UK reimbursement requirement is moving from the Payment Systems Regulator (PSR) to the Financial Conduct Authority (FCA), and an independent review has recommended an anti-fraud levy on digital and communications providers.
Key points
- UK APP scam losses were £576.4 million in 2025, up 19 per cent. Source: UK Finance, Annual Fraud Report 2026, 15 June 2026
- 66 per cent of APP scam cases began online (32 per cent of losses) and 17 per cent began via telecommunications (28 per cent of losses). Source: UK Finance, Annual Fraud Report 2026
- 88 per cent (£316 million) of the money lost to APP scams was reimbursed in the first 18 months of mandatory reimbursement. Source: PSR, APP scams reimbursement dashboard, updated 30 July 2026
- Reimbursement is estimated to have cut APP scam losses by about £73 million a year. Source: PSR, independent evaluation, 1 July 2026
- Under the EU’s agreed Payment Services Regulation, a hosting provider, such as an online platform, would compensate a payment firm for refunds of unauthorised payments and impersonation scams, where the provider failed to remove the illegal content once aware of it. Source: European Parliament, November 2025
- Australia’s Scams Prevention Framework applies to banks, telecommunications providers and digital platforms, and most of its obligations apply from 31 March 2027. Source: ACCC
| Question | UK (mandatory reimbursement) | EU (agreed Payment Services Regulation) | Australia (Scams Prevention Framework) |
|---|---|---|---|
| Who refunds the victim | Sending and receiving payment firms, 50:50, up to £85,000 per claim | The payment firm would refund in full where a fraudster pretended to be that firm using communication channels attributed to it and the consumer reported the fraud to the police and the firm | An entity that breached its obligations, through its internal dispute process and then the Australian Financial Complaints Authority |
| Duties on online platforms | Online Safety Act 2023 illegal content duties; fraudulent advertising duties for the largest services once Ofcom’s code is in force | Very large platforms and search engines would check that advertisers of financial services are authorised or exempt | Prevent, detect, report, disrupt and respond to scams |
| Duties on telecoms providers | Ofcom General Conditions on number misuse; new Ofcom rules on mobile messaging scams; an offence of possessing a SIM farm, from 29 October 2026 | Electronic communications providers would have to take measures against impersonation fraud, including caller ID spoofing | The same principles, with the Australian Communications and Media Authority as sector regulator for telecoms |
| Does the platform or telecoms provider contribute to the loss | No | A hosting provider that fails to remove illegal content once aware of it would compensate the payment firm for refunds of unauthorised payments and impersonation scams | Yes, where it breached its obligations |
| Status | In force since 7 October 2024 | Politically agreed in November 2025; applies after formal adoption and publication | Act passed in February 2025; most obligations apply from 31 March 2027 |
The UK: payment firms refund and platforms and networks have prevention duties
Payment firms in the UK must refund most victims of APP scams. Under section 72 of the Financial Services and Markets Act 2023 the PSR was required to impose a reimbursement requirement on payments made over the Faster Payments Scheme. From 7 October 2024, payment firms in Faster Payments have had to comply with the reimbursement rules issued by Pay.UK under PSR Specific Direction 20. For CHAPS, the Bank of England sets equivalent rules and payment firms must comply with them under PSR Specific Direction 21. Under the PSR’s consolidated policy statement PS25/5, the sending firm must normally refund the victim within five business days, up to £85,000 per claim, and the cost is generally split 50:50 with the receiving firm. The sending firm may apply an excess of up to £100 and may refuse a claim where the consumer acted fraudulently or with gross negligence, but neither the excess nor the gross negligence exception applies to a vulnerable consumer.
Of the money lost to APP scams, 88 per cent was reimbursed over the first 18 months, and losses are estimated to have fallen by about £73 million a year (PSR, APP scams reimbursement dashboard; PSR, independent evaluation, 1 July 2026). The reasoning behind those figures is set out in APP fraud reimbursement: the evidence after one year.
