Britain’s experiment in forcing banks to refund fraud victims has completed its first full year, and the regulator now has an independent read on whether the mandate worked. The verdict from the Payment Systems Regulator is that it did, at a price the industry is still absorbing.
The PSR’s mandatory reimbursement regime took effect on 7 October 2024. For the first time, anyone tricked into authorising a payment to a criminal, the category known as authorised push payment or APP fraud, has a legal right to be refunded by their bank or payment provider, up to a set limit and typically within five business days. An independent evaluation by Frontier Economics, published this summer, estimates that in-scope fraud losses have fallen by roughly £73m a year since the rules landed, with close to 35,000 fewer scams reaching completion.
Frontier puts the short-term net benefit, after accounting for the higher costs the policy imposes on payment firms, at between £17m and £29m, a figure the consultancy calls conservative. On the regulator’s own framing, the mandate has bent the fraud curve. The more useful question, a year in, is how it did so and who is now paying.
The cost moved, then the behaviour followed
The design point of the regime was never simply to compensate victims. It was to change incentives. Reimbursement is split 50/50 between the sending firm and the receiving firm, the first time UK rules have put a price on fraud at the account that takes the money in, not just the account it leaves from. The logic was that once receiving banks and the smaller payment institutions favoured by fraudsters carried half the bill, they would tighten onboarding, monitoring and mule-account controls.
The early data is consistent with that. Claim volumes ran at about 126,000 between October 2024 and June 2025, roughly 15% below the same nine months a year earlier, which points to fewer frauds succeeding rather than simply more generous payouts after the event. The reimbursement rate for in-scope claims has climbed to about 97%, and across all APP claims the share refunded rose from around two thirds in 2023/24 into the high eighties. Over the regime’s first 18 months, to the end of March 2026, the PSR says 88% of the money lost to in-scope scams, some £316m, was returned to victims.
So the composition matters. This is not only banks writing larger cheques. Part of the improvement is prevention: fewer cases, caught earlier, which is the outcome the cost-shift was meant to buy.
Where the burden landed, and where it was capped
The burden landed squarely on payment firms, and it landed unevenly. The 50/50 split bites hardest on receiving institutions where they have historically invested least, and the PSR’s own materials note that implementation has been inconsistent from firm to firm, so a victim’s odds of a fast, full refund still depend partly on which provider they bank with. The regulator has said it will consult on tightening that consistency before the year is out.
The one hard limit on the industry’s exposure is the reimbursement cap, and here the PSR softened its stance before the rules even began. Its earlier proposal set the maximum refund at £415,000, mirroring the then Financial Ombudsman award limit. After industry pushback about the risk to smaller firms, the regulator confirmed in September 2024 a far lower cap of £85,000, aligned with the Financial Services Compensation Scheme limit and in force from day one. The PSR argues the lower figure still fully covers 99.8% of scams by volume and about 90% by value. The corollary is that the largest, life-changing frauds, the ones most likely to involve pensions or house deposits, sit only partly inside the safety net.
What the evaluation does not settle
The skeptical reading starts with what the numbers cannot see. The PSR is candid that reported fraud does not tell the whole story: a year-one survey found 71% of victims were unaware the reimbursement right existed and 49% never attempted a claim, so measured losses understate the problem and any fall in them is easy to overstate. Frontier’s estimate is explicitly short-term.
Displacement is the other open question. If the regime makes bank-to-bank transfers a harder channel for criminals, the rational response is to move: towards fraud types and rails the policy does not cover, or towards persuading victims to route money in ways that fall outside the in-scope definition. The regulator’s data already shows the mix shifting, with impersonation, purchase and delivery scams and charity fraud featuring more prominently, and it has been pointed in saying banks cannot fix this alone. The platforms where scams originate, social media and telecoms, remain largely outside the reimbursement chain and therefore outside its incentives.
For now the headline is genuinely positive: less money stolen, more of it returned, and no sign of the market exits or reckless consumer behaviour that critics predicted. But the £73m is a first-year estimate against a moving target, the cost has been redistributed rather than removed, and the parts of the fraud economy that sit beyond the payment rails have every reason to adapt. One year in, the mandate has proved it can shift both losses and incentives. Whether it can keep doing so, as criminals reprice their own risk, is the test of year two.
Primary sources: PSR, “Payment fraud falls by £73m following PSR reimbursement scheme” (1 July 2026), reporting the Frontier Economics independent evaluation; PSR, “One year on: impact of APP reimbursement on victims” (8 October 2025); PSR policy statement PS24/7, “Faster Payments APP scams reimbursement requirement: confirming the maximum level of reimbursement” (October 2024).
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.