UK banking · September 2026
Common UK money scams in 2026: how to spot them and what to do next
Last updated: 27 September 2026.
Key points
Key decision routes
Related: Pay by Bank (open-banking payments and APP), FSCS protection limits (firm failure ≠ scam reimbursement), UK credit scores 2026 (fraud on your file), banking.
Two big buckets
Two big buckets. Which path applies depends on the facts. Not legal advice. Not a guarantee of recovery.
| Unauthorised | Authorised push payment (APP) | |
|---|---|---|
| What happened | A payment you did not agree to | You agreed to send money — but to a fraudster |
| Typical money-back path | Stronger bank refund rules under the Payment Services Regulations (FCA) | PSR mandatory reimbursement for many UK Faster Payments / CHAPS cases from 7 October 2024 — not automatic in every case |
| Key numbers (APP) | — | Typically up to £85,000; usually within 5 working days (complex cases longer); possible £100 excess (except vulnerable customers); “gross negligence” / consumer standard of caution exceptions exist; some payment types excluded |
| Examples | Card / account takeover; stolen details; malware | Purchase scam; “safe account”; fake invoice; romance; investment; Pay by Bank to a phishing payee — Pay by Bank |
Take Five: Stop — Challenge — Protect.
Dated industry figures (UK Finance Annual Fraud Report 2026)
Covers 2025 data, published June 2026. Use as context — not scare copy.
Dated industry statistics for context. Many victims recover money — but not all pounds are returned.
Not scare copy. Not a personal outcome promise.
| Measure | Figure | Label |
|---|---|---|
| Payment fraud stolen | £1.28bn (+4%) | Industry stat (UK Finance AFR 2026) |
| APP losses | £576.4m (+19%) | Industry stat |
| APP cases | 248,070 (+7%) | Industry stat |
| APP reimbursed by banks | £354.3m (61% of APP losses) | Industry stat — many victims recover money; 61% ≠ 100% of pounds returned |
| How APP often starts | Online 66% of cases; telecoms 17% | Industry stat |
| Investment APP losses (press coverage) | £221.5m (+40%) | Industry / press figure — large driver; purchase scams remain high in case volume |
Take Five: Stop — Challenge — Protect.
- £1.28bn stolen via payment fraud (+4%)
- APP: £576.4m losses (+19%); 248,070 cases (+7%)
- Banks reimbursed £354.3m of APP losses (61% of APP losses) — so many victims recover money, but not all pounds are returned
- APP often starts online (66% of cases) or via telecoms (17%)
- Investment APP losses were a large driver in press coverage (£221.5m, +40%); purchase scams remain high in case volume
Common scam types
Informational types only — not ranked by fear. Outcomes depend on how the payment was made and the facts.
| Type | What it looks like | What to do / report |
|---|---|---|
| 1) APP / bank-transfer | You send Faster Payments because of a fake story (purchase, “safe account”, invoice, romance, investment). Sub-types (UK Finance): purchase; investment; invoice/mandate; impersonation; romance; CEO (more business). Impersonation losses fell in 2025 per UK Finance — pattern still worth knowing | Bank immediately; APP claim if FPS/CHAPS to fraudster; Report Fraud / police |
| 2) Phishing / smishing / vishing | Fake emails, texts or calls mimicking bank, HMRC, delivery firms, government — steal logins, one-time codes, or push an APP payment | Suspicious texts/calls → 7726; phishing emails → report@phishing.gov.uk (NCSC) |
| 3) Fake bank / HMRC / police (“safe account”) | Claim your money is at risk and tell you to move it. Real banks and HMRC do not ask you to transfer to a “safe account” or share full security codes that way. | Hang up; call bank on card/statement number or dial 159 (UK bank fraud hotline — Stop Think Fraud / Take Five ecosystem) |
| 4) Invoice / payment diversion | Genuine-looking bill with changed bank details (email compromise) | Verify new payee details on a known number before paying |
| 5) Investment / crypto cold calls & clone firms | Unsolicited “guaranteed returns”; fake platforms; clone firms copying FCA-authorised names/FRNs (FCA Warning List still active in 2026) | Check FCA Register using Register contact details, not the caller’s; ScamSmart / Warning List. Clone victims typically lose FOS/FSCS protection (firm never authorised). Helpline 0800 111 6768 (even before loss) |
| 6) Romance / money mule | Online relationship → requests for money or to receive/forward funds. Moving money for others can be criminal | Stop; bank / Report Fraud; keep short and non-sensational |
| 7) Card / account takeover | Stolen details or malware → unauthorised transactions | Different refund path from APP — bank ASAP (PSR unauthorised rules) |
What to do if scammed (no guarantee of recovery)
- Contact your bank immediately (card/statement number or 159) — freeze and start recovery / reimbursement claim.
