APP Fraud Guide: Reimbursement, CoP and Mule Detection

In authorised push payment (APP) fraud the customer is deceived into sending the money themselves, so every authentication check passes and the bank's usual fraud model sees a genuine customer on a genuine device. Real-time payments such as Faster Payments settle in seconds, and the money is usually moved on through mule accounts before anyone reports it. UK Finance recorded £576.4 million of APP losses across 248,070 cases in 2025. This guide covers scam types, the UK mandatory reimbursement rules, Confirmation of Payee, sending-bank friction and warnings, receiving-bank mule detection and the emerging EU and Australian regimes. It is for fraud, payments, product and compliance teams at banks, building societies, payment and e-money institutions.

Key takeaways

Authentication does not stop APP fraud. The payer is genuine; controls must detect deception and intervene before execution, then trace and freeze funds at the receiving end.
UK reimbursement is mandatory. Since 7 October 2024, in-scope Faster Payments and CHAPS scam losses must be reimbursed up to £85,000 per claim, with the cost split 50:50 between sending and receiving providers.
Confirmation of Payee is necessary but not sufficient. It catches misdirected and mislabelled payments, not scams where the victim pays an account in the fraudster's own name or a mule's.
Warnings must be specific to work. Generic "is this a scam?" banners are clicked through; warnings based on the stated payment purpose and live risk signals, plus a human conversation for the highest risk, change outcomes.
Receiving banks now share the bill. Mule detection at onboarding and on inbound payments is both a loss control and a regulatory expectation.

APP scam types and the signals they leave

An APP scam, in the Payment Systems Regulator's (PSR) words, involves a consumer being deceived into voluntarily sending a payment to an unintended recipient or for an unintended purpose. The table describes each type at the level a defender needs.

Scam type	How the victim is deceived	Signals a payment provider can see
Purchase scam	Goods, tickets, vehicles or pets advertised online that never arrive	Payee is a personal account receiving many small payments from unrelated payers; marketplace reference in the payment
Investment scam, including "pig butchering"	Fake platforms or advisers promising returns; long relationship-building before larger and repeated payments	Escalating payments, first payments to new investment-themed payees, transfers to the customer's own crypto exchange account
Romance scam	A relationship formed online, then requests for money for emergencies, travel or fees	Repeated payments to a new individual, often abroad or through intermediaries; customer defends the payee when questioned
Impersonation (bank, police, HMRC, utility)	Caller claims the account is compromised and the money must move to a "safe account", or that the customer is helping an investigation	Active phone call during the banking session, sudden transfer of most of the balance, new payee, savings moved to current account first
Invoice and mandate (invoice redirection)	Compromised or spoofed email from a supplier, solicitor or builder with "new" bank details	Payee details changed for an existing supplier; Confirmation of Payee mismatch; first payment to a new account for a large amount
CEO fraud	An email, message or deepfake call appearing to come from a senior executive requesting an urgent transfer	Out-of-pattern urgency, new beneficiary, bypassed approval workflow
Advance fee and lottery	A prize, loan, inheritance or job that requires a fee first	Small repeated payments to individuals, often after an unsolicited contact
Extortion and sextortion	Threats to publish images or information unless paid	Urgent, out-of-character payments to new payees; the customer may be distressed when contacted

Two enablers cut across types. In remote access tool fraud the victim is persuaded to install screen-sharing or remote control software, letting the criminal watch or operate the banking session. In coached customer scams the criminal tells the victim what to say if the bank asks about the payment, which is why scripted questions alone rarely work.

In UK Finance's 2025 figures, investment scams were the largest by value at £221.5 million (up 40%), purchase scams were 71% of cases with £118.1 million lost, and romance losses rose 23% to £39.2 million, while impersonation losses fell 12%. Online sources accounted for 66% of cases but 32% of losses; telecommunications for 17% of cases and 28% of losses: phone-led scams are fewer but larger.

UK mandatory reimbursement rules

The PSR made reimbursement mandatory through Specific Requirement 1 (Pay.UK must put the requirement into the Faster Payments rules), Specific Direction 19 (Pay.UK compliance monitoring), Specific Direction 20 (Faster Payments providers must comply) and Specific Direction 21 (parallel obligations for CHAPS participants under the Bank of England's CHAPS rules). The consolidated policy statement is PS25/5 (May 2025).

