Watch out for the 'hybrid' payment scam that banks refuse to refund

Criminals are expanding to debit and credit card scams following improved controls to prevent authorised push payment (APP) fraud, Which? warns.

APP fraud is when you're manipulated into sending money to a scammer by bank transfer. Fraudsters are now increasingly persuading victims to approve card payments as well. 

They might use similar tactics, such as posing as your bank to convince you to share security codes or approve payments in your app. But you don't have the same protections when you authorise card payments yourself. 

We submitted a Freedom of Information (FoI) request to see which providers prompted the most complaints related to authorised card fraud in 2025. 

Find out how your bank fared and how to protect yourself from this latest evolution. 

How are scammers changing tactics?

Many 'authorised' scams in the UK involve people sending money to fraudsters directly from their bank accounts. But, recent reports to Which? suggest fraudsters are increasingly cashing out by convincing victims to approve card payments instead. 

The Financial Ombudsman Service (FOS) warned in September 2024 that it had come across more people inadvertently using their credit or debit cards to pay fraudsters. It told us in June 2026 that complaints about authorised fraud involving a mix of payment types have continued to increase. 

This is a critical wake-up call after years of security efforts being focused on fighting fraud involving bank transfers. 

How the scam works

Authorised card payments are a common feature of romance and investment scams, as well as bank impersonation scams. 

Even though the battleground has spread to cards, the tactics remain broadly the same. A typical scenario reported to Which? starts with a cold call from a fraudster pretending to be from your bank's security team, the police or the financial regulator. They tell you that your account is under attack to make you panic. 

You might be told to move funds to a 'safe account' you hold with a different bank to escape notice, or if the criminal believes that provider has weaker controls. These 'me-to-me' transfers aren't covered by APP fraud reimbursement rules because the payments are deemed to be to an account you control. 

Scammers may have already stolen your card details and other data (through phishing or a data breach) meaning they can trigger payments and ask you to approve them in your app, pretending this will 'reverse' or 'block' fraudulent attempts. Money often passes through e-money and cryptocurrency wallets where it disappears for good. 

Or, they might convince you to share one-time passcodes (OTPs) to add your card to their own digital wallet and go on a contactless spending spree. 

‘There is no shame in being socially engineered. If it didn’t work, criminals wouldn’t do it. Everyone is susceptible,’ Frost adds. 

Yet the consequences can be dire because while unauthorised card fraud is almost always refunded and bank transfers to UK accounts are protected by the APP reimbursement scheme, people who are manipulated into approving card payments to scammers can be left high and dry.

• Find out more: how I lost £18k to digital wallet scammers

Which banks had the most complaints?

We asked the FOS for data on the most complained about firms for authorised card fraud in 2025. 

It received 3,653 complaints about authorised card payments that year across the firms in our analysis. On average, 27% were upheld in favour of consumers.  

Revolut topped the table with 912 cases, dwarfing second-place Barclays (399). A third of Revolut complaints resolved that year were upheld in favour of its customers, though Monzo had the worst uphold rate (38%) overall, suggesting its customers were most likely to have been treated unfairly. 

Both firms told us these cases relate to historical complaints. Monzo said it has since prevented three times the value of fraud in 2025, compared to 2024. Revolut said its data shows authorised card fraud cases declined by 35% in 2025 and its upheld ratio was higher as it decided to accelerate customer remediation. 

We’re calling on providers to improve defences and publish data on card fraud.

The table shows the 10 firms that attracted the most complaints:

Why isn't there data on hybrid payment scams?

Every year, the banking industry collates data on both unauthorised card fraud and APP fraud, yet authorised fraud involving other payment methods is still a blind spot. 

We told UK Finance about our growing concerns that scammers are successfully manipulating victims into approving card payments, not just bank transfers. We asked if there been any progress on collecting and publishing this data in industry reports and it admitted there has been limited progress. 

It told us: 'We have several pilots running to enhance the depth and coverage of our data, including authorised card scams, but we don’t currently have an estimation of when this will be published.'

First in Which? Money magazine

This story first appeared in Which? Money magazine. Join for reviews and investigations, plus 1-to-1 guidance from our experts.

Join Which? Money

Only £49 per year

Different levels of fraud protection

Many fraud victims have no idea that the payment methods involved can change everything:

• Banks must reimburse you quickly for unauthorised card payments eg if a scammer has stolen your card details to buy goods online, as long as you did not act with gross negligence or fraudulently. 
• If you inadvertently send money to a scammer, bank transfers to UK accounts are protected by a mandatory APP fraud reimbursement scheme. 
• If you authorise a card payment directly to a retailer or trader you later discover is a scammer, you may be able to use chargeback or Section 75 to get your money back. But, you can’t usually claim for payments you authorise to a legitimate company (even if the money ultimately ends up in the hands of a criminal).

This is why it's so devastating when scammers convince victims to approve card payments to a cryptocurrency exchange or money transfer app first, because that company provided the intended services, albeit as part of a chain of fraud. 

Chargeback and Section 75 are primarily designed for unauthorised charges or issues such as non-delivery, faulty goods and misrepresentation.