Under 'What is the complaint about?' the guidance lists 'APP fraud and other scams involving authorised payments or withdrawals' separately from 'Unauthorised transactions and identity theft'. It explains that these cases include situations where "the customer has been tricked into authorising a payment" (authorised push payment fraud) and that the ombudsman looks at how the scam happened and what information or warnings the firm gave the customer. The emphasis is on whether the customer was misled or deceived into authorising the transaction, not merely the mechanical fact of pressing a button to confirm it.

In its page on disputed transactions, the FOS distinguishes between disputes where "a consumer says they didn’t authorise a transaction" and circumstances where "they did authorise it, but were tricked into doing so". It states that in authorised push payment fraud, "the customer has given their bank an instruction to make the payment" but may have done so because "they’ve been misled or deceived" and that it assesses whether the bank did enough to protect the customer in those circumstances. The guidance focuses on the context and deception around the authorisation rather than the mere act of clicking 'confirm'.

This is an extract from a Financial Ombudsman Service decision about an investment scam: "It is common ground that Mr O authorised each of the payments totalling £6,200. He believed at the time he was making genuine investments. I accept that these were all ‘authorised’ payments insofar as Mr O intended to send the monies to the scammer (because, at that time, he was unaware he was being scammed). Accordingly, under the account contract and Payment Services Regulations, HSBC had a duty to execute his instructions without undue delay — unless its ‘due diligence’ warning systems were triggered such as to give a reasonable banker grounds for suspecting fraud or financial crime by or against the customer." This shows FOS recognising that a customer can be *authorising* a payment while being deceived about its purpose or the recipient.

We see a complaint as falling into this category where a customer says they were tricked into authorising a payment – for example, because they were deceived into believing that the payee was genuine, or that the payment was for a legitimate purpose, when this wasn’t the case. In these cases, the customer has authorised the payment themselves – but only because they were misled or manipulated by a fraudster. When we’re deciding what’s fair and reasonable, we’ll look closely at the circumstances of the customer’s authorisation, including any deception used by the fraudster, and at how the firm responded to the risk of APP fraud more generally.

Authorised push payment (APP) is where a payer, often an individual consumer, instructs their payment service provider (PSP) to send money from their account to another account. APP fraud is where a fraudster tricks a payer into making an APP to an account controlled by that fraudster. A key harm in APP fraud is that the victim has, in fact, authorised the payment, albeit under false pretences and as a result of deception. Our proposals address the harm posed by APP fraud by allowing eligible complainants to refer complaints to the Financial Ombudsman Service if they believe the PSP who received the payment as a result of this fraud did not do enough to prevent it or respond to it.

The FOS home page explains that it "makes decisions on the basis of what is fair and reasonable" in individual cases, taking into account "regulator’s rules, guidance and standards" as well as "good industry practice at the relevant time". This framework means that in complaints about authorised push payments, the ombudsman does not rely solely on whether the consumer technically authorised the transaction, but considers surrounding factors such as whether they were misled or tricked.

The "Banking and payments" consumer guidance notes that the service deals with complaints about "disputed transactions" and "fraud and scams", including situations where customers have "been tricked" into making payments. It says the ombudsman will ask consumers to explain what happened and will consider whether the bank acted fairly, including looking at warnings and checks, rather than simply whether the customer pressed a confirmation button.

Authorised push payment (APP) scams happen when consumers are tricked into sending money to a fraudster. The customer gives the bank a payment instruction, so the transaction is classed as ‘authorised’ under the Payment Services Regulations. Nevertheless, the FCA expects firms and the Financial Ombudsman Service to take into account that customers were deceived and to consider whether firms met their duties to detect, prevent and respond to APP fraud. Pressing a ‘confirm’ button or otherwise authorising the payment does not automatically remove protections for consumers where they have been manipulated into making the payment.

Authorized Push Payment (APP) fraud happens when a fraudster convinces a payer to authorize a payment under false pretenses. These scams are based on deception rather than unauthorised account access: the customer technically presses the ‘send’ or ‘confirm’ button, but only because they have been tricked. In June 2023, the Payment Systems Regulator (PSR) introduced a mandatory reimbursement requirement for victims of APP scams, recognising that consent given under deception should not automatically exclude consumers from protection.

