Card, Bank and Payment App Safety: Your Protections

The way you pay decides whether you can get your money back, and many people do not know which of their payment methods protect them. A credit card, a debit card, a mobile wallet, a bank transfer and a payment app such as Zelle, Venmo, Cash App or PayPal all move money in seconds, but the rules for unauthorised payments, scams and purchases that go wrong are very different. Zelle tells its users to treat it like cash. This guide explains which protections apply to each method in the UK and the US, how to set up cards and apps so a stolen phone or password does less damage, and how to choose the right method for each kind of payment. It complements the Online Banking Security Guide, which covers bank account set-up and the APP reimbursement and Regulation E details, and is written for individuals and for people who run awareness for staff and families.

Key takeaways

Unauthorised and authorised are different worlds. The law protects you well when someone else spends your money; protection is much weaker when a scammer persuades you to send it yourself.
Credit cards give the strongest purchase protection. US law caps liability for unauthorised use at $50 and UK Section 75 covers purchases over £100; payment app personal transfers usually have no purchase protection at all.
Personal payments are for people you know. "Friends", "family" and personal app transfers are designed for splitting bills, not for buying from strangers.
Your phone is now your wallet. A strong device passcode, biometric unlock and app-level locks matter as much as your card PIN.
Speed recovers money. Reporting within days, not weeks, keeps US liability at the lowest tier and gives UK banks the best chance of stopping or recovering a payment.

Which payment methods protect you

The table summarises the main protections. Terms vary by provider and change over time, so check your own card or app terms for the details that apply to you.

Method	Someone else uses it (unauthorised)	You are tricked into paying (scam)	Goods not delivered or not as described
Credit card (US)	Liability capped at the lesser of $50 or the amount taken (Regulation Z, 12 CFR 1026.12(b)); many issuers offer zero liability	Billing dispute or chargeback, depending on the facts	Billing dispute or chargeback
Credit card (UK)	Card issuer refund for unauthorised payments	Chargeback may help; depends on the facts	Section 75 for single items over £100 and up to £30,000, plus chargeback
Debit card (US)	Regulation E limits: $50 if reported within 2 business days, up to $500 after, more if not reported within 60 days of the statement (12 CFR 1005.6)	Limited	Card scheme chargeback, not a legal right
Debit card (UK)	Bank refund for unauthorised payments	Limited	Chargeback, not a legal right
Mobile wallet (Apple Pay, Google Pay)	Same as the underlying card, plus tokenisation means the real card number is not shared	Same as the underlying card	Same as the underlying card
Bank transfer (UK, Faster Payments or CHAPS)	Bank refund for unauthorised payments	APP scam reimbursement rules, with conditions and limits	Generally none; treat as cash
Payment app, goods and services payment (PayPal, Venmo)	Provider rules and, in the US, Regulation E for the account	Provider buyer protection may apply if the payment was marked as goods and services	Provider buyer or purchase protection, if eligible
Payment app, personal or "friends" payment	Provider rules and, in the US, Regulation E for the account	Usually none	Usually none; Venmo states personal payments fall outside its Purchase Protection Program
Zelle	Your bank's rules for unauthorised transfers	Limited; Zelle advises sending only to people you trust	Zelle does not describe purchase protection
Gift cards, crypto, money transfer services	Very limited	Effectively none	Effectively none

Two definitions explain most of the gaps. Regulation Z defines unauthorised use as use by someone without "actual, implied, or apparent authority" from which you receive no benefit. If you approved the payment yourself, even because you were deceived, it usually falls outside the strongest unauthorised-use protections. That is why scammers push victims to send money themselves and why UK reimbursement rules for authorised push payment scams were introduced. See the Authorised Push Payment (APP) Fraud Guide.