Online platforms and telecoms providers are subject to prevention duties but make no contribution to the refund. Since 17 March 2025, user-to-user and search services have had to assess and manage the risk of illegal content, including fraud, under the Online Safety Act 2023. The largest services will also be subject to fraudulent advertising duties under sections 38 and 39, which apply from the day the first fraudulent advertising code of practice comes into force (section 51(7)); Ofcom consulted on that code from July to October 2026 and plans its statement by mid-2027. Telecoms providers must stop the numbers allocated to them being misused, a duty Ofcom enforces, as described in Ofcom number misuse: what General Condition B1 requires of providers, and Ofcom has made new rules on mobile messaging scams that apply to person-to-person messages from 18 January 2027 and to application-to-person messages, such as those sent by businesses, from 15 July 2027.
The UK Government “remains committed to maintaining mandatory reimbursement” (Home Office, Fraud Strategy 2026 to 2029) and has not proposed that platforms or telecoms providers fund it. UK Finance has said that tech and telecoms firms should be required to contribute financially, as well as sharing expertise and intelligence to support fraud prevention. Jonathan Fisher KC, in his independent review Fraud in the Digital Age (CP 1600, July 2026), recommended an anti-fraud levy on digital and communications infrastructure providers, including social media platforms, with the funds ring-fenced for law enforcement capability, public awareness campaigns and fraud detection technology.
The EU: refunds for impersonation and a claim against platforms
The European Parliament and the Council reached political agreement on the EU’s Payment Services Regulation in November 2025. Under the agreed text the victim would have a narrower refund right than in the UK, and the payment firm would have a route to recover from a platform. Where a fraudster pretends to be the consumer’s payment firm using communication channels attributed to that firm, the firm would have to refund the full amount, provided the consumer reports the fraud to the police and informs the firm without undue delay. The firm would have 15 business days from notification and receipt of the police report to refund, unless it has objectively justified reasons to suspect fraud or gross negligence by the consumer (Article 59 of the Council’s compromise text; European Parliament, November 2025). Payment firms would also have to check that the payee’s name matches the account identifier and warn the payer of any mismatch.
A hosting service, such as an online platform, that stores fraudulent content and fails to remove it once aware of it, and so loses its protection under the EU’s Digital Services Act, would have to compensate the payment firm for refunds of unauthorised payments and impersonation scams (Article 78, headed “Right of recourse”). Advertisers of financial services would have to show the largest platforms and search engines that they are authorised or exempt, and some duties would apply to electronic communications providers. The Council and the Parliament have yet to adopt the agreed text formally: the Council is to adopt its position first, and the Parliament’s indicative plenary date is 14 December 2026; the final article numbering will be fixed at publication in the Official Journal.
A payment firm in the UK has no statutory equivalent of the EU recourse right: a firm that refunds a victim of a scam advertised on a platform bears the whole cost with the receiving firm, whatever the platform did after it was told about the advert. Platform liability under the EU’s Digital Services Act is a separate question, discussed in The AliExpress DSA fine and the UK marketplace gap.
Australia: one scams regime for banks, telecoms providers and digital platforms
The same scams obligations apply in Australia to three sectors at once. The Scams Prevention Framework Act 2025 inserted Part IVF into the Competition and Consumer Act 2010, which requires each regulated entity to meet six principles: governance, prevent, detect, report, disrupt and respond. The Australian Competition and Consumer Commission (ACCC) is the general regulator and regulates digital platforms, with the Australian Securities and Investments Commission for banks and the Australian Communications and Media Authority for telecoms providers. In May 2026 the Australian Government designated banking, telecommunications and three digital platform services (social media, instant messaging and search engine advertising) as the first regulated sectors.
Each regulated entity will have to run an internal dispute resolution process, and had to join an external scheme, the Australian Financial Complaints Authority, by 1 September 2026. Most obligations will apply from 31 March 2027 (ACCC). There is no UK-style refund right under the Act. A victim may claim for loss caused by a regulated entity’s breach of the principles or of a sector code, by complaint through the dispute schemes or by action under section 58FZC of the Competition and Consumer Act 2010, and the Australian Government has proposed, but not yet made, rules for automatic reimbursement of verified losses below 3,000 Australian dollars.
