Britain Made Banks Refund Scam Victims. The Sky Did Not Fall.

What the industry said would happen

The warnings before launch were specific. Mandatory reimbursement would create moral hazard, teaching consumers to stop caring and inviting first-party fraud. It would crush smaller payment firms under prudential strain. It would slow instant payments to the point of breaking them. The lobbying worked, up to a point: weeks before the regime began, the PSR cut the maximum reimbursement from £415,000 to £85,000 after smaller firms raised prudential concerns, aligning the cap with the UK deposit-insurance limit.

The design that survived is simple and worth studying in its details. Sending and receiving payment firms split the reimbursement cost equally, which gives the receiving bank, the one hosting the mule account, a reason to care it never had before. The victim gets paid within five business days, with a stop-the-clock provision stretching complex claims to 35. Firms may deduct an excess of up to £100, and a gross-negligence exception, drawn deliberately narrowly, protects them from genuinely reckless claims. The £85,000 cap covers roughly 99.8% of cases. Liability sits with the institutions that run the rail, on the theory that they, and only they, can engineer fraud out of it.

Why liability worked where warnings did not

The mechanism that moved the numbers is visible in the design. Before October 2024, the receiving bank, the one hosting the account the stolen money lands in, had no economic stake in stopping inbound fraud; mule accounts were the sending bank’s problem and the victim’s tragedy. The 50/50 split changed the incentive overnight. A firm that tolerates mule accounts now pays for half of every scam that flows through them, which is why the sharpest fraud reductions showed up at the firms with the worst prior records. Decades of consumer-education campaigns asked customers to outwit professional deception. One liability rule asked banks to close the accounts the deception pays into, and the second approach is the one the data rewarded.

What happened instead

Frontier’s evaluation, published July 1, reads like a controlled test of the industry’s predictions. APP fraud losses fell £73 million a year. Overall reimbursement rates rose from 54% to 65% of losses, and firms paid out on 97% of in-scope claims. Net of the industry’s compliance costs, Frontier still finds a positive short-term benefit of £17 to £29 million. The steepest fraud reductions came at the firms with the worst prior records, which is what liability is supposed to do: move prevention spending to exactly the places it was scarcest.

The regulator’s earlier dashboard fills in the operational picture. In the first nine months, 88% of claimed losses were returned to victims, against 66% under the old voluntary code; claim volumes fell roughly 15%, from 148,000 to 126,000; and 84% of claims were resolved within five business days. David Geale, the PSR’s managing director, summed up the finding: firms are preventing fraud in the first place and reimbursing quickly, neither of which was happening before.

On the predictions themselves, the evaluation is blunt. No payment firms exited the market. No evidence emerged of consumers behaving recklessly because reimbursement existed. The moral-hazard argument, the centerpiece of every banking-industry submission against reimbursement anywhere in the world, produced no observable behavior in the first market to test it at scale.

What actually went wrong

The regime’s real failures are different from the forecast ones. Seventy-one percent of fraud victims did not know the protections existed, and 49% never attempted a claim, which means the scheme underdelivers on its own generosity: the money is owed and unclaimed. That awareness gap also flattens the moral-hazard theory from the other direction, since consumers cannot be made careless by a safety net they do not know exists. Implementation varies enough between firms that a victim’s outcome still depends on who they bank with, and the PSR plans a consultation before year-end to force consistency.

Fraud also moves. A liability regime attached to Faster Payments pushes scammers toward channels outside it, and toward the platforms where scams originate. The PSR’s answer is publication: by the end of the year it intends to release platform-level data on where scams start, aimed squarely at the social media and telecom companies that host the first contact. The liability perimeter, having captured the banks, is being redrawn around the platforms.

The banks, for their part, have noticed the same asymmetry. Their money now funds reimbursement for scams that begin as an Instagram ad or a spoofed phone call, while the companies hosting the first contact bear none of the cost. Expect the next lobbying campaign to run in the opposite direction from the last one: instead of arguing against liability, the industry will argue for extending it to the platforms, which is roughly where the PSR’s data publication is designed to point.

The copycats are already moving

Other markets read the UK experiment early and built variations. Singapore’s Shared Responsibility Framework, operational since December 2024, assigns phishing losses down a waterfall: banks pay if they breached their duties, telcos pay if the banks did not, and the consumer bears the loss only when both performed. It is a narrower scheme than Britain’s, covering phishing with a digital nexus and excluding the romance and investment scams that dominate loss totals, which is precisely why the UK data matters more. Britain ran the maximal version, mandatory reimbursement for authorized fraud across the board, and the maximal version is the one that produced a measurable fall in fraud.

The lesson for everyone still arguing

The United States is running the counterfactual in real time. Regulation E covers unauthorized transfers and leaves scam-induced ones unprotected; the CFPB dropped its Zelle case; New York’s attorney general is now suing the network’s operator, and the likely endpoint is UK-style obligations arriving without UK-style clarity, settlement by settlement, state by state. British banks got a cap, a clock and an even split. American banks are getting discovery.

Translating the scheme across the Atlantic is less exotic than the industry pretends. The UK regime runs on one dominant instant rail; the US would need to cover Zelle, RTP and FedNow, and the receiving-bank incentive would work identically, because mule accounts are mule accounts in any jurisdiction. The genuine obstacles are a cost-sharing formula among thousands of institutions and a legislature willing to write one, which is why the American version is being assembled instead from settlement terms, state statutes and whatever survives appeal.

There is one more twist: the regulator that proved the policy will not survive it. The government announced in March 2025 that the PSR will be folded into the FCA, a casualty of the deregulatory mood. The scheme it built now has a year of results that will outlive it. Mandatory reimbursement was supposed to end instant payments. One year of data says it mostly ended the argument, and the £73 million now staying in customers’ accounts is the strongest evidence yet that banks prevent the fraud they have to pay for.