Cards: getting the most from the strongest protection

Use a credit card for online purchases from businesses you do not know well. The NCSC advises that paying by credit card is generally safer when shopping online, and Citizens Advice explains that Section 75 applies to any part paid by credit card, for single items over £100 and up to £30,000.
Know the marketplace caveat. Citizens Advice notes that Section 75 usually does not apply when you buy through a third party such as a marketplace or a PayPal wallet; chargeback may still be available.
Turn on transaction alerts. Push notifications for every card payment let you spot misuse within minutes, which keeps you inside the lowest US Regulation E tier and gives UK banks time to act.
Freeze and unfreeze in the app. Most banking apps let you freeze a card instantly and block categories such as gambling, online or overseas payments.
Use virtual or single-use card numbers where your bank offers them, for subscriptions and unfamiliar shops.
Prefer a mobile wallet in shops and apps. Apple explains that Apple Pay uses a device account number stored in the device's Secure Element, that your card number is not sent to stores or apps, and that each payment carries a one-time dynamic security code. A skimmed or breached merchant does not get your real card number.

Payment apps: how to use them without losing money

Payment apps are excellent for paying people you know and risky for paying strangers. The provider's own rules decide what is covered, and they usually depend on how the payment was labelled when you sent it.

Pay friends with personal payments, pay sellers with goods and services: Venmo's user agreement covers payments to business profiles or payments marked as goods and services, and says personal payments between personal accounts are outside the program. PayPal protects eligible purchases sent with Goods and Services.
Treat Zelle like cash: Zelle's own safety pages say money goes directly into the recipient's account and to send only to people you trust. Confirm the phone number, email or Zelle tag before sending, because a typo sends money to a stranger.
Do not accept unexpected payments and then "refund" them: a stranger who "accidentally" sends you money and asks for it back may be using stolen funds that will later be reversed.
Ignore requests to move to the app from a marketplace: sellers who want payment by app instead of platform checkout are removing your protection. See the Online Marketplace Buying and Selling Safely Guide.
Keep balances low: money sitting in an app wallet may not have the same protections as money in a bank account. Move it to your bank regularly.
Turn off public transaction feeds where the app has them, so strangers cannot see who you pay and when.

Lock down your accounts and devices

Layer	Setting	Why it matters
Phone	Six-digit or longer passcode, Face ID, Touch ID or fingerprint, auto-lock	A thief with an unlocked phone has your wallet, email and banking apps
Payment and banking apps	App PIN or biometric required on open; notifications on every payment	Second barrier if the phone is unlocked; instant warning of misuse
Payment app login	Passkey where offered (PayPal describes passkey login as phishing-resistant), otherwise an authenticator app	Stops password phishing and reuse
Email account	Unique password and two-step verification	Email is used to reset everything else
Mobile number	Account PIN or port-out protection with your carrier	Blocks SIM swap, which lets criminals receive your SMS codes
Card controls	Freeze, category blocks, spending limits, virtual numbers	Limits what a stolen card number can do

For more on these layers see the Securing Your Smartphone Guide, the SIM Swap Fraud Guide and the Passkeys for Everyone Guide.

Choosing the right method for each payment

Payment	Best choice	Avoid
Online shop you have not used before	Credit card or mobile wallet linked to a credit card	Bank transfer, gift cards, crypto
Splitting a bill with friends	Payment app personal payment or bank transfer	Sharing a card number
Buying from an individual online	Platform checkout or payment app goods and services	Personal app payment, Zelle, bank transfer
Buying in person, after inspecting	Card, mobile wallet or bank transfer confirmed in your app	Paying a deposit before seeing the item
Large payment such as a house deposit or car	Bank transfer after confirming account details by phone on a number you already trust	Account details received only by email or text
Subscriptions and free trials	Virtual card number or credit card	Debit card linked to your main account
Anyone demanding a specific unusual method	Nothing until you have checked independently	Gift cards, crypto, money transfer services

Small business owners who pay suppliers from a personal app or card face the same rules: consumer protections often do not apply to business accounts, and invoice redirection is a common loss. See the Invoice Redirection and Supplier Bank Detail Fraud Guide.