Rule	What it says
Start date	Payments made on or after 7 October 2024
Payments covered	Faster Payments and CHAPS, authorised by the consumer, executed in the UK, received in a UK account not controlled by the consumer
Out of scope	International payments, other payment systems, unauthorised fraud, civil disputes, unlawful purposes; credit unions, municipal banks and national savings banks
Maximum reimbursement	£85,000 per claim for both Faster Payments and CHAPS, including vulnerable consumers; providers may pay more
Excess	Optional, up to £100; cannot be applied to vulnerable consumers
Claim window	Claims may be refused if made more than 13 months after the final payment
Timescale	Normally within 5 business days; the clock can be stopped for listed reasons, but claims must close by the 35th business day
Cost allocation	Sending provider reimburses, then may recover 50% from the receiving provider or providers
Exceptions	Consumer was complicit in the fraud, or was grossly negligent under the consumer standard of caution (not for vulnerable consumers)
Disputes	Financial Ombudsman Service, which can consider losses above £85,000 (its own limit is £430,000, according to the PSR's consumer page)

The consumer standard of caution

PS25/5 sets four elements: having regard to interventions from the provider or the police, reporting promptly, sharing information the provider reasonably requests, and reporting to the police (or consenting to the provider doing so). The test is gross negligence, which the PSR describes as requiring a "significant degree of carelessness", a higher bar than ordinary negligence, and the burden of proof sits with the provider. In practice the exception is rarely used: the PSR's dashboard, updated 30 July 2026, shows 3% of claims rejected on these grounds between 7 October 2024 and 31 March 2026.

Vulnerability

Sending providers must apply the FCA's definition of a vulnerable customer, someone "especially susceptible to harm" because of their circumstances, and assess each case individually. A customer vulnerable to the specific scam cannot face the excess or the standard of caution exception.

Outcomes so far and who is responsible

Across the first 18 months the PSR reports £316 million reimbursed, 88% of money lost in in-scope claims, with 82% of claims closed within five business days and 98% within 35. UK Finance's wider data, which uses different coverage, shows £354.3 million (61%) of all APP losses reimbursed in 2025.

The PSR remains the responsible regulator at the time of writing. HM Treasury's consultation response of 21 April 2026 confirmed the government will consolidate the PSR into the FCA, including the APP reimbursement requirements, but this needs primary legislation that had not been passed; the regulators continue to act in the meantime.

Confirmation of Payee and verification of payee

Confirmation of Payee (CoP), run under Pay.UK's rules, checks the name the payer enters against the name on the receiving account and indicates whether the account is personal or business. Pay.UK reports more than 300 organisations live and more than 2 million checks a day. The PSR's Specific Direction 17 required a second group of providers (those with their own sort code, and building societies, sending over Faster Payments or CHAPS) to send and respond to CoP checks by 31 October 2024.

Outcomes: the payer sees a match, a close match with the actual name shown, a no-match warning, or that the check could not be completed. Each should drive a different warning and risk weight.
What it catches: invoice redirection where the fraudster's account name differs from the supplier's, and mistyped details.
What it misses: purchase, romance and investment scams where the victim knowingly pays the name the fraudster gave, and safe account scams where the criminal tells the victim to expect a mismatch. A match proves routing, not legitimacy.
Business payers: use CoP results in accounts payable workflows and treat any change of supplier bank details as a separate verified event, confirmed through a contact already on file. See the Email Identity and BEC Guide.

In the EU, the Instant Payments Regulation (Regulation (EU) 2024/886) inserted Article 5c into Regulation 260/2012: payment providers must check the payee's IBAN against the name before the payer authorises a euro credit transfer, show the actual name on an almost match, and warn on no match. The service must be free, non-consumers sending bulk files may opt out, and a provider that fails to perform the check must refund the payer. It applied to euro-area providers from 9 October 2025 and applies to providers in non-euro member states from 9 July 2027.

Sending-bank controls: friction, warnings and delays

Only the sending provider can stop the payment before it leaves. Apply friction where risk is high and keep low-risk payments instant.

