Why the APP fraud “success story” makes me more cautious, not less
I read the PSR’s press line on the reimbursement review before I read the underlying report, and the gap between the two told me most of what I needed to know. The headline is £73 million in prevented losses and a policy that’s “working.” The report itself is more interesting, and if you run a business that touches UK payment rails, it’s the report you should read.
A 21-to-94% spread is not a working system, it’s a discretionary one. Frontier Economics found reimbursement rates ranging from 21% to 94% across payment service providers, and traced a meaningful chunk of that gap to how firms apply the Consumer Standard of Caution — the get-out clause that lets a PSP decide a customer didn’t take enough care and withhold reimbursement accordingly. One firm invoked it in over a quarter of cases by value. Others never invoked it at all. That’s not two firms interpreting a clear rule slightly differently. That’s two firms operating under effectively different regimes, both technically compliant. I’ve spent enough time in forensic work to know that when the same rule produces a fourfold spread in outcomes, the rule isn’t doing the work — internal risk appetite is.
The part nobody’s framing as the real story: fraud didn’t fall, it moved. Out-of-scope international APP scams rose from £21 million in 2023 to £60 million in 2025. Scams routed to crypto exchanges rose from roughly £59 million to £153 million over the same window. The regulator’s in-scope numbers look good precisely because the scope is narrow. If you tighten the perimeter around Faster Payments and leave international transfers and crypto off-ramps loosely covered, you should expect exactly what happened: displacement, not deterrence. That’s not a flaw in execution. That’s the predictable shape of a rule that regulates a rail rather than a behaviour.
Why this matters for how I’d choose a business bank account today. Receiving firms now share liability alongside sending firms, which means the PSP holding your account carries real exposure if funds pass through it as part of someone else’s fraud chain — and how that PSP behaves under pressure is now, provably, a matter of internal policy rather than statutory certainty. I’d want to know a provider’s actual reimbursement rate and how often it leans on the caution exception before I’d want to know its headline fees. Nobody publishes that number voluntarily. Maybe they should have to.
The PSR calls this evidence the policy is working. I’d call it evidence the policy is working exactly as far as its boundaries reach, and not one inch further. For an operator, that distinction is the whole ballgame.
