Do banks refund scammed money? Who moved the money decides

The first question is who moved the money

The pages we read sort a scam loss into two kinds. In the first, someone else makes the transfer with details they got from you. In the second, you make the payment yourself because you were deceived. The CFPB’s Regulation E answers, last updated on 15 January 2025, define an unauthorized electronic fund transfer as one started by a person other than the consumer, without actual authority and with no benefit to the consumer. They also say that when a third party fraudulently induces a consumer to share account access information and then uses it to make a transfer, that transfer is unauthorized. Their examples are a caller who pretends to be a representative of the consumer’s bank and tricks the person into giving a login, a texted confirmation code or a debit card number, and a third party who uses phishing or other methods to gain access to the person’s computer and observe them entering login details.

The second kind is what UK Finance calls authorised push payment fraud, or APP fraud: being tricked by a criminal into sending money by bank payment to an account the criminal controls. It lists purchase, impersonation, investment, romance and invoice fraud as common types. It keeps this apart from unauthorised fraud, where someone takes a payment from your account without your permission, and says that has separate rules, including for credit and debit card fraud.

The US pages we read do not set out a refund rule for a payment you sent yourself. The FTC’s page tells you to ask the bank to reverse a Zelle or bank transfer and refund the money, and it does not say whether the bank has to. The Ask CFPB page is about a charge or withdrawal “you didn’t make or allow,” and the text we read does not mention scams. The CFPB FAQs we read do not name Zelle. In the United Kingdom the line falls in a different place: the rules that began on 7 October 2024 are written for the second kind.

The United States, one way of paying at a time

The FTC’s page, which it dates June 2026, starts from a hard fact: scammers ask you to pay in ways that make it hard to track them down, and your money might be gone already. It adds that it is always worth asking the company you used to send the money whether there is a way to get it back. The verb throughout is ask. For each way of paying the page names who to report to and what to request, and it makes no promise of a refund.

For Zelle or a bank transfer, it says to report to your bank or credit union immediately and ask them to reverse the payment and refund your money. For payment apps such as Venmo, Cash App or PayPal, the same two steps go to the app. For a wire transfer company such as Western Union or MoneyGram, it says to report to the company, tell them a scammer tricked you into sending money and ask for a refund.

Cards are where the page points to federal law; for cryptocurrency it points only to state laws that might help. If someone used your credit card without your authorization, or a scammer tricked you into paying with it, report it to the issuer immediately, using the number on the back of the card or your account online or in the app, and ask for a refund. The page adds that federal law protects you from unauthorized use of your credit card. The debit card entry has the same steps, for your bank or credit union, and the same sentence about unauthorized use of a debit card. It covers being tricked into paying with the card, but the legal sentence it attaches is about unauthorized use.

For a gift card, contact the issuer immediately, using the number on the back, say a scammer tricked you into giving the card number and PIN, ask for a refund, and keep the card and the receipt, because you may need them to follow up on your claim. For cryptocurrency, contact the exchange or the ATM operator, tell them it was a fraudulent transaction, ask them to reverse it, and report it to the FTC. The page says cryptocurrency payments do not have the same legal protections as credit and debit cards, so it can be hard to get your money back, and that some states have passed laws that might help. For cash sent through the U.S. mail, it says to contact the U.S. Postal Inspection Service immediately: for a fee, it can intercept a package, which lets you redirect a domestic shipment that has not been delivered. For cash sent by FedEx or UPS, contact them as soon as possible.

Guardio, a security company that sells a product, publishes a blog that is blunter. It says cryptocurrency transactions are typically irreversible and that you are unlikely to see a refund, and that most banks will not refund scammed money for gift cards. The FTC words the crypto case as hard, not impossible, and tells you whom to ask for gift cards. We treat the blog as one company’s opinion, not a rule.

The United States, the clock for transactions you did not make

The Ask CFPB page, last reviewed on 28 August 2026, covers a charge or withdrawal you did not make or allow. Once you notify your bank or credit union, it says, the bank generally has ten business days to investigate, or 20 if the account has been open less than 30 days. It must correct an error within one business day after determining that one has occurred, and then has three business days to report its findings to you. You have the right to ask for the information it used, and it has to send it promptly.

If the investigation cannot finish in time, the page says the bank must generally issue a temporary credit for the disputed amount, minus a maximum of $50, while it carries on. There are exceptions: a bank can ask for written confirmation of an error you reported by telephone, and if you do not send it within ten business days it is not required to credit you in the meantime. The bank must resolve the matter in 45 days, or up to 90 days for transactions made in a foreign country, within 30 days of opening the account, or debit card point-of-sale purchases. If it decides the transactions were authorized, it must give you written notice before taking the credited money back out of your account.

Some deadlines are yours. For a lost or stolen debit card, the page says to notify the bank within two business days of discovering the loss: you cannot then be held responsible for more than $50 or the amount of the unauthorized transactions, whichever is less, and after two business days you could be responsible for up to $500. If a statement shows an unauthorized withdrawal and you did not lose your card, the page says to notify the bank within 60 days after it sends the statement; wait longer and you could have to pay the full amount of transactions made after the 60 days and before you notify. In unusual circumstances, such as lengthy travel or hospitalization, it says these periods must be extended.

The Regulation E answers add three points. A financial institution cannot use the consumer’s negligence to impose greater liability than the regulation allows; the example given is a PIN written on a debit card, which does not change liability for unauthorized transfers. Private network rules that say a transfer is final and irrevocable do not reduce the protections for a person-to-person transfer that meets the unauthorized definition, and no agreement can waive them. And a consumer who was fraudulently induced to give account information has not furnished an access device, so the exclusion for transfers started by someone you gave your access device to does not apply.

