We use cookies to allow us and selected partners to improve your experience and our advertising. By continuing to browse you consent to our use of cookies. You can understand more and change your cookies preferences here.
Sign up for a Which? Scam alert to get what you need to know about the latest scams, whether it’s a new phishing email or a phoney HMRC call.
With more than 60 years experience fighting scams and protecting consumers this free service from Which? is available for everyone.
An authorised push payment (APP) scam, also known as a bank transfer scam, occurs when you - knowingly or unwittingly - transfer money from your own bank account to one belonging to a scammer.
For example, a scammer pretends to be from your bank’s fraud team and warns that you need to move your money to a safe account but it’s actually an account the fraudster controls.
If you’ve been tricked into transferring money to the account of someone you don’t know, you might have been the victim of what’s known as authorised push payment (APP) fraud.
If you think you’ve been scammed, you should call your bank or card provider immediately.
Tell the bank what happened, and let them know the bank account number your money was sent to.
Your bank might be able to either stop the transaction from going ahead or recover your money from the fraudster’s account.
But speed is of the essence for this, so it’s important to let your bank know as soon as it happens.
You should also contact the bank where your money was sent and let it know the account number as it may be able to halt the money and get it back for you.
You can check which bank it was sent to by using the Faster Payment's sort code checker.
If you've formally made a complaint to this bank, but you don't think they acted quickly or appropriately enough you can take this complaint to the Financial Ombudsman Service who can investigate further.
If you’ve been the victim of a different type of fraud - for example, you paid on your credit card or via PayPal - read our guide on what to do in those scenarios.
If you’re too embarrassed, know £1.2bn was lost to fraud in 2018 so you’re far from alone.
Scams are more complex and convincing than ever - people of all ages and backgrounds can unfortunately fall victim to scammers’ manipulations.
Hopefully, your bank will be able to help you or stop the scam.
If your bank is signed up to the voluntary Authorised Push Payment Scam Code which launched on 28 May 2019 it has to take a number of steps to protect their customers and reimburse customers who aren’t to blame.
You can ask your bank directly or check the list on the Payment Service Regulator’s website.
The Code only applies to transfers between UK accounts. Overseas accounts aren't covered.
If a bank is signed up to the code, as well as reimbursing APP scam victims, it must have also committed to take steps to protect customers, which includes:
In order to uphold your side of the code, you’re expected to:
1. Pay attention to warnings given to you by your bank - these might be instructions or messages when you set up, change or make payments.
2. Have a reasonable basis for believing that:
3. Take care – in the aftermath of being scammed you might think you weren’t careful enough, but this shouldn’t put you off making a complaint to your bank. The test is about what you did and thought at the time of the payment, not afterwards.
Your bank should also reimburse customers who might not have been able to protect themselves from a scam using these steps or customers considered vulnerable to begin with.
It might be because you’re new to making payments online, were mentally or physically unwell, weren’t able to make decisions at the time or that the scam was very convincing.
When you report the scam to your bank, you’ll likely be asked to send in evidence of what happened, like copies of text messages or emails. Your bank should do this sensitively.
We’ve written a template letter to help you make a formal complaint to your bank about a scam if they’re signed up to the code.
If a bank is signed up to the code, it must reimburse APP scam victims even if they’re not to blame - this also applies if the bank has done nothing wrong.
The code requires that banks reimburse customers if they were vulnerable, even the bank has also done everything it should have under the code.
But if the bank has failed to provide the protections set out in the code and you have also not done what was expected of you, you will get some but not all of your money back.
And if your bank has done all it’s meant to according to the code, but you didn’t, you unfortunately won’t get your money back but your bank may offer you some sort of compensation.
While getting your money back after being scammed is simpler if your bank is signed up to the code, don’t lose hope if they’re not. There are still options available to you.
We’ve written a template letter to help you make a formal complaint to your bank if you were a victim of a bank transfer or APP scam.
You should use this after reporting the scam when it first happened, after you have a clearer idea of what happened and what your bank’s position is.
You should also report the scam to Action Fraud which will give you a crime reference number.
If your bank isn’t signed up to the code, it might tell you that it can’t help you either because you authorised the payment by providing the scammer with your details or because you were ‘grossly negligent’.
The onus is on your bank to prove why they’re refusing to refund you. Your bank will need evidence to provide you:
You can challenge the first and second points.
If your bank says it won’t help you because you authorised the transaction by giving the scammer your personal or banking details, you can challenge this.
The financial ombudsman says when it considers whether a scam transaction was authorised, it considers whether the victim knew that money was going to leave their account.
If the victim didn’t realise they were making a payment, the financial ombudsman says it's likely it will rule the transaction was unauthorised so the bank should reimburse the money.
1. A scammer spoofs your bank’s number, so it looks like your bank is calling you.
2. When you answer, the scammer tells you they’re a member of the fraud team.
3. They ask you a series of questions to prove your identity, including sending texts with confirmation codes which they ask for to prove your identity.
4. When you hang up and check your account, you see the codes actually allowed the scammers to drain your account.
You believed you were speaking with your bank and didn’t realise what you told them gave them access to your account.
Because of that, in this instance it’s likely the financial ombudsman will consider this to be an unauthorised transaction.
The financial ombudsman says the bar for ‘grossly negligent’ is high - it doesn’t just mean you were careless or negligent.
Scammers use sophisticated technology and manipulative social engineering to trick you into thinking they’re someone else.
This means that, depending on what has happened, if you’ve given the scammer some details that doesn’t necessarily mean you have been ‘grossly negligent’.
The financial ombudsman investigates complaints about banks and financial institutions and makes legally binding rulings about cases.
So, if the bank claims you were ‘grossly negligent’, take your case to the financial ombudsman and ask them to rule on this.
1. A scammer called a woman pretending to be from her telecoms provider, saying there had been hacking attempts on her broadband and they needed to secure it.
2. He confirmed her name, address, BT account number and email address as proof.
3. She followed his instructions and at some point logged into her online banking.
4. She soon got a text that a new payee had been set up at which point the fraudster hung up. £4,000 was transferred from her account within 30 minutes.
Her bank refused to reimburse her because they claimed she’d been 'grossly negligent'.
She complained to the financial ombudsman which ruled in her favour.
The financial ombudsman said she didn’t authorise the transfer because she didn’t know money was leaving her account and, because she was tricked, it wasn’t fair or reasonable to consider her to be grossly negligent.
The financial ombudsman ruled her bank refund her the full £4,000, plus an additional £300 compensation for the trouble and upset caused.
Even if your bank refuses to reimburse you, all hope isn’t lost.
You can still escalate your complaint to the financial ombudsman who will investigate what happened, what your bank did, what the receiving bank did and whether anyone is at fault.
In the last quarter of 2018, the financial ombudsman upheld 62% of complaints made by scam and fraud victims.
But it can take up to a year for your case to be decided on because of the volume of complaints the financial ombudsman receives. Which? has been assured they’re working to clear this backlog.
Being scammed can take a huge toll on your emotional wellbeing and mental health. It's often helpful to speak to someone about what you’re going through.
This can be anything from a one-off scam to something which entangles you for months - every scam has an impact on your life, no matter its size.
Mind has a confidential information and support line, Mind Infoline, available on 0300 123 3393 (lines open 9am - 6pm, Monday – Friday).
The charity also runs the supportive online community Elefriends where you can talk about and share your experiences of mental health.
Victim Support has a free, 24/7 helpline where you can speak to someone confidentially. This can be a one-off call or they can refer you to local services for on-going support.
This service is free and run by Victim Support which is an independent charity.
You can contact Victim Support by:
Have your say