What to do if you’re the victim of a bank transfer (APP) scam
Which? scam alerts
Sign up for a Which? Scam alert to get what you need to know about the latest scams, whether it’s a new phishing email or a phoney HMRC call.
With more than 60 years experience fighting scams and protecting consumers this free service from Which? is available for everyone.
What is an 'authorised push payment' scam?
An authorised push payment (APP) scam, also known as a bank transfer scam, occurs when you - knowingly or unwittingly - transfer money from your own bank account to one belonging to a scammer.
For example, a scammer pretends to be from your bank’s fraud team and warns that you need to move your money to a safe account but it’s actually an account the fraudster controls.
If you’ve been tricked into transferring money to the account of someone you don’t know, you might have been the victim of what’s known as authorised push payment (APP) fraud.
Contact your bank immediately
If you think you’ve been scammed, you should call your bank or card provider immediately.
Tell the bank what happened, and let them know the bank account number your money was sent to.
Your bank might be able to either stop the transaction from going ahead or recover your money from the fraudster’s account.
But speed is of the essence for this, so it’s important to let your bank know as soon as it happens.
Contact the bank where your money was sent
You should also contact the bank where your money was sent and let it know the account number as it may be able to halt the money and get it back for you.
You can check which bank it was sent to by using the Faster Payment's sort code checker.
If you've formally made a complaint to this bank, but you don't think they acted quickly or appropriately enough you can take this complaint to the Financial Ombudsman Service who can investigate further.
Other types of fraud
If you’ve been the victim of a different type of fraud - for example, you paid on your credit card or via PayPal - read our guide on what to do in those scenarios.
If you’re too embarrassed, know £1.2bn was lost to fraud in 2018 so you’re far from alone.
Scams are more complex and convincing than ever - people of all ages and backgrounds can unfortunately fall victim to scammers’ manipulations.
Hopefully, your bank will be able to help you or stop the scam.
Make a formal complaint to your bank
If your bank is signed up to the voluntary Authorised Push Payment Scam Code which launched on 28 May 2019 it has to take a number of steps to protect their customers and reimburse customers who aren’t to blame.
You can ask your bank directly or check the list on the Payment Service Regulator’s website.
The Code only applies to transfers between UK accounts. Overseas accounts aren't covered.
If your bank is signed up to the code
If a bank is signed up to the code, as well as reimbursing APP scam victims, it must have also committed to take steps to protect customers, which includes:
- Educating customers about APP scams
- Identifying higher risk payments and customers who are vulnerable and so have a higher risk of becoming a victim
- Providing effective warnings to customers if the bank identifies an APP scam risk - these could be messages when you go to make a payment or set up a new payee
- Talking to customers about payments and even delaying or stopping payments where there are scam concerns
- Acting quickly when a scam is reported to it
- Taking steps to stop fraudsters opening bank accounts
Banks signed up to the code
- Bank of Scotland plc
- Barclays
- Cahoot
- Cater Allen Limited
- Co-op Bank
- First Direct
- Halifax
- HSBC
- Intelligent Finance
- Lloyds Bank
- M&S Bank
- Metro Bank
- Nationwide Building Society
- NatWest
- Royal Bank of Scotland plc
- Santander
- Starling Bank
- Ulster Bank
What you have to do under the code
In order to uphold your side of the code, you’re expected to:
1. Pay attention to warnings given to you by your bank - these might be instructions or messages when you set up, change or make payments.
2. Have a reasonable basis for believing that:
- the person you paid was the person you were expecting to pay
- the payment is for genuine goods or services
- the person or business you are paying is legitimate
3. Take care – in the aftermath of being scammed you might think you weren’t careful enough, but this shouldn’t put you off making a complaint to your bank. The test is about what you did and thought at the time of the payment, not afterwards.
Your bank should also reimburse customers who might not have been able to protect themselves from a scam using these steps or customers considered vulnerable to begin with.
It might be because you’re new to making payments online, were mentally or physically unwell, weren’t able to make decisions at the time or that the scam was very convincing.
When you report the scam to your bank, you’ll likely be asked to send in evidence of what happened, like copies of text messages or emails. Your bank should do this sensitively.
We’ve written a template letter to help you make a formal complaint to your bank about a scam if they’re signed up to the code.
Will I get my money back under the Authorised Push Payment Scam Code?
If a bank is signed up to the code, it must reimburse APP scam victims even if they’re not to blame - this also applies if the bank has done nothing wrong.
The code requires that banks reimburse customers if they were vulnerable, even the bank has also done everything it should have under the code.
But if the bank has failed to provide the protections set out in the code and you have also not done what was expected of you, you will get some but not all of your money back.
And if your bank has done all it’s meant to according to the code, but you didn’t, you unfortunately won’t get your money back but your bank may offer you some sort of compensation.
