APP fraud reimbursement: where does the preventable loss enter the payment journey?

Mandatory reimbursement changed an APP scam from a customer-service event into a shared operating cost. Since 7 October 2024, qualifying scams sent through Faster Payments or CHAPS are normally reimbursed under common rules, with sending and receiving firms splitting the cost. By the end of 2025, Payment Systems Regulator data showed 352,000 reported claims, 243,000 in scope and £243 million returned across the first fifteen months. The commercial question is no longer whether a payment firm needs a policy; it is where evidence, intervention and receiving-account controls fail often enough to justify a paid remediation sprint. This reading follows one claim from intake to contribution, separates rule from judgement, and shows how firms can turn reimbursement data into prevention, complaint quality and recurring control testing. It does not promise that a particular claim will be paid or that a control will eliminate fraud.

The mandatory regime covers qualifying authorised push payment scams made on or after 7 October 2024 between UK accounts through Faster Payments or CHAPS. The customer authorised the payment but was deceived about its recipient or purpose. Card fraud, cash, international transfers, crypto transfers and unauthorised payments follow different rules.

The first control is therefore classification. Rail, date, sending and receiving account, customer category and scam narrative must be preserved before a reimbursement conclusion is attempted. A series of related transfers should remain linked; splitting them into isolated complaints can distort value, timing and evidence.

The rule also covers different firm roles. A payment institution may be the sending provider in one case and hold the receiving account in another. The remediation opportunity appears when those perspectives can be joined without weakening responsibility or privacy controls.

Qualifying customers include consumers, micro-enterprises and qualifying charities within the rule definitions. Eligibility is not decided by sympathy or account label alone. The firm must confirm the legal customer category, payment facts and any relevant exclusions while applying additional protections where vulnerability affects the customer’s ability to meet the expected standard of caution.

The intake journey should collect the minimum facts needed without forcing a distressed customer to retell the event to several teams. It must also distinguish a business payment dispute from deception. That boundary protects genuine victims and prevents reimbursement staff from becoming an informal commercial-dispute service.

Eligible claims are generally reimbursed within five business days, although the timetable can extend to 35 business days where more information is needed. The maximum mandatory reimbursement is £85,000 per claim, and a firm may apply an excess of up to £100 subject to the rules. Vulnerable consumers receive specific protection.

These figures are operating parameters, not marketing promises. A firm needs clocks for acknowledgement, investigation, information requests, decision, payment and receiving-firm contribution. The case should show why time stopped or extended and who approved it.

A paid review should sample closed and open claims, trace them through scope, evidence, vulnerability, decision, timing, reimbursement and contribution, then compare those results with fraud alerts and receiving-account activity. Its output is a prioritised remediation plan—not a generic policy rewrite or a promise to reduce losses by an invented percentage.

The first purchase can be bounded to one product, channel or three-month case sample. It should include decision consistency, hand-offs, management information, complaint escalation and root-cause coding. The buyer receives a red-amber-green control map, named fixes and an estimate based on real case volumes.

The reimbursement cost is normally shared equally between the sending and receiving payment firms. That makes receiving-account onboarding, mule detection, transaction monitoring and intelligence response economically visible. A firm that rarely receives consumer complaints can still incur contribution costs because its account was used to receive scam proceeds.

The receiving firm should link contributions to account-opening channel, customer type, device and network signals, transaction velocity, previous alerts and time to restriction. Aggregated carefully, those cases reveal which acquisition sources or account features create disproportionate exposure.

The lesson is not to block every unusual customer. It is to identify where controls are late, poorly tuned or disconnected. A remediation specialist must therefore understand both fraud operations and customer access, not simply recommend more friction.

Firms should apply the consumer standard of caution to the facts and evidence of the individual claim, not as an automated reason to reject victims. They must consider whether the customer ignored a tailored intervention or failed to cooperate, while recognising the special position of vulnerable consumers and documenting the reasoning behind any exception.

Warning logs need more than a screen impression. The file should record what the customer saw, when, in which context and what action followed. Repeated boilerplate warnings may demonstrate delivery while failing to demonstrate usefulness. The FCA links anti-fraud controls and customer communications to foreseeable harm under Consumer Duty.

Good complaint handling reveals whether reimbursement decisions are consistent, understandable and supported by the evidence customers actually receive. Ombudsman referrals, overturned decisions, repeat contact and vulnerability failures should feed back into policies, staff coaching, warning design and fraud models rather than remain isolated in a complaints dashboard.

A monthly forum can connect operations, financial crime, complaints, product and data. It reviews a small set of cases in depth, identifies systemic causes and assigns changes. This is more valuable than a report containing only average handling time and reimbursement totals.

The recurring service should test a changing sample of claims, monitor contribution and complaint patterns, validate root-cause actions and challenge management information. Its value is independent evidence that fixes work over time. It should not take ownership of regulated decisions or imply that outsourced monitoring makes the payment firm compliant.

Scope can rotate across products, scam types, vulnerable customers and receiving-account cohorts. Quarterly executive reporting should distinguish observed facts, model changes, unresolved risk and decisions required. That creates continuity without manufacturing busywork.

The clearest buyers show a trigger: reimbursement or contribution cost rising, complaint decisions being overturned, a new payment product launching, a receiving-account fraud cluster, weak management information or supervisory scrutiny. Search, regulatory content, industry events, partnerships, calls, email and targeted voicemail can each reach a different decision-maker.

The message should identify the decision rather than exploit fear: “Which case cohort explains your preventable contribution cost?” A short fit screen confirms rail, firm role, volumes, data access, sponsor and capacity. Only then does the paid sample review make sense.

The offer is ready when the partner can analyse real claims securely, separate legal judgement from operational testing, produce a bounded remediation decision and support a recurring evidence cycle. GetFishNet’s free eligibility test checks buyer access, proof, capacity, margin and market expansion before any campaign is launched.

If confidential data cannot be accessed or the service depends on promising a reduction no one can substantiate, the campaign should stop. A credible proposition sells clearer evidence and faster prioritisation. Outcomes remain owned by the payment firm, its controls and the fraud environment.

Authorities cited: Payment Systems Regulator; Financial Conduct Authority; Bank of England; Pay.UK. Dated references remain in the private source register.