Authorized push payment fraud: UK reimbursement vs US Reg E

Authorized push payment (APP) fraud is a scam in which the customer is deceived into sending a payment from their own account to an account the fraudster controls: they log in, pass every check and press send themselves. The UK and the US treat the loss very differently. Since October 2024 UK payment firms must reimburse in-scope victims up to £85,000, the sending and receiving firms share the cost, and the sending bank may delay a suspicious payment for up to four business days to talk to the customer. In the US there is no federal reimbursement mandate for a payment the customer made: Regulation E protects consumers against transfers made by someone else, including a fraudster using credentials tricked out of them, but the Congressional Research Service notes that for a transfer the consumer authorised under fraudulent inducement, liability generally rests with the consumer. That puts the weight on detection. Botminds' APP Fraud Detection is built for the moment both systems depend on: its agents name the scam behind a held payment, write the questions for it and flag coaching on the call, so a colleague can stop the payment before it leaves.

What is authorized push payment fraud, in either country's words?

Authorized push payment fraud is a payment made by the account holder because someone deceived them; the spelling changes across the Atlantic, the mechanism does not. The UK's Payment Systems Regulator describes APP scams as happening "when someone is tricked into sending money to a fraudster posing as a genuine payee". The Federal Reserve's FraudClassifier, a US industry model, files the same cases under "Authorized Party Was Manipulated", and its companion ScamClassifier defines an authorised payment as one that the genuine account owner or user entered or asked for.

The distinction from ordinary fraud is the whole story in law. When a criminal steals a password and sends the money, the payment is unauthorised and both countries protect the customer. When the customer sends the money themselves, the payment is authorised; the UK decided in 2023 and 2024 to protect that customer anyway, and the US has not.

How the UK answered: reimbursement, a delay power and a name check

The UK built three layers. The first is reimbursement: in force since 7 October 2024, it covers individuals, microenterprises and charities paying between UK accounts over Faster Payments or CHAPS, up to £85,000 a claim, with the cost split so that the sending and receiving firms each pay half, by the regulator's design. The second is time: since 30 October 2024 a sending bank with reasonable grounds may delay a payment to the end of the fourth business day to contact the payer or others and make enquiries. The third is the payee name check, confirmation of payee, which most UK providers must offer.

The courts had left the question to Parliament. In Philipp v Barclays the Supreme Court held that a bank instructed by its customer "must execute the instruction and do so promptly" and that "it is not for the bank to concern itself with the wisdom or risks of its customer’s payment decisions"; reimbursement, it said, was a matter for regulators, government and Parliament, and it noted the new scheme would not reach the international payments in that case. The UK's answer is therefore statutory, not a duty of care found by judges. How the delay power works day by day is in UK bank payment delay rules.

Is authorized push payment fraud covered in the US?

Not by any federal reimbursement rule, when the customer made the payment themselves. Regulation E counts an electronic fund transfer as unauthorized only when someone other than the consumer starts it without actual authority and the consumer gets nothing from it (the guide to Zelle and Regulation E quotes the definition). A payment the consumer initiates is not that, however it was induced. The Congressional Research Service put the consequence plainly in November 2024: "For a transaction authorized by a consumer but induced by a third party under fraudulent circumstances, the liability would generally rest with the consumer and not the financial institution."

The losses are large. The Federal Trade Commission reported that in 2024 consumers lost more money to scams paid by bank transfer or cryptocurrency than by every other payment method put together, and that consumers reported "$15.9 billion in losses" to fraud in 2025. Those are self-reported figures, not a complete count, but they describe the same scams the UK now reimburses.

Does Reg E cover scams? The line between a tricked password and a tricked payment

Regulation E covers a scam only where the fraudster, not the customer, makes the transfer. The Consumer Financial Protection Bureau's EFT FAQs, first published in 2021 and still posted in 2026, draw the line. If a fraudster tricks a customer into sharing login details and then uses them to move money, the transfer is unauthorized. The bank cannot treat the shared credentials as the customer's authority either: in the bureau's answer, a consumer tricked into giving up account information has not furnished an access device. The guide to Regulation E and account takeover quotes the FAQ in full.

The FAQs say nothing that brings the second case, the customer who is talked into sending the payment themselves, inside the definition. That is the US gap, and it can turn on who pressed send: a bank-impersonation call that ends with the caller using a one-time code is likely an unauthorized transfer, while the same call that ends with the customer moving the money to a "safe account" is likely not. For a fraud team the practical difference is the evidence. A bank that holds the payment and asks the right questions finds out which it is facing before it matters.

The evidence that a customer was being directed: her own words, an hour before the payment

What happened to the CFPB Zelle lawsuit?

The CFPB dropped it. On 20 December 2024 the Bureau sued the operator of Zelle and three large banks, saying in its press release that it acted "for failing to protect consumers from widespread fraud on America’s most widely available peer-to-peer payment network". On 4 March 2025 the docket records the Bureau's notice of voluntary dismissal. The allegations were never tested in court and are not findings.

The episode matters for what it did not do. A lawsuit could not have created a reimbursement rule for authorised scams; at most it could have tested how existing law applied to a network. With it gone, the US position on a customer-initiated scam payment is what Regulation E and the CRS describe, and any change would have to come from Congress or a rulemaking.