Recognising payment scams

UK Finance's Take Five campaign gives three steps: Stop ("Take a moment to stop and think before parting with your money or information"), Challenge (could the request be fake, and is someone rushing you) and Protect (contact your bank immediately if you think you have been scammed, and report it). Zelle's safety pages name ticket scams, job scams, marketplace scams and social engineering as common patterns. The red flags are consistent:

Pressure to pay now to avoid a penalty, secure a deal or "protect" your money.
A request to use a specific method, especially an app personal payment, gift card or crypto.
A caller claiming to be your bank or the police who asks you to move money to a "safe account". See the Impersonation Scams Guide.
A request for a one-time code sent to your phone. Codes approve payments or sign-ins; nobody genuine needs you to read them out.
A payment "sent by mistake" followed by a request to send it back.

Setting up your finances safely: an ordered plan

List your payment methods: every card, wallet, payment app and bank account, and which phone and email each is tied to.
Secure the foundations: phone passcode and biometrics, unique email password with two-step verification, carrier account PIN.
Turn on alerts: notifications for every card and app payment and for new device sign-ins.
Set limits and controls: card category blocks, daily transfer limits and app spending limits you can raise temporarily if needed.
Move logins to passkeys or an authenticator app for banking and payment apps that support them.
Choose a default method per payment type using the table above, and agree it with others in the household.
Close or remove what you do not use: old payment apps, stored cards on shopping sites and dormant accounts.
Review monthly: read statements, check linked devices and connected apps. Rolling back is simple: limits and blocks can be lifted in the app if they get in the way.

If something goes wrong

Contact your bank or card issuer immediately using the number on the back of your card or the official app, not a number from a message.
Freeze the card or account in the app while you call.
Report to the payment app through its official app or website and open a dispute within its time limit; Citizens Advice says PayPal disputes must be opened within 180 days of payment.
In the US, report in writing as well as by phone and note the date: Regulation E liability tiers depend on when you gave notice.
Report the crime: in England, Wales and Northern Ireland to Report Fraud (reportfraud.police.uk or 0300 123 2040, per Take Five), in Scotland to Police Scotland, in the US to the FBI's IC3 and the FTC.
Secure accounts: change passwords, sign out other sessions, check email forwarding rules and recovery details.

The What to Do If You Have Been Scammed Guide covers recovery and emotional support in more depth.

Checking your protection is working

Alert coverage: every card and app sends a notification for every payment.
Time to notice: how long it took to spot the last unexpected transaction; aim for the same day.
Strong login coverage: number of financial accounts on passkeys or app-based verification rather than SMS.
Stored cards: number of shopping sites holding your card details, falling over time.
Method discipline: purchases from strangers made only through protected methods.

Common failure patterns

Paying a stranger as a "friend": choosing the personal payment option to avoid a fee and losing purchase protection.
Using Zelle or bank transfer for online purchases: the money behaves like cash once sent.
Debit card for everything: a compromised debit card drains the account you pay bills from while the dispute is investigated.
No alerts: misuse is found on the monthly statement, after the cheapest US liability window has passed.
Unlocked phone, unlocked apps: a stolen unlocked phone gives access to wallets and banking apps with no further barrier.
Reading out a code: victims share a one-time passcode with a "bank" caller, approving the fraudster's payment or new device.

Practitioner checklist

Use a credit card or mobile wallet for online purchases from businesses.
Use payment app personal payments and Zelle only for people you know and trust.
Mark purchases as goods and services, or use platform checkout, when buying from individuals.
Turn on payment notifications for every card and app.
Protect the phone, email and mobile number that your money depends on.
Move banking and payment logins to passkeys or an authenticator app.
Set card controls and transfer limits; use virtual card numbers for subscriptions.
Never share one-time codes or move money to a "safe account".
Report unauthorised transactions immediately, in writing in the US, and keep a record of the date.

Protecting Your Personal Finances Online: Card, Bank and Payment App Safety