Bank scam warnings are the messages and spoken cautions a bank gives a customer who may be about to pay a scammer, and they work only when they are specific: about this customer, this scam and this payment, delivered at the moment of decision, and kept so the bank can show later exactly what was said. A generic "could this be a scam?" pop-up shown on every new payee is the warning scammers prepare their victims for. In the UK it also carries little weight in a reimbursement claim, because the regulator's guidance says a bank should not refuse a claim on the strength of boilerplate warnings. The difficulty is that the bank does not know which scam it is facing until it has asked; a warning written before the questions has to be generic. Botminds' APP Fraud Detection reverses the order: its agents name the likely scam behind a held payment, write the questions for it, and put the approved warning for that scam into the call after the answers that support it, with every word kept on the intervention file.
A generic warning against a scam-specific one, on the same held payment
Generic warning: A general caution that this could be a scam and that fraudsters pretend to be people you trust
Scam-specific warning: “People who do this often say they are from the bank or the police, and tell you to move money to keep it safe. Corvane will never ask you to do that.”
Generic warning: Everyone paying a new payee
Scam-specific warning: This customer, on this payment, after these answers
Generic warning: Before the payment, on a screen the customer taps through
Scam-specific warning: On the call, after the questions that surfaced the scam
Generic warning: Often exactly this message, and to ignore it
Scam-specific warning: Not a warning that names the caller’s own story
Generic warning: That a message was displayed
Scam-specific warning: The words, the time, and the customer’s reply
Generic warning: The regulator says not to rely on boilerplate
Scam-specific warning: An intervention specific to customer, scam and payment
Do bank scam warnings work?
Some do, and the ones that work are specific and close in time to the decision. The FCA's review of firms' anti-fraud controls found that "The use of risk-based, automated warning messages during the payment journey, can be effective" in helping customers consider whether a payee is genuine, and it tied that to the Consumer Duty, which expects firms to "design, test, tailor and monitor the effectiveness of such messages". Note the qualifiers: risk-based, and tested.
The research supports both. In a field experiment with people who had been defrauded before, a former telemarketer pitched a mock scam two or four weeks after participants were warned. The authors found that "Both warnings reduced unequivocal acceptance of the mock scam", but a warning about the same scam produced more outright refusals than a warning about a different one, and "The same scam warning, but not the different scam warning, lost effectiveness over time". The specific warning is stronger and fades; a general one is weaker and lasts. For a bank, that argues for a specific warning at the moment of the payment, not a specific warning months earlier and a generic one now.
Why do people ignore scam warnings?
Often because a scammer has got there first, and because a warning can look like every other message the bank shows. In the sample bank's safe-account case the caller had given the customer a cover story for the bank's questions and told her someone at her branch might be involved; in a romance or investment scam the customer may trust the person asking for money more than any pop-up. FG24/6 records that firms asked for room to deal with exactly this: a customer who trusts the fraudster may simply pay through another bank.
Repetition does the rest. A warning that appears on every new payee teaches customers to tap through it, and the PSR's guidance names that pattern as one a bank cannot rely on: warnings "that routinely accompany most or all transactions of a similar type". Even the payee name check, which is not a scam warning but often reads like one, leaves the customer to decide: where it shows no match or a close match, the PSR has said, the payer decides whether to go ahead at their own risk. A customer coached to expect a mismatch can be expected to go ahead.
What makes a good scam warning? Specific to the customer, the scam and the payment
A good scam warning names the scam the bank believes is happening, says why in terms of this payment, tells the customer what a genuine bank or partner would never do, and asks the customer to stop. The PSR's guidance on the consumer standard of caution sets the standard for any warning a bank may later rely on. It must be bespoke: specific to the customer, the scam and the transaction, and boilerplate written warnings do not qualify (the guide to the exception quotes the paragraph).
A warning the customer could have read on any payment protects no one, and it will not defend a refusal either.
The same paragraph adds two practical rules. A written warning has to be put in front of the customer, not left for them to find, and a bank cannot count warnings that merely sit on its public website. The guidance leaves the design to firms, asking them to develop "tailored, specific interventions" and identify best practice themselves.
Six tests of a bank scam warning
- It names the scam
“Someone is pretending to be from our fraud team”, not “fraudsters may contact you”. In APP Fraud Detection the warning comes from the approved script for the scam the typology agent named.
- It uses the customer’s own facts
The new account in their name, the caller who will ring back, the cover story they were given.
- It says what a genuine party never does
The sample bank’s notice: “Corvane will never ask you to do that.”
- It comes after the questions
So it can be specific; a warning read first is necessarily generic.
- It is actively given, not left to be found
Spoken on the call or put in front of the customer, never a link to a web page.
- It is kept with the reply
The words, the time and what the customer said back, on a file nobody can edit.
When should a bank show a scam warning? After the questions, at the moment of decision
A bank should give its strongest warning when it knows which scam it is warning about, which is after the customer has answered the questions that reveal it, and before the payment is released. Earlier warnings still have a place: a risk-based message in the payment journey can make a customer pause. But it cannot name the scam, because the bank does not yet know it.
Where the warning belongs in one scam intervention
- Q1 who contacted youQ1
- Q2 whose accountQ2
- Q3 what is it for: cover story flaggedQ3 · 03:12
- Q4 told not to tell the bankQ4
- Q5 caller will ring backQ5
- Specific warning, acknowledgedWarning
The sample bank learned this the plain way. In its September check of customer outcomes, an internal auditor reviewed 40 interventions with their transcripts: 38 were good, and one of the two that needed remediation was a warning read before the questions. That is a sample bank's audit, not a customer's result, but the finding is the general one: a warning given before the bank knows what it is warning about cannot be specific, and a specific warning is the one that counts.
