Reimbursement didn’t reduce APP fraud. It just changed who pays for it

By Jonathan Frost, BioCatch global advisory director for EMEA

UK Finance’s 2026 annual fraud report found that while the amount of fraud prevented has increased, so have losses from both authorised and unauthorised fraud.

Some will use high reimbursement rates as evidence that consumers are well-protected, with UK fraud victims much more likely to be reimbursed than in other European markets. However, the detriment caused by fraud extends far beyond financial losses, and reimbursement doesn’t address its impact on individuals and society.

Fraud has a human face. It is a retired teacher manipulated into transferring their savings by someone impersonating their bank. It is a university student, excited about a job offer, who is unknowingly recruited as a conduit for criminal funds. The financial loss is measurable. The psychological damage, shame, self-doubt and erosion of trust is not. For the mule, consequences can be more severe, such as a criminal record or a Cifas marker that prevents them from getting a bank account.

This matters because the Payment Systems Regulator (PSR) split liability equally between sending and receiving institutions, a deliberate signal that both have a role in prevention. The industry was expected to tackle financial crime, and it would pay if it failed to do so.

Yet the desired outcome has not materialised. Criminals are still making significant gains from fraud, and whilst individuals no longer bear the financial loss, the cost has shifted to financial institutions. Reimbursement is symptomatic of a structural failure dressed in the language of consumer protection.

For banks, the consequences extend beyond reimbursement. Victims can disengage from digital banking, increasing the cost of servicing them. Others switch banks, whilst those who have laundered money find their relationship with the sector irreparably complicated, reducing their educational opportunities or leaving them unable to receive their wages. The financial and reputational costs are distributed across customer lifetime value, operational overheads, and regulatory exposure.

The path forward requires action at both ends of the payment journey, with real-time insights from the sending and receiving financial institutions. When ANZ, CBA, NAB, Suncorp and Westpac joined BioCatch Trust Australia in late 2024, they created the world’s first real-time, behaviour-based, inter-bank intelligence-sharing network, capable of assessing the risk of a receiving account before a payment is processed.

The results have been material. ANZ has reported measurable uplift in detecting complex scam typologies while simultaneously reducing false positives for legitimate customers. Detection and customer experience are not in tension. They never were.

National Australia Bank’s (NAB) real-time payment alerts prompted customers to abandon nearly AUD $50 million in suspicious payments in just two months, not by blocking transactions, but by intervening at the moment of decision, preventing losses and reinforcing the customer relationship. That is friction that protects customers without frustrating them. Fraud only pays if the proceeds can be moved. Countering money laundering, at scale, is as important as countering the scam itself. NAB recently used behavioural biometrics to identify and offboard customers who pose an excessive risk, removing approximately 10,000 high-risk profiles. The alternative is costly. The bank estimated the baseline cost of maintaining a single mule profile at approximately AUD $1,200, before accounting for investigation costs, regulatory obligations or exposure to scam reimbursement.

The UK does not yet have a cohesive, equivalent approach to collaboration. Collective action has empowered banks in Australia to act decisively to counter financial crime without adding unnecessary controls or friction. The best outcome for any fraud victim is to not become a victim at all. In the absence of significant reductions in criminal gains, the current regulatory approach cannot be considered a success.

Banks are being asked to serve as the last line of defence against threats that originate elsewhere. The infrastructure of fraud, including fake advertisements, impersonation campaigns, and the recruitment of mules through social media, is built and operated on platforms that bear no liability for the outcomes.

By the time a suspicious payment is attempted, banks have no visibility into the criminal’s interaction with the victim, whether it originated via text, phone call, social media, or a fraudulent website. The point of intervention arrives late, and the obligation to remediate falls entirely on the institution that processes the payment.

That is not a sustainable model. Platform operators, social media companies, digital advertising networks, and telecommunications providers must be brought into the accountability framework. The Fraud Strategy 2026–2029 and the Online Safety Act create the statutory architecture. What is required now is enforcement with teeth.

Rising fraud losses are not an argument for more reimbursement. They are an argument for better prevention, in sending and receiving banks, and across the wider ecosystem that fraud relies on to function. The goal was never to pay people back. It was to stop them from being harmed in the first place.