Contact your card provider immediately#

As soon as you see a payment you didn't authorise, get in touch with whoever issued the card.

Under UK law, banks are obliged to refund unauthorised transactions. But there's a limit: reach out within 13 months of the payment date, or you may not be able to claim at all.

Expect a few questions about what happened; they rarely hold things up. The usual outcome is a refund landing by the close of the next working day, with any fees or interest the fraud cost you returned alongside it.

One exception worth knowing. If you haven't reported your card lost or stolen, you may be liable for up to £35 of the unauthorised transaction. That only applies if the provider can show you didn't take reasonable steps to keep the card secure.

Who is responsible for the refund#

For unauthorised transactions — where someone took money without your approval — your card provider is normally responsible for refunding you, under the Payment Services Regulations 2017.

There are established processes for investigating and resolving this, and providers can help recover payments.

The burden of proof sits with them, not you. To refuse a refund they must demonstrate that you acted intentionally or with gross negligence. That's a high bar, and it's worth knowing before you accept a refusal.

If they refuse#

Escalate to the Financial Ombudsman Service (opens external site).

They'll carry out their own investigation and make their own ruling. They can settle disputes and compel firms to pay compensation, and using them costs you nothing.

If you were tricked into making the payment#

This is a different category with different rules, and the protections here have improved significantly.

Authorised push payment fraud — APP fraud — is where you're tricked into transferring money to a fraudulent account yourself. The classic version is a fraudster posing as your bank, telling you that you urgently need to move money to a different account.

The distinction matters because you technically authorised the payment. That used to make recovery much harder.

Rules introduced in October 2024 changed that. UK banks are now required to refund victims of APP fraud up to £85,000, within five days.

So if you've been tricked into transferring money, report it to your bank straight away and be clear about what happened. The refund obligation applies whether or not you feel foolish about how it occurred — which is worth saying, because embarrassment is a major reason people delay reporting, and delay is the thing that genuinely costs you.

The key things to remember#

  • Report unauthorised payments as soon as you spot them; the deadline is 13 months.
  • Banks must refund unauthorised transactions, usually by the next working day.
  • To refuse, they must prove intent or gross negligence — the burden is on them.
  • Unreported lost or stolen cards can leave you liable for up to £35.
  • The Financial Ombudsman is free and can compel a firm to pay.
  • APP fraud — where you were tricked into paying — is refundable up to £85,000 within five days.