Banking Fraud Guide UK (Scams, Unauthorised Payments, Protection 2026)

Types of Banking Fraud

Banking fraud takes many forms, but the most common in 2026 are:

• Authorised Push Payment (APP) scams: You are tricked into authorising a payment to a fraudster posing as your bank, a company, the police, or a romantic partner. This is the biggest category of UK banking fraud by value — over £500m lost in 2025.
• Phishing and smishing: Bogus emails or texts that appear to be from your bank, HMRC, or a delivery company, asking you to click a link that steals your login details.
• Card fraud: Your debit or credit card details are used without your permission — either through a cloned card, lost or stolen card, or online card-not-present fraud.
• Purchase scams: You pay for goods or services (often on social media or marketplace sites) that never arrive — this is also an APP scam but through a purchase transaction.
• Investment scams: Fraudsters lure you into fake investment schemes promising high returns — often using professional-looking websites and fake celebrity endorsements.
• Identity theft: Someone uses your personal information to open bank accounts, take out loans, or make purchases in your name.

Each type of fraud has different protections and recovery routes. If you have been targeted, the steps you take in the first 24 hours are critical. See our Credit Score guide → for how fraud affects your credit report.

What to Do Immediately If You Spot Fraud

If you suspect banking fraud, act immediately. The faster you act, the more likely you are to recover your money. Follow these steps:

• Call your bank or card provider immediately using the number on the back of your card or their official app — never call a number from an email or text message. Most banks have 24/7 fraud hotlines.
• Report the fraud to Action Fraud (the UK's national fraud and cyber crime reporting centre) at actionfraud.police.uk or call 0300 123 2040. They will give you a crime reference number.
• Change your online banking passwords and PINs immediately. Use a strong, unique password that you do not use on any other site.
• Check your recent transactions on your banking app or online account. Report any unrecognised payments.
• If your card has been lost or stolen, ask your bank to cancel it immediately and send a replacement.
• Freeze your credit file with the three credit reference agencies (Experian, Equifax, TransUnion) — this prevents fraudsters from opening new accounts in your name.
• If you have been tricked into an APP scam, tell your bank it was an authorised push payment — this triggers the CRM Code protections. Do not be embarrassed — thousands of people fall victim every day.

Keep a record of all communications with your bank, including names, dates, and reference numbers. If the bank does not resolve your case quickly, you can escalate to the Financial Ombudsman Service. See our FSCS guide → for how deposit protection works.

Unauthorised Transactions — Your Right to a Refund

If someone makes a transaction from your account without your permission (unauthorised transaction), UK law gives you a strong right to a refund. Under the Payment Services Regulations 2017, your bank must immediately refund any unauthorised transaction unless they can prove you authorised it or that you acted fraudulently or with gross negligence. You must report the unauthorised transaction without undue delay and within 13 months of the transaction date. In practice, report it within 24–48 hours. The refund includes both the transaction amount and any fees or interest caused by it. Your bank must complete their investigation within 15 business days (extendable to 35 in some circumstances). If they decide you were grossly negligent (for example, you shared your PIN or password), they may refuse the refund — but the burden of proof is on the bank. Examples of unauthorised transactions include: your card is cloned and used in a shop, someone uses your online banking credentials without your knowledge, or a direct debit is set up without your consent. If your bank rejects your claim, you can take the case to the Financial Ombudsman Service free of charge. For credit card unauthorised transactions, you also have protection under Section 75 of the Consumer Credit Act 1974 — this covers purchases between £100 and £30,000 and the credit card provider is jointly liable with the retailer. See our Section 75 guide → for full details.

Authorised Push Payment (APP) Scams and the CRM Code

APP scams are the most devastating type of banking fraud because you authorised the payment yourself — you were tricked into doing so. Common APP scams include: a fraudster posing as your bank calling to say your account is compromised; a fake invoice from a supplier you regularly use; a romance scam where the fraudster builds a relationship and then asks for money; or an investment scam promising high returns. The Contingent Reimbursement Model (CRM) Code, introduced in 2019 and made mandatory from 2024, requires banks and payment providers to reimburse APP scam victims in most cases. The code covers payments made through Faster Payments, CHAPS, and Bacs. You are entitled to reimbursement if: you were not at fault (you did not ignore bank warnings or provide one-time passcodes), you reported the scam promptly, and the bank failed to take sufficient steps to prevent the fraud. From October 2024, the mandatory reimbursement limit is £415,000 per claim (yes — four hundred and fifteen thousand pounds). Banks must reimburse within 5 business days in most cases. If the bank decides you were grossly negligent (for example, you ignored multiple warnings), they can refuse or reduce reimbursement. The reimbursement is split 50/50 between the sending bank and the receiving bank. If your bank rejects your claim, you can escalate to the Financial Ombudsman Service. APP scams involving cryptocurrency payments are not covered by the CRM Code. Always be suspicious of anyone asking you to transfer money to a "safe account" — this is the most common scam script used by fraudsters.

