For years, the answer to that question depended almost entirely on which bank you happened to use. If you transferred money to a scammer under the spell of a fake “fraud officer” or a panicked phone call from someone pretending to be your son, you were at the mercy of a voluntary code that some banks signed up to and others didn’t. That landscape changed on 7 October 2024, when the Payment Systems Regulator (PSR) replaced the old Contingent Reimbursement Model (CRM) Code with a mandatory reimbursement scheme. The protections are stronger, the deadlines are tighter, and almost every payment provider in the UK is now bound by them.
Here is what victims of phone-enabled bank transfer scams need to know in 2026.
A quick history: from CRM to mandatory reimbursement
The CRM Code was launched in May 2019 by a group of major UK banks as a voluntary commitment. The idea was that customers who lost money to authorised push payment (APP) fraud (that is, scams where the customer is tricked into transferring money themselves) could expect to be reimbursed, provided they had taken reasonable care. The Lending Standards Board oversaw the code.
It was an important step, but it had two big weaknesses. First, it was voluntary, so a customer’s protection depended on whether their bank had signed up. Second, banks interpreted the “reasonable care” standard in wildly different ways, and reimbursement rates varied dramatically between firms.
The PSR’s new mandatory regime, which took effect on 7 October 2024, fixed both problems in one stroke. It applies to all payment service providers (PSPs) sending or receiving payments over Faster Payments and CHAPS, which means essentially every bank, building society and e-money firm in the country. Reimbursement is no longer optional, and the rules are written by the regulator rather than the industry.
What the new rules say
Under the mandatory scheme, victims of APP fraud can be reimbursed up to £85,000 per claim. The cost is split 50:50 between the bank that sent the money and the bank that received it, a deliberate design choice to give receiving banks a financial incentive to weed out mule accounts.
Sending banks may charge an excess of up to £100 per claim, but this excess does not apply to customers who are considered vulnerable. The protection covers individuals, micro-enterprises and charities, and the framework was rolled out at the same time across both Faster Payments and CHAPS.
Crucially, the regulator has set a hard deadline for processing. Once a victim reports a scam, their PSP must reimburse them within five business days, or within 35 business days if the case needs further investigation. The old practice of leaving customers in limbo for months while a bank “looked into it” is no longer permitted.
When the bank can refuse
The new rules are generous, but they are not unconditional. Banks can still refuse to reimburse customers who acted with what the regulator calls “gross negligence”: broadly, where someone has ignored repeated, specific warnings or sent money in defiance of obvious red flags. This is referred to as a failure to meet the Consumer Standard of Caution.
In practice, this is a high bar. Falling for a convincing impersonation scam, even one that in hindsight used clumsy tactics, is not gross negligence. Sending money after your bank has explicitly warned you the destination account is fraudulent, and after a fraud officer has told you on the phone that this is a scam, might be.
The gross negligence carve-out does not apply to vulnerable customers at all. The PSR’s definition of vulnerability is broad and includes circumstances such as poor health, recent bereavement, cognitive impairment, low financial resilience and digital exclusion: categories that capture many of the older adults targeted by phone scammers.
How to claim: a step-by-step guide
If you have transferred money to a scammer over the phone, the rules now give you a clear route to reimbursement. But the process is time-sensitive, and the strength of your claim depends largely on what you do in the first hour.
Contact your bank immediately. Use the number on the back of your card or the in-app help function, not any number the caller gave you. Tell them what happened in plain terms: someone phoned you, claimed to be from X, persuaded you to send Y, and you now believe it was a scam. The bank may be able to recall the payment if it has not yet been processed at the receiving end.
Report it to Action Fraud. Call 0300 123 2040 or report online at actionfraud.police.uk. You will be given a crime reference number. Some banks will report on your behalf if you give consent, but it is worth confirming this has happened.
Cooperate fully with your bank. Respond promptly to requests for information, provide any messages or transaction details, and consent to your details being shared with the police if asked. Refusing reasonable requests can weaken your claim.
Keep evidence. Note down the phone number that called you, the time, what was said, any names mentioned, and any web addresses you were sent to. Screenshots of bank app warnings or text messages can all matter. If you don’t recognise the number that called you, looking it up on a scam-call directory can confirm whether other people have reported the same caller.
Mind the deadline. You must report the fraud within 13 months of the last fraudulent payment to be covered by the mandatory regime. Older losses fall outside the rules.
If your bank turns you down
A refusal is no longer the end of the road. If your bank declines to reimburse you, ask for the decision in writing along with the specific reasons. You then have a clear right to escalate the complaint to the Financial Ombudsman Service, which adjudicates disputes between consumers and financial firms for free.
The Ombudsman has historically taken a robust view of bank responsibilities in APP fraud cases, and its caseload has shown a high rate of decisions in favour of consumers where the bank’s reasoning leans on a strict reading of “negligence.” If you are an older person, were under pressure during the call, or have any vulnerability that affected your judgement, make sure the Ombudsman knows.
You do not need a lawyer to complain to the Ombudsman, and you do not need to pay anyone to do it for you. A number of claims-management firms now advertise services to help recover money from APP fraud, often taking a percentage of any refund, but the process is designed to be navigable by victims directly.
A stronger floor, not a guarantee
The shift from the CRM Code to mandatory reimbursement has done two things that matter for anyone scammed over the phone in 2026. It has put a floor under the worst inconsistencies between banks, and it has flipped the default: where once victims had to argue their way to a refund, the starting position is now that you should be reimbursed unless the bank can show you fell short of a clear, regulator-set standard.
It is not a guarantee, and it does not replace the importance of pausing before transferring money to anyone you have not met. But for the hundreds of thousands of people each year who do fall victim, disproportionately older people, disproportionately targeted by impersonation and “safe account” scams, the rules in place today are, for the first time in a long time, weighted in their favour.
If you have been scammed over the phone recently, do not assume the answer is no. Pick up the phone to your bank, then to Action Fraud, and find out what the new system has to say.