Is a warning enough to refuse reimbursement?
Rarely, and never on its own. Under the UK rules a bank may refuse an in-scope claim only if the customer was complicit or, through gross negligence, failed to meet the consumer standard of caution, and the first of that standard's four parts is that the customer "Should have regard to any intervention made by their sending PSP and/or by a CNA". Ignoring a warning is not automatically gross negligence. The guidance says a customer who goes ahead after an intervention is not for that reason alone grossly negligent, and lists what must be weighed, including how specific the bank's intervention was and how sophisticated the scam was, social engineering included.
Three further limits apply. The exception falls away for a vulnerable customer whose vulnerability materially affected their ability to protect themselves from the scam. The bank has to consider whether it should itself have "paused or otherwise prevented a payment from being executed". And in practice the exception is little used: the PSR reports that "around 1,700 (2%)" claims were rejected for insufficient consumer caution in the first quarter of 2026. A warning's real value is in stopping the payment, not in defending a refusal; how a refusal on caution grounds has to be proved is set out in the consumer standard of caution exception, from the APP Fraud Reimbursement series.
Which part of the consumer standard of caution turns on a warning?
Only the first, of four. The consumer standard of caution is the set of four things a UK sending bank may expect of a customer who claims reimbursement for an APP scam: that they have regard to the bank's or the police's interventions, report the scam promptly and within 13 months, respond to reasonable requests for information, and consent to the scam being reported to the police. A bank can refuse a claim under it only if the customer failed one of those through gross negligence, and not if the customer was vulnerable in a way that materially affected their ability to protect themselves. A warning only counts towards the first part, and only if it was specific to the payment; the guide to the exception covers the other three and how a refusal is proved.
The consumer standard of caution, and what each part asks of the bank first
| The customer should | What the bank needs to have done |
|---|---|
| Have regard to interventions by the bank or a competent national authority | Made an intervention specific to the customer, the scam and the payment, and kept it |
| Report promptly, and within 13 months of the last payment | Offered accessible ways to report, and not caused the delay itself |
| Respond to reasonable and proportionate requests for information | Asked for what the rules allow, for a permitted purpose |
| Consent to a police report, or report it directly | Asked, in a way the customer could agree to |
How should warnings be recorded?
Word for word, with the time, the channel, the version of the script it came from, and the customer's reply, on a file that cannot be edited afterwards. A note that says "customer warned" proves that someone typed two words. A claims handler deciding within five business days, or the Financial Ombudsman Service months later, needs to read what the customer actually heard and said.
The sample bank's file for its safe-account case shows the level of detail that helps. The warning, W-SA-1, is listed as read and acknowledged, labelled a specific, directed intervention, and tied to the second of the call it was given in. Beside it the file maps each part of the consumer standard of caution to its evidence: the warning, the five of five questions answered on a recorded line, the police report to be offered at the branch visit, and the customer's recorded vulnerability, with a note that the gross-negligence exception would not be relied on if a claim ever came.
The warning on the file: words, time and reply, mapped to the consumer standard of caution
Testing scam warnings the way the FCA expects: design, test, tailor, monitor
The FCA's expectation that firms design, test, tailor and monitor their warning messages is a measurement programme, and a scams line can run it. Track, for each warning version, how often the customer stops the payment after hearing it, how often a released payment later becomes a claim, and how warnings perform by scam type. The research on forewarning suggests the measures will differ: a specific warning may produce more refusals at first and less over time.
The sample bank measures its scripts, of which the warning is the last part, by the share of confirmed scams each stopped against the previous version: 87% for the current safe-account script against 79% for the one before, 80% against 72% for invoice redirection, 58% for purchase scams. Those are sample figures, not a customer's result. In the solution, a new script or warning is tested on the previous month's calls before it goes for approval, the script agent can only use warnings from the approved library, and every version stays on the file, so a warning that worked can be identified and one that did not can be retired.
The delay notice is a warning too: plain words, the scam named, what the bank will never ask
The written notice that follows a delayed payment is the last warning the customer receives, and it is held to the same standard. FG24/6 expects it to give the customer enough to understand the risks the bank has found. The sample bank's notice names the pattern, says the bank will never ask for money to be moved, and tells the customer to hang up and call the number on the back of their card. How a warning fits into the whole call is in scam intervention, how it changes when the customer is in a relationship with the scammer is in romance scam intervention, and the system that writes and keeps it is APP Fraud Detection.
Questions people ask
What is a "specific, directed intervention"?
It is the PSR's description of a warning a bank can expect a customer to heed: one that conveys the bank's assessment that this payment is likely to be an APP scam, specific to the customer, the scam and the transaction. Boilerplate warnings shown with most payments of a similar type do not qualify.
Does a confirmation of payee warning count as a scam warning?
A payee name check tells the customer whether the name matches the account; it does not assess whether the payment is a scam. On its own it is unlikely to meet the PSR's description of a bespoke intervention specific to the customer, the scam and the payment.
Should a bank warn every customer on every payment?
No. Warnings that routinely accompany most or all transactions of a similar type are the kind the PSR says a bank cannot rely on, and repetition teaches customers to ignore them. Risk-based warnings, shown when there is a reason, are what the FCA found can be effective.
Can a bank refuse reimbursement because the customer ignored a warning?
Only if ignoring it amounted to gross negligence, which the PSR describes as a high bar, and never where the customer's vulnerability materially affected their ability to protect themselves. The specificity of the warning and the complexity of the scam are part of that judgement.
How long does a scam warning work?
The evidence is limited. In one field experiment with past fraud victims, pitched a mock scam two or four weeks after a warning, a warning about the same scam lost effectiveness over time while a warning about a different scam did not, which supports warning at the moment of the payment rather than relying on earlier campaigns.