An independent evaluation of the UK’s mandatory reimbursement rules, published by the Payment Systems Regulator on 1 July 2026 and carried out by Frontier Economics, has found the regime cut authorised push payment scam losses by around 21%, worth an estimated £73 million a year, in its first year. It is the first hard read on whether forcing banks to refund fraud victims changes anything. It has.

But most of the fraud it pays out on doesn’t start inside the payments system. It starts on social media, marketplaces and messaging apps, and the industry paying the bill has no power to police any of them. That gap, the Payments Association argues, is becoming the central policy fight of the next 12 months.

What the evaluation found

The requirement, in force since 7 October 2024, makes sending and receiving payment firms split the cost of refunding APP fraud victims sent over Faster Payments. Losses on those payments fell by around 21% after the rules took effect, equal to roughly 35,000 fewer scams, which Frontier attributed to firms investing harder in prevention once they carried the liability. Reimbursement rates across all APP claims rose from 54% to 65%, and for claims in scope of the regime, firms are now refunding 97% of losses.

 “APP reimbursement is working,” said David Geale, managing director of the PSR. “Payment fraud losses are down, more victims are being reimbursed, and firms are investing in prevention.”

 Frontier put the added cost to payment firms at £44 million to £56 million a year. Set against £73 million of avoided losses, that is a net benefit of £17 million to £29 million, which Frontier called conservative, with no evidence of the market exit or reckless consumer behaviour industry had predicted. The PSR capped reimbursement at £85,000 per claim, down from an earlier proposal above £400,000.

Where the fraud actually starts

 The bigger limit is upstream. A whitepaper published by the Payments Association in March 2026 found that 66% of reported UK APP fraud cases in the first half of 2025 originated on online platforms such as social media, marketplaces and messaging apps, and a further 17% began on telecoms channels, more than four in five between them.

 The banks funding the refunds sit at the end of that chain, not the start of it. UK Finance has made the same argument, naming US-headquartered platforms such as Meta’s Facebook and Instagram that carry fraudulent advertising and profit from it while bearing none of the payout cost. Fraud prevention inside banks and fintechs has improved sharply under liability pressure, a shift Fintechly has tracked across challenger banks, but none of it reaches the advert or spoofed text that starts the scam, and the rules cover only Faster Payments.

The case for shared liability

 The Payments Association wants regulators to close that gap. “The findings show that while the current regime is working, it’s only treating the symptoms, not the source of fraud,” said Renuka Rawlins, its director of policy and government relations. “If two-thirds of APP scams start on online platforms, those platforms must share responsibility,” she added, calling for “a robust shared accountability framework” that holds the origin points liable alongside the firms that reimburse.

 The whitepaper behind that position proposes mandatory identity checks for advertisers, defined takedown timelines and financial penalties for repeat failures. None of it is settled policy: it’s a trade body making the case that the burden sits in the wrong place, and the evaluation has handed that case a stronger evidential base.

What happens next

 The PSR plans to open a consultation before year end on making the policy apply more consistently, so victims are treated the same way regardless of firm. As the only country to mandate reimbursement, the UK’s evaluation is the first real-world read on whether forcing refunds cuts fraud, and regulators across Europe now have evidence to argue from.

 What none of them has solved is reaching platforms based largely in the United States and operating globally. Putting liability on social media or telecoms firms needs government action, and runs into the Online Safety Act and the interests of the world’s largest firms: a slower fight than mandating a refund. For fintech firms, the regime is now a fixed operating cost, part of a wider tightening of UK payments regulation Fintechly has tracked through recent policy signals.