- Report the crime: England, Wales, NI — Report Fraud (reportfraud.police.uk / 0300 123 2040); Scotland — Police Scotland 101
- Keep screenshots, numbers and emails.
- If unhappy with the bank’s decision → firm complaint → Financial Ombudsman Service.
- Investment clone approach (even before loss): FCA 0800 111 6768.
How to spot (calm checklist)
- Unexpected contact + urgency / fear / secrecy
- Requests to move money to a “safe” account
- New bank details for a regular supplier without independent check
- Too-good investment returns; pressure not to talk to family/bank
- Links that don’t match the real domain
- Caller ID can be spoofed — hang up and redial a trusted number
Prevention: Take Five before paying; use confirmation of payee / bank warnings; soft-search eligibility ≠ sharing codes with cold callers; check credit file if identity theft suspected — UK credit scores 2026; never install remote-access software because a “bank” asked.
1) APP / bank-transfer scams
You send Faster Payments because of a fake story — a purchase, “safe account”, invoice, romance or investment.
Sub-types (UK Finance language): purchase scams; investment; invoice / mandate; impersonation (bank / police / other); romance; CEO (more business). Impersonation losses fell in 2025 per UK Finance — the pattern is still worth knowing.
2) Phishing / smishing / vishing
Fake emails, texts or calls mimicking a bank, HMRC, a delivery firm or government. Goal: steal logins, one-time codes, or push an APP payment.
Report suspicious texts or calls to 7726. Report phishing emails to report@phishing.gov.uk (NCSC).
3) Fake bank / HMRC / police (“safe account”)
Criminals claim your money is at risk and tell you to move it. Real banks and HMRC do not ask you to transfer to a “safe account” or share full security codes that way. Call the bank on a number from the card or statement, or dial 159 (UK bank fraud hotline — Stop Think Fraud / Take Five ecosystem).
4) Invoice / payment diversion
A genuine-looking bill with changed bank details (often after email compromise). Always verify new payee details on a known number.
5) Investment / crypto cold calls and clone firms
Unsolicited “guaranteed returns”; fake trading platforms; clone firms copying FCA-authorised names and FRNs (FCA Warning List still active in 2026 — including September 2026 clone alerts).
Check the FCA Register using the Register’s contact details, not the caller’s. Use ScamSmart / the Warning List. Clone victims typically lose Financial Ombudsman / FSCS protection because the firm was never authorised.
6) Romance / money mule
An online relationship leads to requests for money, or to receive and forward funds. Moving money for others can be criminal. Keep this short and non-sensational.
7) Card / account takeover
Stolen details or malware lead to unauthorised transactions — a different refund path from APP.
How to spot (calm checklist)
- Unexpected contact plus urgency / fear / secrecy
- Requests to move money to a “safe” account
- New bank details for a regular supplier without an independent check
- Too-good investment returns; pressure not to talk to family or the bank
- Links that don’t match the real domain
- Caller ID can be spoofed — hang up and redial a trusted number
Five checks before you send a new payee money
- Did I start this payment myself — or did a cold call / message push me?
- Have I verified new bank details on a known number?
- Am I being asked for secrecy or a “safe account”?
- For investments: did I check the FCA Register / Warning List myself?
