APP scams: What you need to know about getting your money back

The number of authorised push payment (APP) scams has soared over the last year, but a new voluntary code should help victims get their money back. Here's everything you need to know.

Bank customers who are conned into sending money to fraudsters' accounts should find it easier to get compensations from today after various banks signed up to a new industry code.

The voluntary code has been brought in to help victims of authorised push payment (APP) scams, which cost Brits a staggering £354 million in the last year alone.

But while the new rules increase the support on offer, it doesn’t mean every victim will automatically get their money back.

We reveal everything you need to know about how the code works and what it covers.

What is the voluntary code?

The APP Scams Steering Group, which was established by the Payment Systems Regulator (PSR) in February 2018, has led the development of a new industry code for APP victims.

In a nutshell, the code aims to protect customers by reimbursing them if they are fall victim to an APP scam. It only covers victims of APP scams and unfortunately will not be applied retrospectively.

Companies who choose to adopt this code must have procedures to detect, prevent and respond to APP scams, or they may have to reimburse victims.

Banks can look a customer’s behaviour and transaction data to identify payments that are at a ‘higher risk’ of being an APP scam, and may issue warnings of a potential scam when someone sets up a new payee, amends one, or just before they authorise a payment.

If a bank chooses to adopt this code, they must also take “reasonable steps” to prevent accounts from being used to launder the proceeds from APP scams. 

How do APP scams work?

APP scams involve the victim transferring money to another account, which they believe is owned by a legitimate payee – but is in fact controlled by a scammer.

Some scams may involve calls from the victim’s bank claiming their account has been compromised.

Unfortunately, some people can be tricked by what looks like a legitimate number or by the scammer’s knowledge of their recent transactions.

The amount of money people have lost from APP scams is staggering as a collective £354.3 million was lost in 2018, according to UK Finance.

Worryingly, the amount lost by victims soared by 50% from £236m in 2017.

Who has adopted the voluntary code?

Eight payment service providers, representing 17 consumer brands and over 85% of authorised push payments, have signed up to the voluntary code. 

The table below lists all the brands that are currently signed up.

It's worth mentioning that TSB, while not in the table below, guaranteed all APP scam will get their money back in a separate announcement back in April. 

I’ve lost money during a scam! Am I guaranteed to get my money back?

According to the voluntary code, companies can choose not to reimburse a customer in some cases.

For example, if someone ignores any “effective warnings” by a bank when setting up a new payee, amending an existing payee or immediately before making the payment, they may not get their money back.

The code also states a customer may not be reimbursed if they made a payment without a “reasonable basis” for believing they were paying the right person or for genuine goods or services.

If a small firm or charity falls victim to an APP scam but did not follow its own internal procedures for approving payment, they may not be reimbursed – if those procedures would have been effective in preventing the scam.

‘Grossly negligent’ customers may also not get their money back, but this term has not been defined in the code.

Vulnerable customers are assessed on a case-by-case basis, as several factors need to be considered when deciding on reimbursement.   

In a situation where both the bank and the customer have failed to follow the requirements set out in the code, then the customer will be reimbursed some, but not all, of their money.

How scammers stole £18,000 off my dad

How long would it take for me to be reimbursed for any stolen funds?

The bank should decide whether to reimburse a customer no later than 15 business days after the day the scam was reported by the customer.

If the bank decides to reimburse the customer, they should “without delay.”

If a customer is unhappy with the outcome, they should contact the bank. But if there’s no resolution with the bank, they can then refer the complaint to the Financial Ombudsman Service.

APP fraud: my battle to get compensation after I lost £17,000

Who is paying to reimburse APP scam victims?

Victims have lost over £350 million to transfer scams last year alone so, assuming most people are compensated in the coming 12 months, we are looking at some pretty substantial sums.

In most cases, the banks will reimburse victims and then get reimbursement from the "no-blame" fund established by Barclays, HSBC, Lloyds, Metro Bank, Nationwide, Royal Bank of Scotland and Santander.

Long-term funding arrangements are still being agreed by the banks under the voluntary code as the current fund is a temporary solution until the end of this year. 

The banks will pay for any approved reimbursement, but the exact proportion paid by the banks will be determined by whether one party (or both) failed to protect a customer from an APP scam.

If neither bank is at fault, the customer’s bank can apply to the “no-blame” fund to recoup reimbursement costs.