Payment fraud in Europe: APP scams, UK refunds and the EU PSR

Scams where victims authorise payments are surging in Europe. The numbers, the UK's 88% reimbursement rate and what the EU changes with verification of payee.

2026-10-06

Europe's fastest-growing fraud is the one where victims authorise the payment themselves, tricked by someone posing as their bank, a supplier, an investment adviser or a romantic partner. The UK calls it authorised push payment (APP) fraud and already mandates reimbursement; the EU is responding with verification of payee and a new Payment Services Regulation.

The EU picture

The joint EBA-ECB report of 15 December 2025 found total payment fraud in the EEA rose to €4.2 billion in 2024 from €3.5 billion (EBA). Credit transfer fraud reached €2.2 billion, up 16%, and users bore about 85% of those losses, mostly from scams that led them to initiate payments. Strong customer authentication still works against the fraud it was designed for; card fraud was 17 times higher when the payee was outside the EEA.

UK: the reimbursement experiment

UK Finance data reported by Neopay show payment fraud losses of £1.28 billion in 2025 (+4%). APP fraud reached £576.4 million (+19%) across 248,070 cases; investment scams were the largest category at £221.5 million (+40%). Some 66% of APP cases started online and 17% via telecoms.

Since 7 October 2024, payment firms must reimburse APP victims on Faster Payments up to £85,000, with an optional £100 excess. The PSR dashboard shows 88% of money lost (£316 million) was returned over the 18 months to 31 March 2026, and 89% in Q1 2026. Only 3% of claims were rejected for lack of consumer caution.

Metric	EU (2024)	UK
Total payment fraud	€4.2bn	£1.28bn (2025)
Credit transfer / APP fraud	€2.2bn	£576.4m (2025)
Who bears losses	~85% users	88% reimbursed

EU verification of payee

Under the Instant Payments Regulation, euro-area payment providers have had to offer free verification of payee since 9 October 2025; non-euro states follow by 9 July 2027 (PwC Legal). It covers all SEPA credit transfers between payment accounts and returns match, close match, no match or other. Payers may proceed, but if they do after a warning they bear the risk of a misdirected transfer.

The Payment Services Regulation

A provisional deal on the PSR and PSD3 was struck on 27 November 2025 (William Fry). According to Taylor Wessing, it includes mandatory name-identifier checks, fraud data sharing between providers, full refunds for bank-employee impersonation scams when the victim reports to police and the provider, liability for providers lacking adequate fraud controls, and liability of online platforms towards reimbursing banks when they fail to remove reported fraudulent content. It also restricts platforms and search engines from advertising financial services by firms not authorised in the relevant member state. The texts still need formal adoption, and a transition of about 21 months was expected.

Two models

The UK chose broad, bank-funded reimbursement for authorised scams. The EU, for now, leans on prevention (verification of payee, data sharing) and targeted refunds for bank-impersonation fraud, while pushing part of the bill onto the digital platforms where many scams begin. For Brazil, where Pix scams follow the same pattern, both approaches are useful benchmarks.

Checklist

Treat a "no match" payee warning as a stop sign.
Hang up on callers claiming to be your bank and call back on the official number.
Check that investment advertisers are authorised.
Businesses: confirm supplier bank-detail changes on a second channel.
Report to police and your bank immediately.