Consumer standard of caution exception: proving gross negligence

The consumer standard of caution exception is the only ground, apart from the customer's own fraud, on which a UK bank may refuse to reimburse an APP scam victim under the PSR's rules. It applies where the bank can show that the customer, through gross negligence, failed one of four requirements: having regard to the bank's interventions, reporting promptly, answering reasonable requests for information, and consenting to a police report. The bank carries the whole burden of proof, gross negligence means a significant degree of carelessness, and the exception never applies to a customer whose vulnerability materially affected their ability to protect themselves. In practice, a refusal stands or falls on one document: the file that shows, requirement by requirement, what the customer was told and what they did. Botminds' APP Fraud Reimbursement is designed around that file. Its agents quote every warning the customer saw, class each as bespoke or boilerplate, and propose; a handler decides, and every refusal for gross negligence gets a full second review.

The rule is short. Its guidance, published by the PSR in December 2023, is where the bar is set, and it is quoted closely below because a refusal letter will be read against it by the customer, the bank's own reviewers and, often, the Financial Ombudsman Service.

What is the consumer standard of caution?

It is the standard of care a bank may expect of its customers when they make a payment, and it consists of four requirements and nothing more. A customer should have regard to interventions by the bank or by the police or National Crime Agency; report a suspected scam promptly and within 13 months of the last payment; respond to reasonable and proportionate requests for information; and, after claiming, consent to the bank reporting to the police on their behalf or report directly.

The guidance closes the list. "These four requirements are the totality of the standard of care that all consumers, other than those identified as vulnerable, can be expected to meet." Banks may not add standards through their terms and conditions or alter these four. A refusal that rests on anything else, such as "the customer should have checked the company's website" or "the return was too good to be true", has to be translated into one of the four or it has no footing in the rule.

What counts as gross negligence for APP fraud?

A significant degree of carelessness, measured against the four requirements, and higher than ordinary negligence. The PSR's words are: "We interpret ‘gross negligence’ to be a higher standard than the standard of negligence under common law. The consumer needs to have shown a ‘significant degree of carelessness.’"

The guidance also lists what a firm must weigh before deciding a customer who proceeded past an intervention was grossly negligent: the specificity and nature of the intervention, the degree of certainty it conveyed that the payment was a scam, the complexity of the scam including any social engineering, and any claims history suggesting the customer falls repeatedly for similar scams. Proceeding after a warning is not, by itself, enough: the customer "should not automatically be deemed to have been grossly negligent."

Two of those factors cut in the customer's favour more often than banks expect. A customer "in thrall of a scammer", in the guidance's phrase, is one the bank should be slow to call careless. And the guidance treats a history of repeated scams of a similar kind as a possible sign of vulnerability, which would remove the exception altogether.

Does a generic warning count as an intervention?

No. Only a bespoke intervention, specific to the customer, the scam and the payment, can support a finding of gross negligence. This is the single sentence a refusal file is most often tested against:

"Any intervention for the purpose of this exception should be bespoke. They must be consumer, scam, and transaction specific. They should not consist of ‘boilerplate’ written warnings."

PSR, Consumer standard of caution exception guidance, para 1.10

The guidance goes further on how a warning is delivered. A written warning "must be actively brought to the attention of the consumer", and firms should not rely on passive warnings such as those on public websites. The intervention must also clearly convey the bank's assessment of the probability that the payment is an APP scam. A screen that says "criminals can pretend to be people you know" conveys no assessment of this payment at all.

Detection and warning design belong before the payment, and a bank that wants refusals to hold must invest there first. The guidance says so in terms: the bank should consider whether it should have paused or prevented the payment, and engaging with the customer does not let it "transfer responsibility for assessing transaction risk entirely onto the consumer." Botminds' APP fraud detection solution covers the warning side, and bank scam warnings that work sets out what makes a warning specific enough to count; this guide covers what the claim file must show afterwards.

Who must prove gross negligence?

The bank, alone. The guidance says "The burden of proof falls exclusively upon the PSP to demonstrate that a consumer has acted with gross negligence." Firms may not shift it through contract terms or require customers to disprove negligence.

The operating consequence is that absence of evidence counts against the bank. If the call recording of a branch intervention cannot be found, the intervention did not happen for the purposes of the claim. If the in-app warning text at the time of the payment cannot be reproduced, because the screens have since been changed, the bank cannot show what the customer saw. A refusal file therefore needs the warning as it was displayed on the day, not as it reads today.

The second question answered, with each warning quoted and the rule beside it

Can a vulnerable customer be refused?