An article discussing authorised push payment scams explains that in many FOS decisions, "the key question is whether the customer has genuinely been tricked into making the payment" and whether the bank followed the relevant code and warnings, even though the payment was technically authorised. It notes that the FOS can order reimbursement where it finds that the customer "was the victim of deception" and that the bank did not respond appropriately, emphasising the circumstances of the authorisation rather than the mechanical act of confirming the transfer.

The courts have emphasised that in cases of authorised push payment fraud, the key issue is whether the customer was induced by fraud to make the payment, not simply that the customer gave the payment instruction. In Philipp v Barclays Bank UK PLC, the High Court noted that the customer was the victim of an ‘APP fraud’—she was deceived into authorising the payments. Although the payments were technically authorised, the case raised questions about the duties owed by banks when customers are being tricked. This legal reasoning underpins the approach later adopted by regulators and the Financial Ombudsman Service, where the presence of deception is central to assessing liability and redress.

From 7 October 2024, the Reimbursement Rules will require all PSPs, save for credit unions, municipal banks and national savings banks, sending payments over Faster Payments to fully reimburse all their consumers, including microenterprises and charities, that are victims of APP fraud. For “multi-step fraud” cases, which may involve a number of different payments to different accounts, the payment that is covered will be the Faster Payment made to an account controlled by a person other than the customer, where the customer has been deceived into granting authorisation for the payment. The scheme focuses on whether the customer was deceived into authorising the transfer, not on the mechanical act of pressing a confirmation button.

Authorized Push Payment (APP) fraud is a label for a range of scams whereby a bank customer is tricked into transferring money from their account, thinking that they are engaged in a legitimate transaction. Under the UK’s mandatory reimbursement scheme for APP fraud victims, a qualifying case is defined as an authorised payment from an account controlled by a customer to an account controlled by someone else, authorised by the customer as part of an APP fraud and executed over Faster Payments. The regulatory focus is on the presence of fraud and deception in the customer’s authorisation, rather than on the mere fact that the customer initiated and confirmed the payment.

Wikipedia’s overview of the Financial Ombudsman Service explains that the ombudsman "makes decisions on the basis of what it believes is fair and reasonable in the particular circumstances of each case" and must take into account "regulator's rules, guidance and standards; codes of practice; and (where appropriate) what he/she considers to have been good industry practice at the relevant time." This supports the idea that in cases of authorised payments, the ombudsman considers the context, including any deception, rather than treating the act of authorisation as decisive.

Victims of authorised push payment fraud are, by definition, people who have been deceived into authorising a payment. Following changes to the FCA’s Handbook, victims now have the right to complain to the Financial Ombudsman about the payment service provider (PSP) who received their payment on behalf of the fraudster if they believe that the PSP did not do everything possible to get the money back. The FCA notes that ‘in practice, many complaints relating to APP fraud will be about the receiving PSP’s actions, especially the allegation that the receiving PSP has not done enough to prevent fraud.’ The focus is thus on the deceptive nature of the transaction and the conduct of the firms, even though the payment was technically authorised.

A Grant Thornton UK analysis of FOS trends explains that fraud and scams are a key driver of banking complaints and notes that many cases involve deception: "Banking fraud complaints were broad in scope, covering everything from authorised push payments (APP) and ID theft to customers being unfairly placed on fraud prevention lists." It lists typical scenarios: "situations where customers have been tricked into sharing personal information (such as passwords or PIN numbers)..." and "incidents where customers say their debit card, credit card or bank details have been used without their knowledge or permission." The article comments that FOS has had to consider how far firms should reimburse people who were **tricked into authorising payments**, highlighting deception as central to dispute outcomes.

In social media outreach, FOS highlights deception-based scams: a LinkedIn post refers to its information for businesses on fraud and scams and says: "Our information for businesses covers what we see in complaints involving fraud and scams, our approach, and the information we need from firms to investigate." While the post itself is brief, it points to underlying guidance where FOS’s approach differentiates between customers who were **tricked into authorising payments** and straightforward, fully-informed authorisations.