Purpose-led journeys: ask what the payment is for with specific options (paying a tradesperson, investment, moving money to keep it safe, someone you met online), then show warnings written for that scam type. Selecting "moving money to keep it safe" should end the online journey and route to a specialist, because no genuine bank asks for this.
Risk-based delays: the Payment Services (Amendment) Regulations 2024 (SI 2024/1013, in force 30 October 2024) let a payer's provider delay an outbound UK sterling payment where it has reasonable grounds to suspect fraud or dishonesty by someone other than the payer, established by the end of the business day after receipt. The delay may last no longer than the end of the fourth business day after receipt, the payer must be told of the delay and what they need to do, and the provider is liable for resulting charges and interest. FCA guidance FG24/6 covers outbound delays and suspicious inbound payments.
Session and device signals: an active phone call during the banking session, remote access or screen-sharing software, accessibility services driving the app, unusual hesitation or copy-and-paste of payee details, and a balance moved between the customer's own accounts just before a large first payment.
New payee controls: lower limits for the first payment to a new payee, a cooling-off period for large first payments, and confirmation in the app when a payee is added through another channel.
Human intervention: for the highest-risk payments, a trained colleague's open conversation works better than scripted yes or no questions that a coached customer has rehearsed. Repeat interventions when the customer returns with the same pattern.
Customer controls: optional limits, trusted contacts and the ability to freeze outbound payments.

Receiving-bank controls and mule detection

Stolen funds land in mule accounts: accounts opened with stolen or synthetic identities, or genuine accounts whose owners have been recruited, sometimes with a promise of easy money. Under the 50:50 allocation, every receiving provider pays half of the reimbursement for scam payments into mule accounts it hosts.

Stage	Signals	Controls
Onboarding	Device or contact details reused across applications, mismatched identity data, synthetic identity markers	Identity proofing with liveness, device intelligence, application velocity checks
Dormancy and activation	A dormant or new account that suddenly receives payments from many unrelated payers	Inbound velocity rules by payer count and value, not just total value
Pass-through	Funds moved out within minutes, often in round amounts or to crypto exchanges (fan-in, fan-out)	Hold suspicious inbound payments for review; limit outbound for new or reactivated accounts
Reports	Sending-bank fraud reports naming the account	Freeze remaining funds, return what can be repatriated, review linked accounts by device and network

The PSR's early data showed 86% of claims reported by the sending firm to the receiving firm within two business hours; speed of that hand-off largely decides how much can be frozen. See the Fraud Prevention Guide for Digital Businesses.

Other jurisdictions

European Union: beyond verification of payee, the Council and Parliament reached a provisional agreement on a Payment Services Regulation on 27 November 2025. Parliament's summary says providers would have to refund customers in full where a fraudster impersonates a provider's employee, provided the customer reports to the police and informs the provider, that online platforms could be liable to providers for fraudulent content they fail to remove after notification, and that providers would share fraud information. The text required formal adoption; we have not confirmed its final form or application dates from a primary source.
Australia: the Scams Prevention Framework covers banking, telecommunications and digital platforms, requiring them to prevent, detect, disrupt, report and respond to scams. The ACCC says most obligations apply from 31 March 2027, when the Australian Financial Complaints Authority begins handling eligible scam complaints; sector codes were still being developed in October 2026.

Decision guidance

Friction versus speed: calibrate interventions on loss avoided per genuine customer delayed. A delay on a £50 marketplace payment costs more goodwill than it saves; a delay on a first £20,000 payment to a new payee after a long phone call does not.
Large banks: invest in real-time behavioural and session analytics, purpose-led journeys, specialist intervention teams and network analysis across inbound and outbound flows.
Smaller providers and e-money institutions: use CoP through an aggregator, vendor scoring for inbound and outbound payments, clear thresholds for referral, and documented reimbursement and claim-handling procedures that meet the 5 and 35 business day timescales.
Corporate payers: the consumer reimbursement rules may not cover you (check the scope definitions in PS25/5), so dual approval for new or changed beneficiaries and call-back verification to known numbers are your primary controls. The Arup deepfake fraud shows a fake CFO on a video call triggering HK$200 million in transfers.

Where identity fits

APP fraud is about whose account the money lands in. Confirmation of Payee is a lightweight check of the payee's identity, and mule detection starts with identity proofing at account opening. It also differs from account takeover: when a criminal logs in as the customer the payment is unauthorised, which carries different protections. See the Identity Proofing and KYC Guide and, for voice and video impersonation, the Deepfake and AI Impersonation Guide.

