Are businesses covered by APP fraud reimbursement in the UK?

If a fraudster tricks your business into paying them, will the bank refund you? In the UK, it depends on what kind of business you are. Mandatory reimbursement for authorised push payment (APP) scams started on 7 October 2024, and it was written mainly for consumers. Small businesses are partly in. Most growing companies are out.

Who is covered by APP fraud reimbursement?

The rules cover payments made by:

If your company has 10 or more staff, or is above the €2 million line, the mandatory scheme does not apply to you, whatever the size of the loss.

Which payments does it cover?

The scheme covers Faster Payments and CHAPS payments sent within the UK, from a UK payment account to another UK account controlled by the fraudster. The maximum reimbursement is £85,000 per claim. The sending firm can deduct an excess of up to £100.

It does not cover:

1. International payments, including SWIFT wires and SEPA transfers.
2. Card payments, which have their own chargeback and dispute rules.
3. Payments to an account you control, even if you were then scammed from there.
4. Civil disputes, such as a real supplier who delivered poor goods.

For a business that pays overseas suppliers, the first exclusion matters most. A fake invoice from a "supplier in Shenzhen" paid by international wire has no mandatory route back.

How does a claim work?

1. Report the scam to your payment provider as soon as you notice, within 13 months of the last payment.
2. The provider assesses the claim and should reimburse within 5 business days.
3. It can stop the clock to ask for information, but must reach a decision within 35 business days.
4. The cost is split between the sending firm and the receiving firm.

A firm can refuse where it shows gross negligence or that the claimant took part in the fraud. Ignoring a clear, specific warning from the bank at the time of payment can count against you.

What can a larger company do?

Without the mandatory scheme, prevention is the protection. The scams we see most against businesses are payment detail changes on supplier invoices, fake CEO requests to finance, and people posing as the bank's fraud team.

Controls that stop most of them:

1. Confirm any new or changed bank details by phone, on a number you already had, never one in the email.
2. Read the Confirmation of Payee result and stop on a no match or close match. See what each Confirmation of Payee result means.
3. Require a second person to approve new payees and large payments.
4. Send a small test payment to a new supplier and have them confirm it.

Our guide to invoice fraud and payment detail scams has examples and a checklist you can give your team.

Does insurance cover APP fraud?

Some commercial crime or cyber policies cover social engineering fraud, often with a separate, lower limit. Read the wording: many require that you followed a call-back procedure before paying. If you do not, the claim may fail.

How Rivet handles payee checks

Rivet is a business account for registered companies. From the Growth plan, a Rivet workspace has team roles and approvals, so a payment can need a second person before money moves, and the payouts screen shows the recipient's name and details as entered before you confirm. That step catches more fraud than any refund scheme repays.