APP scam reimbursement: when a small business may be covered

Mandatory reimbursement rules for authorised push payment scams can protect qualifying microenterprises and charities as well as individuals. The rules do not cover every business or every payment problem, so the first step is to check whether the organisation, payment and scam fall inside the scheme.

Check whether the organisation qualifies before assuming the rules apply

The Payment Systems Regulator says the mandatory APP reimbursement protections apply to individuals, microenterprises and charities. They are not a blanket reimbursement guarantee for every SME. A larger company can therefore fall outside the mandatory scheme even though the same fraud would look identical operationally.

If eligibility is uncertain, ask the payment provider which definition it is applying and request the reason in writing. Do not rely only on labels such as small company or family business. The relevant regulatory category determines whether the mandatory reimbursement rules apply.

Check whether the scam payment was made through a covered UK payment rail

The PSR's reimbursement regime began on 7 October 2024 and applies to covered APP scam payments made through Faster Payments, with parallel protections introduced for CHAPS. The scam involves a payer being deceived into authorising a transfer to a recipient or for a purpose different from what the victim intended.

This is different from an ordinary commercial dispute. If a genuine supplier delivers poor-quality goods after receiving an authorised payment, that is not automatically an APP scam. The claim depends on deception about the recipient or purpose, not simply dissatisfaction with the transaction.

Understand the standard £85,000 reimbursement cap and possible excess

The current PSR standard maximum reimbursement amount is £85,000 per claim, although individual firms can choose to reimburse more. The regulator says this level covers more than 99 percent of claims by volume. A payment provider can also choose to apply an excess of up to £100 in a reimbursable claim.

The possible excess does not apply in the same way to vulnerable consumers under the rules. For a business claim, ask the provider whether it is applying an excess and how the reimbursable amount was calculated. Keep the original payment amount, recovery from the recipient bank and any partial refund clearly separated in the claim record.

Report the scam quickly and preserve the evidence trail

Contact the sending payment provider immediately using official contact details. Provide the beneficiary, payment amount, time, reference, communication with the fraudster and the moment the deception became clear. Also preserve emails, invoices, messages and call records. If a supplier bank-change fraud is involved, keep both the genuine and fraudulent instructions.

The PSR says most reimbursable claims should be handled within five business days. Where more information is genuinely needed, firms can stop the clock for specified reasons, but the process is subject to an overall 35-business-day outcome requirement. Fast reporting also improves the chance of recovering money before it moves onward.

Understand that reimbursement does not remove the need for reasonable payment controls

The reimbursement framework includes a consumer standard of caution. The PSR can allow a claim to be rejected where the provider proves the payer acted with gross negligence in relation to required caution. The bar is deliberately high, and the PSR's 2026 dashboard shows only a small proportion of claims rejected on caution grounds.

Businesses should still follow bank warnings, verify changed beneficiary details and cooperate with information requests. Mandatory reimbursement should not become a reason to weaken dual approval or supplier verification. Good controls prevent the disruption, investigation and uninsured exposure that can remain even when part of a loss is later reimbursed.

Know the escalation route when the loss exceeds the cap or the provider rejects the claim

The PSR says firms may reimburse more than £85,000 voluntarily. Where a victim loses more or is dissatisfied with the provider's decision, the complaint can be taken through the provider's formal complaint process and, for eligible complainants, to the Financial Ombudsman Service.

Keep the reimbursement claim and complaint evidence in one file. State why the payment meets the APP scam definition, why the organisation is in scope and how the provider applied any exception. For a larger business outside the mandatory scheme, report the fraud immediately anyway and pursue recovery and complaint routes available under the account terms and general banking rules.

Do not mix the reimbursement decision with the internal incident review. Even where the bank repays most of the loss, the business should still ask how the scam passed its controls. A supplier bank-change scam that succeeds once can succeed again unless beneficiary verification, staff training and payment approvals are strengthened after the claim.