Does Nacha cover authorized push payments? False pretenses: monitoring, not liability

Nacha's rules now require banks on both sides of an ACH payment to look for credits sent under false pretenses, but they do not make anyone reimburse the sender. The rules define false pretenses as a payment induced by someone lying about who they are, about whom they act for, or about who owns the account to be credited. That covers business email compromise and impersonation; Nacha adds that it does not reach scams over fake, missing or shoddy goods and services (the guide to Nacha false pretenses takes the definition part by part).

The monitoring duty is new and phased. The rules on monitoring for fraud became effective in March 2026 for the largest participants and on "June 19, 2026" for everyone else, with June 22 the practical date because of the holiday. Since October 2024 a receiving bank has been allowed, but not required, to return a suspicious entry with code R17, and has been exempt from Nacha's funds-availability timing for credits it suspects were sent under false pretenses. Those are tools for stopping a scam payment, which is the closest the US rulebook comes to the UK's delay power, and they say nothing about who bears the loss.

Is Congress considering scam reimbursement?

Bills have been introduced; none has become law. In August 2024 the Protecting Consumers From Payment Scams Act, H.R. 9303 in the House and S. 4943 in the Senate, proposed to amend the Electronic Fund Transfer Act so that a "fraudulently induced" transfer would be treated like an unauthorized one, and that the loss "shall be evenly shared between the financial institution holding the consumer's account and the financial institution that received the transfer", the UK's 50:50 split in American form. Both were referred to committee in the 118th Congress, which ended without further action.

The bill moving in the current Congress is narrower. The TRAPS Act, S. 2019, would establish a Task Force for Recognizing and Averting Payment Scams; its identical House version was "Ordered to be Reported (Amended) by the Yeas and Nays: 49 - 0" by committee on 16 September 2026. A task force studies; it does not reimburse. Separately, the federal banking agencies' June 2025 request for information on payments fraud noted that data are thin "especially authorized payments that are a part of a scam or fraud"; by November 2025 the agencies said they were still assessing the comments, and no rule has followed.

"H.R. 9303/S. 4943 would mandate that the sending and receiving financial institutions share the liability—as opposed to the consumer."

Congressional Research Service, Elder Financial Exploitation, November 2024

What is the US equivalent of APP reimbursement? None yet, so detection carries the weight

There is no US equivalent: no federal rule makes a bank reimburse a customer who authorised a scam payment. The result is that a US bank's main lever against authorised scams is the one the UK added before reimbursement: stopping the payment.

For wires, the law already gives room. Under the official text of UCC Article 4A, a receiving bank has no duty to accept a payment order beyond what the article or an agreement requires, so the account agreement usually governs how long a bank may pause one; there is no statutory clock like the UK's D+4. For ACH, the Nacha rules above give receiving banks a reason and a code to return a suspicious credit. In both, the bank still needs what a UK bank needs on the call: a named scam, the questions for it, and evidence that the customer is being directed. That is the work scam detection software is for, and the reason APP Fraud Detection's agents never decide on their own.

What a US bank can borrow from the UK model, without waiting for Congress

A US bank can adopt the UK's operational practices without its liability rules. The UK's delay power was written around a conversation with the customer, its notice around plain reasons, and its regulator's data around consistent scam types, and none of that needs a statute in the US to begin.

A hold with a reason a colleague can say out loud, and the clocks computed from the order

Those practices are what Botminds' APP Fraud Detection automates around a person's decision. Built for UK banks, its agents gather the signals, name the scam, write the questions, listen for coaching, draft the notice and keep the file; the colleague holds, releases or refers. Where the UK's clocks do not apply, the same work happens under the bank's own policy. How the UK's public data now rank banks on sending and receiving scams is in PSR APP fraud performance data; the full case is on the APP Fraud Detection page.

Questions people ask

Are US banks required to refund scam payments?

Not under federal law, where the customer made the payment. Regulation E requires banks to investigate and limits consumer liability for unauthorized transfers, which include transfers made by a fraudster using credentials tricked out of the customer, but the Congressional Research Service notes that liability for a transfer the consumer authorised under fraudulent inducement generally rests with the consumer.

Is "authorised push payment fraud" the same as "authorized push payment fraud"?

Yes. The UK spelling is authorised; the US spelling is authorized. Both describe a payment the account holder makes after being deceived, which the Federal Reserve's FraudClassifier files under "Authorized Party Was Manipulated".

Does the UK reimburse scams paid by card or international transfer?

Not under the APP scheme, which covers payments between UK accounts over Faster Payments or CHAPS. Card, cash and cheque payments have their own protections, and the Supreme Court noted the scheme does not extend to international payments.

Does Zelle reimburse scam victims?

Any reimbursement by a network or bank for a payment the customer authorised is a matter of its own rules or policy, not federal law. The CFPB's 2024 lawsuit over Zelle was voluntarily dismissed in March 2025 without any finding.

Can a US bank delay a payment it thinks is a scam?

There is no US statute like the UK's D+4 delay power. For wires, the official text of UCC Article 4A gives a receiving bank no general duty to accept a payment order, so the account agreement usually governs a pause; for ACH, Nacha's rules let a receiving bank return a suspected fraudulent entry with R17 and exempt credits it suspects were sent under false pretenses from funds-availability timing, while Regulation CC still applies.