Bank Transfer to a Supplier: What the APP Fraud Rules Cover

Since 7 October 2024 UK banks must reimburse most authorised push payment scam victims up to £85,000. Does that cover a research-materials order paid by bank transfer or open-banking 'pay by bank' that never arrives?

Mostly no, and the reason is a distinction the rules draw on purpose. The UK reimbursement requirement protects people who were deceived into paying a fraudster. It does not protect a buyer who paid a genuine supplier that then failed to deliver or delivered something defective. The Payment Systems Regulator calls that second situation a civil dispute and says it sits outside the scheme ^[3].

So a bank transfer or open-banking payment to a research supplier is covered if the supplier was a fake or an impersonation, and not covered if the supplier was real and simply did not perform. In practice a buyer rarely knows which it is on day one, which is why the question is worth settling before paying, not after.

What an authorised push payment is

An authorised push payment is one the account holder instructs the bank to make. You log in, you enter the account details, you confirm. The word authorised matters: the payment was not taken from you, it was sent by you. The fraud lies in how you were persuaded to send it.

A bank transfer to a supplier fits that description exactly. It is a push payment, because you start it, and it is authorised, because you approve it. Whether it is also an APP scam depends on the legal definition, which is narrower than the everyday idea of being cheated.

The PSR's Specific Direction 20 defines an APP scam as one in which a person uses a fraudulent or dishonest act or course of conduct to manipulate, deceive or persuade a consumer into transferring funds to an account the consumer does not control, where either the recipient is not who the consumer intended to pay or the payment is not for the purpose the consumer intended ^[4]. The direction adds that if the consumer is party to the fraud or dishonesty, it is not an APP scam for these purposes ^[4].

The reimbursement requirement on one page

The PSR confirmed the policy start date of 7 October 2024 in its policy statement PS23/4. Payments made on or after that date are covered, and where a claim involves a series of payments, those made before the start date are not ^[2]. The PSR's overview says everyone making a payment by Faster Payments or CHAPS from one UK bank account to another is covered, and that the sending and receiving firms share the cost of reimbursement equally ^[1].

The headline figures need care, because they changed between the policy statement and the live rule. PS23/4, published in December 2023, confirmed a maximum level of £415,000 ^[2]. The PSR's current consumer page states that the maximum amount people can claim is £85,000, and that firms may choose to reimburse more ^[3]. Law firm commentary describes the lower figure as the outcome of industry feedback ^[5]. Use the figure on the live page, read on 10 October 2026, and confirm it again before relying on it.

These terms are sourced from the PSR's consumer page ^[3]. The 13-month window also appears in the PS23/4 description of the reimbursement rules, where the sending firm is not obliged to reimburse a claim submitted more than 13 months after the last payment in the case ^[2].

Scam versus civil dispute

The PSR's consumer guidance separates APP fraud from civil disputes, describing the latter as cases where you might pay a legitimate supplier for goods or services that are not received or are defective, and noting that such disputes may fall under consumer law instead ^[3]. Law firm commentary puts it the same way: claims relating solely to civil disputes are not covered ^[5].

The words civil dispute do not appear in the text of PS23/4 as published. The exclusion follows from the legal definition quoted above, which requires a fraudulent or dishonest act, and the plain wording of the exclusion is on the PSR's consumer page. If you need to quote it, quote that page, with the date you read it.

The difficult middle case is a supplier that was never genuine from the start but operates through a real company. Whether that is a dishonest act designed to deceive, or a failed business, is a question the bank assesses on the evidence. Do not assume the outcome either way.

Pay by bank and open banking

Open-banking payment initiation lets a checkout instruct your bank to make a payment without you typing sort code and account number. The payment generally settles over Faster Payments, so it sits inside the same rules as a transfer you enter yourself. It is a push payment, and the line between scam and civil dispute is drawn in the same place.

What it does not carry is card protection. There is no section 75 claim and no scheme chargeback, because the payment is not a card transaction. A smooth checkout and a one-tap approval can feel safer than they are. The convenience is not a remedy.

The standard of caution

Reimbursement is not automatic. A firm may refuse where a consumer, with gross negligence, has not met the consumer standard of caution. PS23/4 narrows that to four requirements: having regard to interventions made by the bank or the police, reporting promptly and within 13 months, responding to reasonable requests for information, and reporting the matter to the police after making a claim ^[2].

The standard does not apply to customers identified as vulnerable ^[2]. Gross negligence is described as a higher bar than carelessness, so an ordinary mistake does not usually defeat a claim. What it does mean is that a warning from your bank at the payment stage is something to read, not to click through.

Who can claim

The PSR names individuals, microenterprises and charities ^[3]. PS23/4 uses a definition of consumer that includes microbusinesses, smaller charities and individuals ^[2]. A microenterprise under the payment services rules is generally a very small business, defined by headcount and turnover; ask your bank whether your organisation qualifies.

A university department paying from a central finance account, or a company of any real size, is unlikely to be inside that definition. For them, the practical protections are contractual and procedural, and a related article on changed bank details covers the control that matters most.

The first 24 hours after a payment to a fraudster

1. Contact your bank immediately, using the number on your card or in its app, and say that you have made an authorised push payment to a fraudster.
2. Give the exact time, amount, recipient name, sort code and account number, and the way you were contacted.
3. Do not send any further payment to the same recipient, including a 'fee' to release the first one.
4. Report the matter to the police through Action Fraud. The police reporting requirement is one of the four standard-of-caution items ^[2].
5. Keep the invoice, the emails, the web page as it appeared and the bank's confirmation. Respond promptly to any request from the bank for more information.
6. Note the date. The window to claim is 13 months from the payment ^[3], but the sooner the receiving bank is told, the better the chance of recovering funds.

Choosing a payment method for a first order

For a first order from a supplier you have not used before, the table of remedies decides the question more than convenience does. A credit card can carry section 75 for a qualifying item. A debit card can carry chargeback. A bank transfer carries neither, and carries APP reimbursement only if you were the victim of a scam, not if you picked a poor supplier.

Where a transfer is unavoidable, reduce the exposure. Pay the smallest first order that tests the relationship. Verify the company and its bank details through an independent route. Use the bank's payee name check, and treat anything other than a full match as a reason to stop and make a call. Keep the evidence of the listing and the terms, because in a civil dispute your claim is against the supplier and the paperwork is your case.

Finally, read the supplier's terms for what happens if an order is not fulfilled: refund timing, who bears the risk in transit, and which law governs. Those terms are the only remedy the rules above do not replace.