Who bears the loss under each of the three models
In the UK the first loss falls on the payment firms in most cases, so the victim has one place to go and a deadline for an answer. In the EU the first loss would also fall on the payment firm, but for a narrower set of cases led by impersonation of that firm, and the firm could then recover from a platform that ignored notice of the fraud. In Australia a victim may claim from whichever of the bank, telecoms provider or platform failed to meet its obligations, so each sector has a financial stake in its own prevention record.
A UK victim gets speed and certainty, UK payment firms have a strong reason to stop scam payments, and losses are estimated to have fallen as a result (PSR, independent evaluation, 1 July 2026). The platform or network where the scam began has no direct financial stake in the refund, and a platform that pays a regulatory fine does not thereby compensate the victim or the refunding firm. Under the EU and Australian models more of the cost is borne by the source of the scam, and the victim’s route to a refund is narrower or slower.
Implications for UK payment firms, platforms and telecoms providers
UK payment firms bear the cost of every refund paid today. The Financial Services and Markets Bill would abolish the PSR, and HM Treasury has said that it will ensure transitional provisions are made to transfer the reimbursement requirement to the FCA, which will then decide its approach (HM Treasury, April 2026, para 2.14). Before the transfer, the PSR plans to consult in December 2026 on changes to the reimbursement rules, including the consumer standard of caution and payments to accounts the consumer controls, and to report on the platforms and services fraudsters use (PSR, APP scams policy roadmap). The Bill’s effect on the PSR is described in Financial Services and Markets Bill 2026: PSR absorbed into the FCA. A requirement for platforms or telecoms providers to contribute would need new legislation.
Platforms and telecoms providers in the UK remain subject to prevention duties enforced by Ofcom, with the fraudulent advertising duties and the new messaging rules still to come into force. Groups that also operate in the EU or Australia will be subject to a different allocation there: once the EU text applies, a recourse claim from payment firms, and in Australia, dispute resolution and compensation for breach. For payment firms launching new products such as open banking and variable recurring payments, the allocation that applies to each payment journey is a design question, and the related advice is described on the payments product and scheme governance page.
Viewpoint
A UK victim has one certain route to a refund, and the reimbursement requirement is estimated to have reduced losses. I read the EU and Australian models as attempts to make the business where a scam begins pay part of the cost; in the UK that business pays nothing towards the refund.
Platforms and telecoms providers in the UK owe prevention duties but have no mechanism for contributing to the refund. The Fisher review recommended a levy on digital and communications providers, but the money would fund law enforcement, awareness and detection rather than refunds, and any levy would need legislation; the FCA will decide how the payment firms’ share is set once it takes over the reimbursement requirement.
Frequently asked questions
Who pays for APP scam reimbursement in the UK?
The sending and receiving payment firms. Since 7 October 2024 the sending firm must refund an eligible victim of an APP scam paid over Faster Payments or CHAPS, up to £85,000 per claim, and the cost is generally split 50:50 with the receiving firm. Online platforms and telecoms providers do not contribute to the refund.
Do social media platforms have to refund scam victims in the UK?
No. Platforms are subject to Online Safety Act 2023 duties to manage the risk of fraud, and the largest will be subject to fraudulent advertising duties once Ofcom’s code is in force. Jonathan Fisher KC’s independent review has recommended an anti-fraud levy on digital and communications infrastructure providers, including social media platforms.
What would a payment firm have to do about impersonation scams under the agreed EU Payment Services Regulation?
Under the text agreed in November 2025, a payment firm would have to refund the full amount where a fraudster pretends to be the firm using communication channels attributed to it, provided the consumer reports the fraud to the police and the firm. A hosting provider that fails to remove fraudulent content once aware of it would have to compensate the payment firm that refunded the consumer. The Council and the Parliament have yet to adopt the text formally.
Does Australia require banks to reimburse scam victims?
Not in the way the UK does. Under the Scams Prevention Framework Act 2025, banks, telecommunications providers and digital platforms must meet the same prevention obligations, and a victim may claim from an entity that breached them, with complaints that are not resolved internally going to the Australian Financial Complaints Authority. Most obligations apply from 31 March 2027.
Rob Bratby speaks on the “Who pays for fraud” panel at Open Banking Expo in London on 14 October 2026. For advice on scam reimbursement and the fraud duties of payment firms, platforms and telecoms providers, contact Rob Bratby at Bratby Law.