If your bank isn’t signed up to the code
While getting your money back after being scammed is simpler if your bank is signed up to the code, don’t lose hope if they’re not. There are still options available to you.
We’ve written a template letter to help you make a formal complaint to your bank if you were a victim of a bank transfer or APP scam.
You should use this after reporting the scam when it first happened, after you have a clearer idea of what happened and what your bank’s position is.
You should also report the scam to Action Fraud which will give you a crime reference number.
How to prove you didn’t authorise the bank transaction
If your bank isn’t signed up to the code, it might tell you that it can’t help you either because you authorised the payment by providing the scammer with your details or because you were ‘grossly negligent’.
The onus is on your bank to prove why they’re refusing to refund you. Your bank will need evidence to provide you:
- authorised the transaction - but your bank can’t just say because your password, card or Pin were used that you authorised it.
- are at fault because you were ‘grossly negligent’. This is quite a high test.
- told your bank more than 13 months after the unauthorised transaction.
You can challenge the first and second points.
How to challenge the claim you made an authorised transaction
If your bank says it won’t help you because you authorised the transaction by giving the scammer your personal or banking details, you can challenge this.
The financial ombudsman says when it considers whether a scam transaction was authorised, it considers whether the victim knew that money was going to leave their account.
If the victim didn’t realise they were making a payment, the financial ombudsman says it's likely it will rule the transaction was unauthorised so the bank should reimburse the money.
Scam example: Your bank’s ‘fraud team’ give you a call
- A scammer spoofs your bank’s number, so it looks like your bank is calling you.
- When you answer, the scammer tells you they’re a member of the fraud team.
- They ask you a series of questions to prove your identity, including sending texts with confirmation codes which they ask for to prove your identity.
- When you hang up and check your account, you see the codes actually allowed the scammers to drain your account.
You believed you were speaking with your bank and didn’t realise what you told them gave them access to your account.
Because of that, in this instance it’s likely the financial ombudsman will consider this to be an unauthorised transaction.
How to challenge the claim you were grossly negligent
The financial ombudsman says the bar for ‘grossly negligent’ is high - it doesn’t just mean you were careless or negligent.
Scammers use sophisticated technology and manipulative social engineering to trick you into thinking they’re someone else.
This means that, depending on what has happened, if you’ve given the scammer some details that doesn’t necessarily mean you have been ‘grossly negligent’.
The financial ombudsman investigates complaints about banks and financial institutions and makes legally binding rulings about cases.
So, if the bank claims you were ‘grossly negligent’, take your case to the financial ombudsman and ask them to rule on this.
Scam example: There’s a problem with your broadband connection
- A scammer called a woman pretending to be from her telecoms provider, saying there had been hacking attempts on her broadband and they needed to secure it.
- He confirmed her name, address, BT account number and email address as proof.
- She followed his instructions and at some point logged into her online banking.
- She soon got a text that a new payee had been set up at which point the fraudster hung up. £4,000 was transferred from her account within 30 minutes.
Her bank refused to reimburse her because they claimed she’d been 'grossly negligent'.
She complained to the financial ombudsman which ruled in her favour.
The financial ombudsman said she didn’t authorise the transfer because she didn’t know money was leaving her account and, because she was tricked, it wasn’t fair or reasonable to consider her to be grossly negligent.
The financial ombudsman ruled her bank refund her the full £4,000, plus an additional £300 compensation for the trouble and upset caused.
Escalate your complaint to the Financial Ombudsman Service (FOS)
Even if your bank refuses to reimburse you, all hope isn’t lost.
You can still escalate your complaint to the financial ombudsman who will investigate what happened, what your bank did, what the receiving bank did and whether anyone is at fault.
In the last quarter of 2018, the financial ombudsman upheld 62% of complaints made by scam and fraud victims.
But it can take up to a year for your case to be decided on because of the volume of complaints the financial ombudsman receives. Which? has been assured they’re working to clear this backlog.
Emotional support available after a scam
Being scammed can take a huge toll on your emotional wellbeing and mental health. It's often helpful to speak to someone about what you’re going through.
This can be anything from a one-off scam to something which entangles you for months - every scam has an impact on your life, no matter its size.
Mind has a confidential information and support line, Mind Infoline, available on 0300 123 3393 (lines open 9am - 6pm, Monday – Friday).
The charity also runs the supportive online community Elefriends where you can talk about and share your experiences of mental health.
Victim Support has a free, 24/7 helpline where you can speak to someone confidentially. This can be a one-off call or they can refer you to local services for on-going support.
This service is free and run by Victim Support which is an independent charity.
You can contact Victim Support by:
- Calling them for free on 0808 16 89 111
- Requesting online support
- Contacting your local Victim Support team