Detection and measurement

Log the payment purpose selected, warnings shown and the customer's response, CoP outcome, session signals (call in progress, remote access indicators), intervention outcome, delay decisions under regulation 86 and timings of reports to and from receiving providers.

APP loss rate: scam losses per million pounds of outbound payments, split by scam type.
Intervention effectiveness: share of high-risk payments stopped or cancelled after a warning or conversation, and later confirmed as scams.
False positive cost: genuine payments delayed per confirmed scam prevented.
Claim handling: share of claims closed within 5 and within 35 business days, and standard of caution rejections overturned by the Ombudsman.
Mule detection: share of inbound scam funds frozen, and mule accounts identified before the first sending-bank report.
Repeat victimisation: customers who suffer a second scam within 12 months.

How to implement

Map the journey: document every channel that can create a payee or send a payment, including branch and telephone banking.
Meet the rules first: confirm CoP send and respond, reimbursement claim handling, Pay.UK data reporting and the 50:50 recovery process.
Add purpose and warnings: introduce purpose capture and dynamic warnings, testing wording with customers before launch.
Score in shadow mode: run new outbound and inbound rules in log-only mode for several weeks, measuring how many confirmed scams they would have caught and how many genuine payments they would have delayed.
Pilot delays: apply regulation 86 delays to a narrow, high-risk segment such as large first payments to new payees, with specialist staff ready to call customers.
Expand to inbound: deploy mule rules and inbound holds, and agree data sharing with other providers.
Roll back safely: keep each rule behind a switch with a named owner so that a rule delaying too many genuine payments can be relaxed within minutes, and record each change for the regulator.

Framework mapping

Control	UK	EU	Australia SPF obligation
Payee name check	Confirmation of Payee, PSR Specific Direction 17	Art. 5c Regulation 260/2012 (inserted by Regulation (EU) 2024/886)	Prevent
Victim reimbursement	SR1, SD20, SD21 (PS25/5)	Provisional PSR agreement (impersonation refund)	Respond (AFCA complaints from 31 March 2027)
Outbound delay for suspected fraud	PSRs 2017 reg 86(2A) to (2D), FCA FG24/6	Not confirmed	Disrupt
Inbound and mule controls	50:50 allocation; FG24/6 suspicious inbound payments	Fraud information sharing (provisional)	Detect, disrupt
Claim data and monitoring	SD19, Pay.UK compliance data reporting	Not confirmed	Report

Common failure patterns

Generic warnings: the same banner on every payment trains customers to click through and rarely changes behaviour.
Treating a CoP match as clearance: purchase and investment scams usually produce a match because the fraudster controls a correctly named account.
Scripted questions only: coached customers give the expected answers; conversations need open questions and the authority to delay.
Ignoring inbound flows: a provider that scores only outbound payments funds half of every claim on mules it never looked for.
Breaking up a multi-stage scam: money moved first to the customer's own crypto exchange account falls outside the definition at that step, but the pattern is still visible and should trigger intervention.
Weak supplier change checks: businesses changing beneficiary details on the strength of an email, as invoice redirection depends on.

Practitioner checklist

Confirm CoP send and respond coverage on every payment channel and use each outcome as a distinct risk signal.
Capture payment purpose and show scam-specific warnings.
Detect active calls, remote access software and other coaching signals during payment sessions.
Define when regulation 86 delays apply, who calls the customer and how the payer is notified within a business day.
Apply lower limits and cooling-off to large first payments to new payees.
Run inbound mule rules and hold suspicious inbound payments.
Process claims within 5 business days where possible and always within 35, with a documented vulnerability assessment.
Recover 50% from receiving providers promptly and report data as Pay.UK requires.
Track loss rate, intervention effectiveness, false positives and mule funds frozen monthly.

Standards and references

Related NHI Mgmt Group resources: Payment Fraud Guide · Fraud Prevention Guide for Digital Businesses · Financial Services Identity Security Guide · Deepfake and AI Impersonation Guide. This guide summarises the UK APP scam reimbursement and Confirmation of Payee rules, EU verification of payee and the status of EU and Australian scam reforms as published at 16 October 2026, and is not legal advice.

Authorised Push Payment (APP) Fraud Guide