You check your bank statement and discover transactions you never made—money has been taken from your account without your permission. Whether it’s a hacked account, a stolen card, or fraudulent payments, unauthorised transactions can be devastating.
The good news is that UK law provides strong protection for victims of bank fraud. This guide explains your rights and how to get your money back.
Your Legal Rights: Payment Services Regulations 2017
Under the Payment Services Regulations 2017, banks are legally required to refund unauthorised transactions unless they can prove you acted fraudulently or were “grossly negligent.”
Key points:
- Banks must refund promptly – No later than the end of the next business day after you report it
- You’re not liable for more than £35 – For unauthorised transactions before you report the loss/theft (unless you were negligent)
- No liability if you couldn’t have known – If your card was cloned or details stolen without your knowledge
Unauthorised vs Authorised Transactions
Understanding the difference is crucial:
Unauthorised Transactions (Strong Protection)
Someone else made the payment without your knowledge or consent:
- Account hacking
- Stolen card used without your knowledge
- Card cloning
- Identity theft
Authorised Push Payment (APP) Fraud (Different Rules)
You made the payment yourself, but were tricked by scammers:
- Romance scams
- Investment scams
- Impersonation scams (fake bank calls)
- Invoice redirect fraud
From October 2024, banks must also reimburse victims of APP fraud up to £85,000 under new mandatory reimbursement rules, unless you ignored explicit warnings or acted with gross negligence.
UK Case Examples
Revolut Customers Win FOS Complaints
According to TLW Solicitors, three Revolut customers successfully claimed compensation through the Financial Ombudsman Service:
- In one case, a customer was tricked by someone impersonating her bank. Revolut initially refused to refund, but the FOS ordered full reimbursement plus 8% interest
- Another customer received their full £4,000 refund plus £300 compensation for distress and inconvenience
Step 1: Report to Your Bank Immediately
Speed is critical:
- Contact your bank as soon as you notice – Use their fraud hotline (usually 24/7)
- Request a freeze on your account – To prevent further fraud
- Get a reference number – For your records
- Follow up in writing – Email or letter confirming what you reported
Under the regulations, banks must refund by the end of the next business day unless they have grounds to investigate further.
Step 2: If Your Bank Refuses
Banks can only refuse if they believe you:
- Acted fraudulently – You made or authorised the transaction yourself
- Were grossly negligent – A very high bar (more than just careless)
If your bank refuses:
- Request a written explanation – They must explain their reasons
- Submit a formal complaint – The bank has 8 weeks to respond with a final answer
- Escalate to the Financial Ombudsman Service – If unsatisfied
Step 3: Financial Ombudsman Service (FOS)
The Financial Ombudsman Service is free and can overrule your bank:
- You have 6 months from the bank’s final response to escalate
- FOS can award up to £430,000 (for cases from April 2024 onwards)
- They can add compensation for distress and inconvenience
- Decisions are binding on the bank if you accept them
FOS investigations can take 3-9 months for complex fraud cases.
What Compensation Can You Get?
- Full refund of stolen money – The primary remedy
- Interest – Typically 8% per year on money wrongly withheld
- Compensation for distress and inconvenience – Often £100-£500, but can be higher in serious cases
- Consequential losses – If the fraud caused you additional costs (late fees, charges, etc.)
What Is “Gross Negligence”?
Banks often claim customers were grossly negligent to avoid refunds. However, the threshold is high:
NOT gross negligence:
- Clicking a convincing phishing link
- Being tricked by sophisticated scammers
- Responding to what appeared to be your bank
- Having a weak password (in most cases)
May be gross negligence:
- Giving your PIN to a stranger
- Ignoring multiple explicit warnings
- Writing your PIN on your card
- Sharing one-time passcodes after clear fraud warnings
The FOS generally takes a consumer-friendly approach and requires banks to prove gross negligence, not just ordinary carelessness.
Steps to Take Now
- Report to your bank immediately – Time matters
- Report to Action Fraud – The UK’s national fraud reporting centre (0300 123 2040)
- Change all passwords – For online banking and email
- Check credit report – For signs of identity theft
- Document everything – Screenshots, correspondence, timeline of events
- Keep records of impact – Stress, time spent, any costs incurred
Frequently Asked Questions
How long does the bank have to refund me?
For unauthorised transactions, banks must refund by the end of the next business day after you report it—unless they have reasonable grounds to suspect fraud or gross negligence. Investigations should conclude within 15 working days, or 35 days for complex cases.
What if I gave my details to a scammer?
If you were tricked into making the payment yourself (APP fraud), different rules apply. From October 2024, mandatory reimbursement rules require banks to refund APP fraud victims up to £85,000 in most cases. Before then, it depends on whether your bank signed up to the voluntary CRM Code.
Can I claim from the receiving bank too?
Yes. The receiving bank (where the scammer’s account was held) may share liability. The FOS can investigate both banks’ conduct.
What if my bank says I authorised the transaction?
They must prove it. Banks have access to IP logs, device information, and authentication records. If the transaction shows unusual patterns (different location, new device, odd timing), this supports your case.
Is there a time limit to claim?
Report to your bank as soon as possible—ideally immediately. For FOS complaints, you have 6 years from the fraud (or 3 years from when you became aware) to bring a complaint, but acting quickly is always advisable.