APP scams happen when someone is tricked into sending money to a fraudster posing as a genuine payee. The victim has technically authorised the payment, but only because they were deceived. If you have fallen victim to a scam, you should first contact your bank… If you are unhappy with their response, you can take the matter further by referring it to the Financial Ombudsman Service. The PSR’s work on APP scams is based on the principle that authorisation obtained through deception should not prevent victims from seeking redress.

A risk management industry article on push payment scams notes that the Financial Ombudsman Service has seen a rise in complaints about "push payment scams, where customers are tricked into authorising payments to fraudsters". It describes that the FOS looks at whether banks have followed the Contingent Reimbursement Model Code and given adequate warnings, which can lead to reimbursement even though the payments were authorised, highlighting deception and bank behaviour as central factors.

This guide explains APP fraud claims, chargebacks, and how to escalate to the Financial Ombudsman. Key fact: Banks are now required to refund APP fraud victims (Authorised Push Payment scams) unless you were negligent. APP fraud occurs when criminals trick you into authorising a transfer to their account by impersonating a trusted person or organisation. Unlike card fraud, the money leaves your account with your consent – but obtained by deception. If you can prove you were deceived (fake email domain, forged invoice, impersonation), the bank should refund under APP fraud rules.

A discussion post in a Facebook group criticising FOS refers to a case involving fraudulent transactions: users complain that "The financial ombudsman are a complete disgrace" and describe a situation where they say they were tricked into authorising payments yet were not reimbursed. The post alleges that FOS sided with a bank because the complainant "pressed confirm" on the payment, while the complainant argues they were deceived. Although anecdotal and contested, this illustrates that some consumers perceive FOS as placing more weight on the act of confirmation than on deception, contrasting with the official guidance that emphasises deception and circumstances.

The Payment Services Regulations 2017 distinguish between ‘authorised’ and ‘unauthorised’ payment transactions on the basis of whether the payer gave consent. However, in the context of authorised push payment scams, regulators and the Financial Ombudsman Service have recognised that consumers may give consent only because they were deceived. Consequently, guidance on APP fraud emphasises that the presence of consent (for example, clicking ‘confirm’) does not end the inquiry; instead, authorities consider whether the consumer was tricked and whether the firm complied with its obligations to protect the consumer.

A consumer discussion about the Financial Ombudsman notes that when people complain about debt communications, the FOS "typically requires substantial evidence" of unfair treatment and misleading information, not just proof that the customer agreed to or confirmed something. The commentary highlights that the ombudsman often asks for details of how the customer may have been misled or pressured, suggesting that deception is a significant factor in its assessment of fairness.

The Consumer Financial Protection Bureau (CFPB) in the US, while not the UK FOS, provides comparable guidance: "If you suspect a scam, there are a few important steps you should take right away" and advises contacting law enforcement and reporting scams. It distinguishes between situations where a consumer has authorised a payment and those where money is taken without permission. This international regulator’s guidance mirrors the UK FOS’s distinction between **authorised payments made under deception** versus unauthorised transactions, showing a broader regulatory focus on deception rather than just button-pressing as the key factor in protection debates.

The Financial Ombudsman Service (FOS) has published updated versions of its guidance on handling complaints concerning fraud, scams, authorised push payment (APP) fraud and other authorised payments. The updated guidance emphasises that firms should consider whether customers were misled or manipulated into authorising payments, and the steps the firm took to protect customers from APP fraud, when assessing complaints. This reflects a focus on deception and fair treatment, rather than a narrow view of authorisation based solely on the customer pressing a confirmation button.

General explanatory material on the Financial Ombudsman Service describes it as an organisation set up by Parliament to resolve disputes where consumers believe they have been treated unfairly by financial businesses. It emphasises that consumers can bring complaints even where they have technically authorised transactions, if they feel they were misled or not adequately warned, and that the ombudsman considers the fairness of how the transaction was authorised.