Section 75 and Chargeback for Fraud

Two important consumer protection tools can help you recover money lost to fraud or failed purchases. Section 75 of the Consumer Credit Act 1974 applies to credit card purchases between £100 and £30,000. If the goods or services are not delivered, are faulty, or the transaction was fraudulent, the credit card issuer is jointly liable with the retailer. This means you can claim your money back from your credit card provider even if the retailer has gone bust or disappeared. Section 75 covers both UK and overseas purchases. You must claim within 6 years (or within 6 months of discovering the problem). See our Section 75 guide → for a detailed walkthrough. Chargeback is a scheme run by Visa, Mastercard, and American Express that allows you to reverse a debit or credit card transaction if the goods or services were not as described or not delivered. Unlike Section 75, chargeback has no minimum spend — it applies to any amount. However, you must claim quickly: usually within 120 days of the transaction date or the expected delivery date. Chargeback is not a legal right — it is a voluntary scheme — but most card providers honour it. If the retailer disputes the chargeback, the card provider will investigate. Chargeback can be used for failed purchases, goods that never arrived, and some types of fraud. You can use both Section 75 and chargeback in some circumstances, but you cannot recover more than the transaction value. See our Chargeback guide → for the full process.

How to Protect Yourself from Banking Fraud

Prevention is the best defence against banking fraud. Follow these key practices to keep your money safe:

• Never share your PIN, password, or one-time passcode with anyone — your bank will never ask for these.
• Be sceptical of unexpected calls, texts, or emails claiming to be from your bank, HMRC, the police, or a delivery company. If in doubt, hang up and call your bank on their official number.
• Use the 159 call service — dial 159 to speak directly to your bank's fraud team if you suspect a scam. This number connects you to most UK banks.
• Enable two-factor authentication (2FA) on all financial accounts and use biometric security (fingerprint or face ID) on your banking app.
• Check your statements regularly — at least once a week. Use your banking app to monitor transactions in real time.
• Set up transaction alerts on your account so you are notified immediately of any payment over a certain amount.
• Keep your devices and software updated — use antivirus software and avoid using public Wi-Fi for banking.
• Register with CIFAS Protective Registration if you believe you are at heightened risk of identity fraud — this adds extra checks when anyone applies for credit in your name.
• Be cautious on social media and dating sites — romance scams and purchase scams are rife. Never send money to someone you have not met in person.

If you do fall victim, remember that the UK's banking fraud protections are among the strongest in the world. You are very likely to get your money back if you report quickly and follow the right process. For more on credit and fraud protection, see our Credit Score guide → and FSCS Compensation guide →.

FAQs

What is the difference between Section 75 and chargeback?

Section 75 is a legal right under the Consumer Credit Act that applies only to credit card purchases between £100 and £30,000. Chargeback is a voluntary industry scheme that applies to both debit and credit cards with no minimum spend but you must claim within 120 days.

Will my bank refund me if I was tricked into sending money (APP scam)?

Yes, in most cases. Under the CRM Code, your bank must reimburse you for APP scams unless you were grossly negligent (e.g. you ignored warnings or shared your one-time passcode). The reimbursement limit is £415,000 per claim and must be paid within 5 business days.

How long do I have to report banking fraud?

For unauthorised transactions, you have up to 13 months but should report within 24–48 hours. For APP scams, report as soon as you realise. For chargeback, the limit is 120 days. For Section 75, up to 6 years. Reporting quickly gives you the strongest protection.

Can I get my money back if I paid by bank transfer (Faster Payments)?

Yes — if it was an APP scam, the CRM Code requires your bank to reimburse you in most cases. If it was a genuine mistake (wrong account number), your bank will try to recover the money but there is no guarantee. Contact your bank and Action Fraud immediately.

What should I do if my bank refuses to refund a fraudulent transaction?

Ask for the bank's final written response, then escalate to the Financial Ombudsman Service (free of charge). You must do this within 6 months of the bank's final response. The Ombudsman can order the bank to refund you, plus compensation for distress.