Payment fraud: which losses are refundable and which are not
The dividing line is usually whether you authorised the payment — and scammers work hard to make sure you did.
The short answer
- Unauthorised card and account transactions carry statutory protection.
- Authorised push payment scams are treated differently, with rules varying by market.
- Bank transfers are far harder to reverse than card payments.
Consumer payment protection is built around one distinction: transactions the customer did not authorise, and transactions the customer authorised while being deceived. The first category is well covered by law. The second is where most modern losses occur.
Unauthorised transactions
If a card or account is used without consent, statutory rules cap or eliminate the customer's liability provided the incident is reported promptly and the customer has not acted with gross negligence. Prompt reporting is a condition, not a formality.
Authorised push payment scams
Where a victim is manipulated into sending money themselves — a fake invoice, an impersonated bank official, a fraudulent property completion — the payment is technically authorised. Some jurisdictions now require reimbursement in defined circumstances; others leave it to voluntary codes. Outcomes differ sharply by market.
Practical defences
- Enable transaction alerts so unauthorised activity surfaces within hours.
- Use a card rather than a bank transfer for purchases from unfamiliar sellers.
- Treat urgency and secrecy as the primary warning signs, regardless of who is calling.
- Report to the bank first, then to the national fraud reporting body.
Sources
- Fraud and scam reporting — U.S. Federal Trade Commission
- Payment protections — CFPB
Spotted an error? Tell our corrections desk.