- Have I paused (Take Five) before approving?
What to do if scammed (no guarantee of recovery)
- Contact your bank immediately (card / statement number or 159) — ask them to freeze accounts and start recovery / a reimbursement claim.
- Report the crime:
- England, Wales, Northern Ireland: Report Fraud — reportfraud.police.uk / 0300 123 2040
- Scotland: Police Scotland 101 (Advice Direct Scotland is also cited on FCA pages)
- Keep screenshots, numbers and emails.
- If unhappy with the bank’s decision → firm complaint → Financial Ombudsman Service.
- Investment clone approach (even before a loss): FCA 0800 111 6768.
APP reimbursement (careful wording)
Eligible Faster Payments / CHAPS APP from 7 October 2024 — the sending payment service provider must generally reimburse up to £85,000 if the rules are met. That is not a promise for every story (consumer standard of caution / gross negligence; excess; exclusions for some payment types).
Details: PSR and FCA fraudulent-payments pages. A2A / open-banking context: Pay by Bank.
Careful: the £85,000 APP reimbursement cap is not the same as FSCS deposit protection (£120,000 from 1 December 2025 if a firm fails). FSCS does not replace APP scam reimbursement when a fraudster took a transfer: FSCS protection limits.
Prevention habits
- Take Five before paying
- Use the bank’s confirmation of payee / warnings
- Soft-search eligibility checks ≠ sharing codes with cold callers
- Check your credit file if identity theft is suspected: UK credit scores 2026
- Never install remote-access software because a “bank” asked
UK money scams: FAQs
What are the most common UK money scams in 2026?
Common patterns include APP / bank-transfer scams, phishing / smishing / vishing, fake bank or HMRC “safe account” stories, invoice diversion, investment / clone firms, romance / money-mule approaches, and card or account takeover. This page is calm information — not fearmongering.
What is the difference between unauthorised payments and APP fraud?
Unauthorised means a payment you did not agree to — stronger bank refund rules often apply under the Payment Services Regulations. APP (authorised push payment) means you agreed to send money but to a fraudster — a different reimbursement path under PSR rules.
What is APP reimbursement?
For many UK Faster Payments / CHAPS APP cases from 7 October 2024, PSR mandatory reimbursement may apply — typically up to £85,000, usually within 5 working days (complex cases longer), with a possible £100 excess. It is not automatic in every case and is not the same as FSCS.
Is APP £85,000 the same as FSCS £120,000?
No. APP reimbursement is about bank-transfer scams under PSR rules (typically up to £85,000). FSCS protects eligible deposits if a firm fails (£120,000 from 1 December 2025). Never mix the two.
What should I do if I think I’ve been scammed?
Contact your bank immediately (card / statement number or 159). Report the crime via Report Fraud (England, Wales, NI) or Police Scotland 101. Keep evidence. If unhappy with the bank’s decision, complain then consider the Financial Ombudsman. There is no guarantee of recovery.
How do I spot a fake bank or HMRC “safe account” scam?
Criminals claim your money is at risk and tell you to move it. Real banks and HMRC do not ask you to transfer to a “safe account” or share full security codes that way. Hang up and call a number from your card or statement, or dial 159.
How do I check for clone investment firms?
See Common scam types above.
Where do I report phishing texts or emails?
Report suspicious texts or calls to 7726. Report phishing emails to report@phishing.gov.uk (NCSC). Still contact your bank if you shared details or sent money.
How does Pay by Bank relate to APP scams?
Pay by Bank is an account-to-account open-banking payment. Approving a transfer to a fake shop or phishing payee can fall under the APP path. See Pay by Bank for how it differs from cards and the three protection buckets.
What if fraud appears on my credit file?
Unrecognised accounts or searches: contact the CRA and lender; report fraud. See UK credit scores 2026. Never pay a cold-caller who claims to “fix” your score.
Get our weekly email
The Friday Finance Lowdown — five minutes of the money stuff worth knowing.
Free to join. See our privacy policy for how we handle your email address.