Which banks are worst at refunding fraud victims?

There's an alarming gap between the best and worst banks for reimbursing fraud victims and preventing criminals from abusing accounts, new data reveals.

For only the second time, the Payment Systems Regulator (PSR) has published industry data from the largest 14 banking groups in the UK. 

These figures reveal the banks that are the least likely to reimburse their customers, as well as the payment firms failing to stop the proceeds of bank transfer fraud from reaching their accounts.

Which? research has repeatedly highlighted the reimbursement lottery victims face, and we've led the charge for a mandatory scheme, which will be effective from 7 October 2024. 

Bank reimbursement rankings

Banks and payment firms must report data related to authorised push payment (APP) fraud – also known as bank transfer scams – to the PSR. 

It's hugely important that these figures are made public, to expose the worst performers. 

Overall, reimbursement has increased from 61% in 2022 to 67% in 2023, but for the second year running the three firms that reimbursed the least were Monzo (reimbursing 17% of losses), Danske Bank (13%) and AIB (9%). None are signatories of the CRM Code. 

At the top of the reimbursement table is TSB (88% of losses of were reimbursed to customers), Nationwide (87%) and HSBC/First Direct (76%), matching the top three in 2022. 

Most of these scams start with an impersonation, for example, of your bank, the police, an investment company, or even your solicitor. Others involve scammers selling non-existent goods online and asking you to pay by bank transfer, meaning you can’t use chargeback or Section 75 to protect card payments.

They may urge you to move your money to a 'safe' account, or authorise a transaction for some spurious reason. In reality, you are sending money to an account the fraudster controls. 

Which firms receive the most APP fraud money?

The PSR has also published data showing how much money is received into fraudsters' accounts as a result of APP fraud (covering money sent from accounts held with the 14 largest banking groups to any payment firm). 

As we saw in 2022, smaller payment firms received disproportionately higher rates of cash from APP fraud than larger, more established banks, suggesting weaknesses – including poor detection of mule accounts – that were exploited at scale by criminals.

Skrill (a digital wallet similar to PayPal) has a scam rate almost double that of the highest-receiving firm in 2022, and at least four times higher than any other firm in the top 20.

Skrill said it considers these scams relate to a digital wallet provided to a former client, with whom Skrill no longer does business. It claims it has seen a significant reduction in the APP scam levels that reflect the date this occurred.

A new era for fraud protection

It's hard to believe it's been eight years since Which? made a super-complaint to the PSR, calling for better safeguards for APP fraud victims. 

A voluntary code was the first milestone in May 2019, signed by eight banking groups initially – Barclays, HSBC, Lloyds, Metro Bank, Nationwide, NatWest, Santander and Starling Bank – with the Co-operative Bank and Virgin Money joining later. TSB has offered its own fraud refund guarantee since 2019.

It was a start, but Which? repeatedly warned that banks were applying the same rules inconsistently, blaming victims for being careless rather than acknowledging their own fraud-prevention failings and unfairly rejecting valid claims. 

We also led the campaign for scams to be included in the Online Safety Act, so that tech giants will also be held accountable for scams originating on their platforms

Rocio Concha, Which? director of policy and advocacy, said: 'The PSR's report acknowledges levels of performance vary hugely depending on which bank a consumer uses, so while there have been some improvements, fraud victims are still facing a reimbursement lottery and some firms are clearly way off the pace. 

'The government and the regulator have faced heavy lobbying by sections of the industry to push back against the new mandatory reimbursement scheme, which will see the vast majority of scam victims get their money back. Today's figures clearly show these new rules cannot come soon enough and must not be delayed.

'Consumers are being targeted by highly sophisticated scams, which they can often do little to protect themselves from. The UK is in desperate need of these protections that have been years in the making and will play a vital role in the fight against fraud.'

• Find out more: bank transfer scam redress for 2024 confirmed 

The banks respond

We contacted the three firms named as the worst in terms of reimbursing customers who lost money to fraud in 2023. 

AIB NI said: 'We’re committed to protecting customers from fraud, making them aware of the latest scams, educating on the best ways to keep their money and details safe, as well as supporting them if they do fall victim to fraud.

'The Payment System Regulator’s report shows that AIB has the lowest level of authorised push payment (APP) fraud per million of transactions, with our customers impacted the least. This is in part due to the level of protection and support we have in place. 

' We investigate APP fraud thoroughly on a case-by-case basis to best understand the root causes and protect our customers from such scams in the future. This goes hand in hand with our wider fraud preventive measures which saw us refund 100% of customers in cases of ‘unauthorised’ fraud last year.'

Rich Bromley, director of fraud at Monzo, said: 'Our priority is to stop fraud before it happens - and it’s working. We’ve stopped 55% more fraud since this time last year because of our commitment to building and leveraging best-in-class technology while hiring top experts to keep our customers’ money safe. 

'Our customers are disproportionately affected by purchase scams, 66% of which originate directly on social media - yet these platforms bear no responsibility for preventing fraud or providing reimbursement for money lost. They need to take decisive action like we are to protect consumers from losing money to criminals.'

Danske Bank told us: 'We take fraud very seriously and we’re continually investing in measures to further protect customers and indeed wider society from the impacts of fraud, part of which includes speaking to customers regularly about scams and how they can protect themselves.

'We provide payment advice messages in the payment journey and provide customers access to the confirmation of payee system in all our payment channels to allow customers to make informed decisions about the payments they make. Through these preventative measures we continue to see a comparatively low number of cases where our customer fall victim to APP scams. 

'This however does not mean we can be complacent and as fraud evolves so does the fight against it. In addition, we’re working hard to implement changes required to deliver the new mandatory reimbursement requirement coming in October 2024.'

What does the banking industry say?

Ben Donaldson at UK Finance said: 'The financial services sector invests more in countering fraud than anyone else and is the only sector that reimburses victims. Today’s data from the PSR shows reimbursement increased and the majority of authorised push payment (APP) fraud is reimbursed.

'Reimbursement is important in the fight against fraud, but it does not solve the problem on its own – victims still suffer the same psychological impact and criminals still get the stolen money, which causes further harm to society.

'Our focus has to be protecting consumers in the first place and that means looking at where fraud originates. Our data shows that over 90% of APP fraud starts online or over the phone, through social media, fake messages and calls. Despite this, the technology and telecommunications sectors bear no responsibility for reimbursing victims. That needs to change and these sectors also need to tackle the criminal activity that proliferates on their platforms, sites and networks.'

This article was updated to include comments from AIB NI, Danske Bank and Monzo