Who Pays When a Scam Payment Is “Authorized”?

Two people, one in Leeds and one in Ohio, get the same call from someone posing as their bank’s fraud team. Both are told their account is compromised and talked into moving their savings to a “safe account.” Both press the button themselves. In the UK, the victim can claim reimbursement of up to £85,000 under rules in force since October 2024. In the US, the victim’s bank will often say the transfer was authorized, because the customer made it.

The difference is not about which victim was more careful. It is about where the law puts the loss when a person is persuaded rather than hacked, and that choice changes who has a reason to invest in stopping the persuasion.

The word that decides the outcome

In US consumer banking, the key definition sits in Regulation E, which implements the Electronic Fund Transfer Act. An “unauthorized electronic fund transfer” is one “initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit,” according to the text of 12 CFR 1005.2. A transfer that the consumer initiated, even under deception, generally falls outside that definition, so the strong unauthorized-transfer protections do not apply.

That is the same gap we described in a business context in “the email passed authentication; the payment still needs authorization”. A system checks whether the right person pressed the button. It does not check whether that person was told the truth.

Two rulebooks side by side

The UK details come from the Payment Systems Regulator’s consumer guidance and its October 2024 policy statement, which set the start date as October 7, 2024 and cut the maximum claim to £85,000. The guidance says that limit covers over 99% of claims, allows an optional excess of up to £100 that “cannot be applied to vulnerable consumers,” and gives victims 13 months to claim.

What the UK data shows after 18 months

The PSR’s reimbursement dashboard, updated in July 2026 with data to March 31, 2026, gives the first long run of figures.

The rejection figure is worth noticing. The rule lets firms refuse victims who were grossly negligent, and critics worried that banks would use the exception widely. In the latest quarter, about 2% of claims were rejected on that ground.

Did reimbursement reduce the fraud?

The question that matters for incentive design is not whether victims got money back, but whether making banks pay changed what banks did. An independent evaluation by Frontier Economics, published by the PSR on July 1, 2026, estimates that “APP fraud losses have fallen by an estimated £73 million per year” and that the number of scams fell by nearly 35,000. The PSR said the biggest improvements came at firms with the highest fraud levels before the policy, and that “firms are investing in prevention.”

That is the incentive argument in its plainest form. When a bank carries the loss, it has a reason to slow suspicious payments, question customers about unusual transfers, and refuse to open accounts that look like mule accounts. When the customer carries the loss, the same steps are costs with no direct return.

The friction that comes with liability

Prevention has a visible cost for customers. A bank that carries the loss will hold payments, ask questions about why money is moving and show warnings that interrupt a transfer. People in the middle of a scam often experience those interruptions as obstacles, because the scammer has prepared them for exactly that moment, for instance with a line like “the bank may ask questions; say it is for a renovation.” A well-designed intervention has to work against a script the customer has already been given.

That is why the design of the conversation matters as much as the rule. Our article on why knowing the warning signs is easier than saying no in the moment describes the social pressure on the person being questioned. A liability rule gives banks a reason to ask. It does not by itself make the asking effective, and a bank that interrupts badly can teach customers to give rehearsed answers faster.

The caveats the industry raises

UK Finance, the banking trade body, supports reimbursement but disputes that it solves the problem. Its Annual Fraud Report 2026 counted 248,070 APP cases in 2025, up 7%, and losses of £576.4 million, up 19%, across a wider scope than the PSR scheme. Its foreword says: “Reimbursement is important, but it is not stopping the fraud.”

Both statements can be true. The Frontier evaluation estimates what would have happened without the rule; the UK Finance count measures what did happen across all APP fraud. Our explainer on why two reports can disagree without contradicting each other applies directly. The trade body also notes where scams start: in its data, 66% of APP cases began online and 17% via telecoms, which is its argument that technology platforms and phone networks should share the cost.

There is also an awareness gap. The PSR’s one-year review in October 2025 found that 71% of victims surveyed were unaware of the policy and 49% did not try to claim. A protection people do not know about does less than its headline rate suggests.

The US position in 2026

In the US, the main federal attempt to push banks toward covering induced payments went nowhere. The Consumer Financial Protection Bureau sued JPMorgan Chase, Bank of America and Wells Fargo, along with Zelle’s operator, Early Warning Services, on December 20, 2024, alleging they let fraud “fester” on Zelle. Its own page now notes that on March 4, 2025 the bureau voluntarily dismissed the case against all defendants with prejudice.

New York’s attorney general sued Early Warning Services in August 2025, alleging scammers stole “over $1 billion between 2017 and 2023” and that the company failed to “require banks to reimburse consumers for certain scams.” We found no outcome. At the state legislative level, a Massachusetts bill on customer reimbursement for financial fraud (H.1081) was sent to a study order in November 2025, which usually means it will not advance.

Some US banks reimburse certain scam victims voluntarily, and payment networks have their own policies. But voluntary policies vary, are hard for customers to compare and can change without notice.

What the comparison does and does not prove

The UK experience is a natural experiment, not a controlled trial. Fraud trends shift for many reasons, and the evaluation’s £73 million estimate rests on a model of what would have happened otherwise. It also does not show that UK-style rules would work identically in a US market with thousands of banks and different payment systems.

What it does show is that a liability rule can be run at scale, that most claims are paid quickly, that the negligence exception has been used sparingly, and that the firms that carry the cost appear to invest in prevention. For anyone arguing about US policy, those are the facts to start from. For any organization, inside or outside banking, the broader lesson stands: if you want a process to resist persuasion, put the cost of being persuaded on whoever designs the process.

Sources

• APP scams reimbursement dashboard (PSR, updated July 30, 2026): reimbursement rate, claims, speed, rejections.
• Payment fraud falls by £73m following PSR reimbursement scheme (PSR, July 1, 2026): Frontier Economics evaluation.
• One year on (PSR, October 8, 2025): awareness survey.
• PS24/7 (PSR, October 2, 2024) and APP fraud reimbursement protections (PSR): start date, cap, exceptions, timelines.
• Annual Fraud Report 2026 (UK Finance, June 2026): case and loss counts, origin data, foreword.
• 12 CFR 1005.2 (CFPB): definition of unauthorized transfer.
• CFPB Zelle lawsuit (CFPB, December 20, 2024, with dismissal note).
• Attorney General James sues company behind Zelle (New York AG, August 13, 2025).
• Bill H.1081 (Massachusetts Legislature): status.