Source: https://rivet.global/blog/app-fraud-reimbursement-for-businesses
Published: 2026-06-10 · Updated: 2026-07-08 · By William Sunjo M.

# Are businesses covered by APP fraud reimbursement in the UK?

UK APP fraud reimbursement covers consumers, microenterprises and small charities up to £85,000. Who qualifies, what is excluded and what larger firms can do.

## Key takeaways

- Mandatory APP fraud reimbursement applies to Faster Payments and CHAPS payments made in the UK from 7 October 2024.
- It covers consumers, microenterprises and charities with annual income under £1 million, up to £85,000 per claim.
- A microenterprise has fewer than 10 staff and annual turnover or balance sheet of €2 million or less.
- International payments, card payments and payments to accounts you control are not covered.
- Larger companies rely on their own controls and their bank's discretion, so payment checks matter more.

If a fraudster tricks your business into paying them, will the bank refund you? In the UK, it depends on what kind of business you are. Mandatory reimbursement for authorised push payment (APP) scams started on 7 October 2024, and it was written mainly for consumers. Small businesses are partly in. Most growing companies are out.

## Who is covered by APP fraud reimbursement?

The rules cover payments made by:

| Covered | Definition |
|---|---|
| Consumers | Individuals acting for personal purposes |
| Microenterprises | Fewer than 10 employees, and annual turnover or balance sheet total of €2 million or less |
| Charities | Annual income under £1 million |

If your company has 10 or more staff, or is above the €2 million line, the mandatory scheme does not apply to you, whatever the size of the loss.

## Which payments does it cover?

The scheme covers Faster Payments and CHAPS payments sent within the UK, from a UK payment account to another UK account controlled by the fraudster. The maximum reimbursement is £85,000 per claim. The sending firm can deduct an excess of up to £100.

It does not cover:

1. International payments, including SWIFT wires and SEPA transfers.
2. Card payments, which have their own chargeback and dispute rules.
3. Payments to an account you control, even if you were then scammed from there.
4. Civil disputes, such as a real supplier who delivered poor goods.

For a business that pays overseas suppliers, the first exclusion matters most. A fake invoice from a "supplier in Shenzhen" paid by international wire has no mandatory route back.

## How does a claim work?

1. Report the scam to your payment provider as soon as you notice, within 13 months of the last payment.
2. The provider assesses the claim and should reimburse within 5 business days.
3. It can stop the clock to ask for information, but must reach a decision within 35 business days.
4. The cost is split between the sending firm and the receiving firm.

A firm can refuse where it shows gross negligence or that the claimant took part in the fraud. Ignoring a clear, specific warning from the bank at the time of payment can count against you.

## What can a larger company do?

Without the mandatory scheme, prevention is the protection. The scams we see most against businesses are payment detail changes on supplier invoices, fake CEO requests to finance, and people posing as the bank's fraud team.

Controls that stop most of them:

1. Confirm any new or changed bank details by phone, on a number you already had, never one in the email.
2. Read the Confirmation of Payee result and stop on a no match or close match. See [what each Confirmation of Payee result means](/blog/confirmation-of-payee-no-match).
3. Require a second person to approve new payees and large payments.
4. Send a small test payment to a new supplier and have them confirm it.

Our guide to [invoice fraud and payment detail scams](/blog/invoice-fraud-payment-detail-scams) has examples and a checklist you can give your team.

## Does insurance cover APP fraud?

Some commercial crime or cyber policies cover social engineering fraud, often with a separate, lower limit. Read the wording: many require that you followed a call-back procedure before paying. If you do not, the claim may fail.

## How Rivet handles payee checks

Rivet is a business account for registered companies. From the Growth plan, a Rivet workspace has team roles and approvals, so a payment can need a second person before money moves, and the [payouts screen](/payouts) shows the recipient's name and details as entered before you confirm. That step catches more fraud than any refund scheme repays.

## Questions

### What is an APP scam?

An authorised push payment scam is when someone tricks you into sending money yourself, for example by pretending to be a supplier with new bank details or posing as your bank. You authorise the payment, which is why it used to be hard to recover.

### How long do I have to make an APP fraud claim?

Up to 13 months after the last payment in the scam. The payment firm normally has to decide within 5 business days, which can be extended to 35 business days if it needs more information.

### Can my bank refuse to reimburse a microenterprise?

It can if it shows gross negligence, if you were part of the fraud, or if the claim is outside the rules, such as an international payment. It can also deduct an excess of up to £100.

### Are larger UK companies protected at all?

Not by the mandatory scheme. Some banks reimburse voluntarily, and some fraud may be covered by commercial crime insurance. The practical protection is checking payment details before you pay.