These timetables belong to the first kind of loss. The pages we read do not say that they apply to a payment you sent yourself, and they cannot be set beside the UK timetable below, which belongs to a different scheme.

The United Kingdom, since 7 October 2024

UK Finance explains the Payment Systems Regulator’s rules for authorised push payment fraud, which apply to payments made on or after 7 October 2024. It says they cover payments within the UK by Faster Payments or CHAPS, from personal accounts and by micro-enterprises and certain charities, and that they bind all payment services providers, including building societies, e-money organisations and fintechs. Citizens Advice, writing for England, gives the same two payment types and names e-money firms such as Revolut among the providers.

UK Finance lists what is not covered: payments by cash, cheque, or credit, debit or prepaid card; payments sent overseas; civil disputes, such as paying a genuine business and being unhappy with what you got; payments to another account you control; payments that are themselves unlawful; payments where you acted fraudulently; and payments to or from a credit union, municipal bank or national savings bank. Citizens Advice says a bank does not have to refund you if you used BACS or Swift, or sent the money abroad.

The two pages word the promise differently. Citizens Advice says the bank or payment provider should usually refund you, and that the bank must refund you up to eighty-five thousand pounds. UK Finance says reimbursement is not guaranteed in all cases, and names the same amount as the most you can claim. On timing, UK Finance says that if the claim is valid you should in most cases be reimbursed within five business days, and in some cases it can take up to 35 business days, when the bank needs extra time to gather information from you, the receiving bank or a statutory body. Citizens Advice gives five working days and up to 35. On cost, UK Finance says an excess of up to £100 may be deducted, and the bank may choose a different excess or none; Citizens Advice says the bank might charge a fee of £100, which it takes off the refund.

UK Finance attaches duties to the claim, which it calls the “Consumer Standard of Caution.” You follow advice and warnings from your bank and law enforcement, report the fraud as soon as you can and no more than 13 months after the last fraudulent payment, answer the bank’s requests for information, and consent to the police being told where that is possible and reasonable. A bank does not have to reimburse if you showed a significant degree of carelessness, which UK Finance calls “gross negligence.” Citizens Advice says you might not get a refund if the bank can prove you were not careful enough or did not help it. For customers who may be more vulnerable to being tricked, UK Finance says that if those circumstances affected their ability to spot or protect themselves from fraud, they can still be reimbursed even if they did not take every step, and no excess applies.

Both pages send you to your bank first. UK Finance says to use a number you know to be genuine, such as the one on the back of your card, and also to report the fraud to Action Fraud, or to Police Scotland if you are in Scotland. If you are unhappy with the result, the Financial Ombudsman Service is free; Citizens Advice says you can go to it if your complaint is not sorted out in eight weeks, or you get a final response letter.

Citizens Advice covers other ways of paying. For a card, your provider can ask the seller’s bank for the money back under chargeback; a debit card can use it for any amount, and a credit card user might be able to claim under Section 75 if the item cost more than £100 and less than thirty thousand pounds. Money paid from a PayPal account goes through a dispute with the seller. A Direct Debit has a guarantee that it says should give a full refund. For wire services such as MoneyGram, PayPoint or Western Union, and for vouchers or gift cards, it says a refund is unlikely. For a bank transfer made before 7 October 2024, it says the bank should refund you if it was registered under the Contingent Reimbursement Model Code, which applied from 28 May 2019 to 6 October 2024. The UK pages we read do not mention cryptocurrency.

What the numbers said in 2022, and where to report

Which? published its article on 30 September 2022, in the week the regulator proposed mandatory reimbursement. It reports that losses to APP fraud reached £583.2 million in 2021, up 39% on the year before, overtaking card fraud losses of £524.5 million for the first time. It says only 46% of APP fraud losses were refunded in 2021, and, citing UK Finance, that victims of unauthorised card fraud were refunded in 98% of cases, while APP victims relied on a voluntary industry code. It also reports that the Financial Ombudsman Service ruled for the customer in 76% of authorised fraud complaints in 2021 to 2022, and 59% in the first quarter of the following year, with a note that the data was unpublished and covered all authorised fraud, not only APP. These are one publisher’s figures about the old voluntary system. The pages we read do not give a count of claims paid under the 2024 rules.

Which? also describes what was then only a proposal: reimbursement on payments over £100, with an excess of no more than £35. UK Finance, describing the rules that apply from 7 October 2024, gives an excess of up to £100. The two figures differ: one is a 2022 proposal and the other is the excess in the rules that apply from 7 October 2024.

Reporting is a separate step from getting money back. The FTC asks for reports at ReportFraud.ftc.gov and says it uses them to build cases against scammers, spot trends, educate the public and share data about what is happening in a community. If you gave a scammer your Social Security number and they used it, it points to IdentityTheft.gov for a recovery plan; if you gave a username and password and can still log in, it says to create a new strong password, change it elsewhere if you reused it, and turn on two-factor authentication. Our page on identity theft has the deadlines after money or data has been lost.

The same pages warn about the ask itself. The FTC says it will never tell you to transfer your money to “protect it,” and UK Finance says banks and law enforcement will never ask you to transfer money to protect yourself from fraud. How the contact starts is covered on our pages on a vishing call, a phishing email, a romance scam and a pig butchering scam.

What we did not use

We tested nothing and contacted no bank. We did not read the Reddit thread, the LegalShield page, the Quora question or the Surfshark blog on the same subject. The Guardio blog is a security company’s, so we used it only for statements labelled as its own. The Ask CFPB text we read does not mention scams and the CFPB FAQs we read do not name Zelle, so we give no rule for a Zelle payment you approved yourself. The pages we read do not say how many claims banks accept today. The Which? article dates from 2022 and is used only for the history. The FTC page is dated June 2026 and the Ask CFPB page was last reviewed on 28 August 2026; either may change.