Not under the caution exception, if their vulnerability had a material impact on their ability to protect themselves from the scam. Specific Requirement 1 says the exception "does not apply if the victim was a vulnerable consumer when they made a FPS APP scam payment and this had a material impact on their ability to protect themselves from the scam." The same test removes the £100 excess.

The order of work follows from this. Vulnerability should be assessed before anyone drafts a refusal, because a confirmed finding ends the caution question. The guidance names two situations where firms risk confusing the two: repeated scams of a similar kind, and a customer who is unable or unwilling to answer requests for information. In both, it tells firms to take care "that they do not mistakenly categorise vulnerability as gross negligence". A customer can still be refused for first-party fraud, which is a separate exception, or because the payment is out of scope; the APP fraud reimbursement rules page walks through scope.

How many claims are refused for gross negligence?

Few, and the share has been falling. Over the regime's first 18 months, to 31 March 2026, 3% of claims were rejected because the customer had not taken enough care over the transaction or the claim. In the first quarter of 2026 the PSR counted around 1,700 (2%), against an average of about 2,200, or 3%, over the previous four quarters.

The averages hide a spread between firms. In the first three months, "only 23% of firms that received a claim in the period used this exception as a reason for rejecting reimbursement." The PSR said then that it would keep under review whether more clarity was needed. Its 2026 roadmap now lists, for a consultation planned for December 2026, "guidance on the application of the consumer standard of caution". A bank whose refusal rate sits well above its peers should expect questions, and a file that can answer them.

How does the Financial Ombudsman judge a refusal?

It looks at the intervention itself and at why the customer moved past it. The Ombudsman's guidance to firms says that where a bank believes the customer failed to have regard to an intervention with gross negligence, "We’ll assess both the nature and quality of the intervention. And we’ll consider why the customer moved past it." It quotes the PSR's "significant degree of carelessness" as the test.

The Ombudsman also looks beyond the scheme. Even where the reimbursement rules do not oblige a refund, it may ask a bank to reimburse if it finds the bank could and should have prevented the loss. A refusal file built only to satisfy the four requirements can still lose if it shows the bank's own controls failed. Its business response form for scam cases, which sending firms must complete, is a useful checklist of what the Ombudsman expects to see.

One refusal, read twice

A refusal is easier to defend when the proposal, the evidence and the reviewer's check are on one screen. In Botminds' solution the Assessment agent never refuses: a refusal is only ever a proposal for the handler, and the agent's limits state that the burden of proof is the bank's. Every refusal for gross negligence, and every claim over £30,000, then goes to a claims quality reviewer for a full second review.

Take the solution's fictional investment scam claim for £34,200 across three payments. Before the first, the customer saw no intervention, so that payment is proposed for reimbursement, £4,000 less the £100 excess. Before the second and third, he received a warning naming crypto investment scams, the new payee and the amount, and was told in branch it was very likely a scam; he said the money was for a kitchen fitter. The proposal refuses £30,200 and reimburses £3,900. The reviewer reads the burden-of-proof checks and the Consistency agent's comparison with 11 similar claims from the previous 90 days before approving or returning it.

A part refusal, payment by payment, with the burden-of-proof checks

The payments before the warning matter as much as those after it. A refusal that covers the whole claim because the customer ignored a warning at payment two would fail for payment one, where nothing was shown. Treating each payment as its own question is how the file avoids that error. Which claims go to a second reviewer, and at what amount, is a policy choice covered in APP fraud reimbursement policy.

Questions people ask

Can a bank refuse an APP scam claim because the customer ignored a warning?

Only if the warning was a bespoke intervention, specific to the customer, the scam and the payment, and the bank can prove that disregarding it was grossly negligent. A generic or boilerplate warning cannot support a refusal, and proceeding after a warning is not automatically gross negligence.

Is failing to report a scam quickly gross negligence?

Only where the delay itself was grossly negligent, judged from when the customer realised. The guidance says delay caused by the bank's own reporting systems should not count, and a delay because the customer reported to the police first does not equate to gross negligence. Claims made more than 13 months after the last payment may be denied regardless.

Can a customer be refused for not consenting to a police report?

A refusal to consent can be a barrier, but the guidance says firms should work with the customer to encourage consent and not automatically treat continued refusal as gross negligence. Fear, manipulation or vulnerability may explain it, and the firm must consider those first.

Does the consumer standard of caution apply to CHAPS payments?

Yes. The Bank of England has incorporated the exception into its CHAPS reimbursement rules, so it applies to CHAPS payments as it does to Faster Payments, according to the PSR's consolidated policy statement.

Can a bank's terms and conditions set a stricter standard?

No. The guidance says firms should not place any standards on the customer beyond the four requirements, alter or qualify them, or use contract terms to shift the burden of proof onto the customer.