Reasonably safe, with one difference that matters more than the rest. A bank transfer carries no chargeback and no section 75 protection, so if the payment goes to a fraudster your only route back is the APP reimbursement regime. And that regime covers individuals, along with microenterprises and charities, so a larger business paying by transfer is outside it.
The short version
- Paying by card gives you chargeback, and a credit card adds section 75 for purchases over £100.
- A bank transfer gives you neither, so the APP reimbursement rules are the whole of your protection.
- Those rules cover individuals, plus microenterprises and charities. Larger businesses aren't covered.
- The maximum claim is £85,000, which the PSR says covers over 99% of claims, and firms may apply an optional £100 excess.
- Claims run within 13 months, and reimbursement is due within 5 business days, extendable to 35.
- APP fraud rose in 2025 to £576.4m across 248,070 cases, reversing the fall reported for 2024.
What you give up when you pay by transfer
The three main ways of paying an invoice carry three different levels of protection, and the gap between them is wider than most people paying assume.
| How you paid | What protects you |
|---|---|
| Debit or credit card | Chargeback. Your card provider "can ask the seller's bank to refund the money" |
| Credit card, over £100 | Section 75 of the Consumer Credit Act 1974 as well, for items costing more than £100 and less than £30,000 |
| Bank transfer or open banking | The APP reimbursement regime, and nothing else |
The FCA sets this out plainly for consumers, and the mechanics are the same whoever is paying. A card payment can be pulled back through the card scheme. A bank transfer can't, because there's no scheme rule that lets you reverse a payment you authorised.
That's the whole of the difference. Open banking sends money over Faster Payments in the same way a manual transfer does, so the two share a protection profile even though open banking is much harder to get wrong: your bank knows the payee details, and you approve inside your own banking app rather than typing an account number off an email.
The APP reimbursement regime, and who it covers
Authorised push payment fraud is where you're tricked into sending money yourself. Since 7 October 2024, payments made over Faster Payments or CHAPS have come with a reimbursement right, and the sending and receiving banks split the cost between them.
The headline terms are these. The maximum you can claim is £85,000, and the PSR says that will "cover over 99% of claims". Firms can apply an optional £100 excess, though not to vulnerable consumers. A claim has to be made within 13 months. Reimbursement is due within 5 business days, extendable to 35 where the bank needs longer to investigate.
Two exceptions cut the right off. You get nothing if you were complicit in the fraud, and nothing if you were grossly negligent, though the PSR describes gross negligence as "a high bar" and disapplies the exception for vulnerable consumers.
Scope is where nearly every published summary goes wrong. The regime covers individuals, microenterprises and charities. If your business is larger than a microenterprise, you're outside it, and a payment your finance team sends to a fraudulent bank account carries no reimbursement right at all. Plenty of published guidance describes the rules as though every payer benefits, and a business that plans around that assumption is planning around a protection it doesn't have.
Where your business sits against the microenterprise threshold decides which side of that line you're on, and the definition isn't reproduced here because our source doesn't carry it. Check it against the PSR's own materials before you rely on the answer either way.
The fraud numbers moved the wrong way in 2025
Anything written from the 2024 data tells you APP fraud is falling. UK Finance reported losses of £450.7m for 2024, down 2%, across under 186,000 cases, the lowest since 2020.
The 2025 figures reverse that. APP fraud losses reached £576.4m, up 19%, across 248,070 cases, up 7%. So the reassuring trend that ran through commentary for a year and a half no longer holds, and if you're setting internal controls from an article about the 2024 report, you're working from the wrong direction of travel.
What this means for a business paying suppliers
Your protection against paying the wrong account is mostly preventative, because the money is gone once it's sent. A Faster Payment can't be cancelled after it leaves, and the recovery process depends on whoever received the money agreeing to send it back.
So the controls that work happen before the payment:
- Treat any change of bank details as suspicious by default, and verify it by ringing a number you already held, never one from the email asking for the change.
- Read the Confirmation of Payee result properly. A no match on a supplier you've paid for years deserves a phone call before you override it.
- Pay from the supplier's own payment link where one exists, since the details come from them rather than from your keyboard.
- Where the sum is large and the supplier is new, a card payment buys you chargeback rights a transfer won't.
And if you're the one being paid
The same properties look different from your side of the invoice. No chargeback means no chargeback risk: a customer who pays you by open banking or bank transfer can't reverse it weeks later, and you keep the money without a card scheme sitting between you and it.
Adfin offers card, Apple Pay, Google Pay, open banking and bank transfer on the same payment link, so your customer picks the protection they want while you get the payment reconciled against the invoice either way. Open banking payments settle the same day and carry no chargeback exposure at all, while a card payment carries both the risk of one and a fee for it, quoted at £15, so there's a genuine commercial argument for steering customers towards paying by bank when the relationship is established.
For a customer paying you for the first time, the card route and its protections may be what gets the payment made at all, and that's usually worth more than the fee difference.
Common questions
Is it safe to pay an invoice by bank transfer? It's safe enough in a settled supplier relationship, but you're giving up chargeback and section 75. If the details turn out to belong to a fraudster, your only route back is the APP reimbursement regime, and that doesn't cover businesses larger than a microenterprise.
Does a bank transfer have any chargeback protection? No. Chargeback is a card scheme mechanism, so it doesn't exist for bank transfers or open banking payments. Section 75 is also unavailable, since it applies to credit card purchases.
Does APP fraud reimbursement cover my business? Only if you're a microenterprise or a charity. The regime covers individuals, microenterprises and charities, so larger businesses fall outside it. Check your size against the definition before assuming you're protected.
How much can I claim for APP fraud? Up to £85,000, which the PSR says covers over 99% of claims. Firms can apply an optional £100 excess, though not to vulnerable consumers, and a claim has to be made within 13 months of the payment.
How long does an APP fraud refund take? Reimbursement is due within 5 business days, and a bank can extend that to 35 business days where it needs more time to investigate the claim.
Is open banking safer than a manual bank transfer? The protection is identical, since both move money over Faster Payments. What differs is the chance of error: with open banking the payee details come from the business you're paying and you approve in your own banking app, so there's nothing to mistype.
Sources
- FCA — fraudulent payments (accurate as of August 2026)
This article explains the protections that apply to UK bank transfers and open banking payments and is not legal or financial advice. The rules and the figures change, so check current guidance before relying on them. Last updated August 2026.
