2 refund routes fail authorised card scam victims, Which? warns

For legal and RegTech professionals, this warning signals a liability black hole in UK consumer protection law. Mandatory APP reimbursement pushed protection onto bank transfer rails, but card payments remain governed by a patchwork of chargeback and Section 75 rules that Which? says were never designed for payments authorised to a legitimate front company. The result is a statutory blind spot that invites test litigation or regulatory reform.

On 13 August 2026, consumer group Which? issued a warning about a dangerous escalation in payment fraud: criminals are increasingly manipulating people into approving card payments, not just bank transfers. The alert is significant because most UK fraud prevention and reimbursement policy has been built around authorised push payment, or APP, scams and unauthorised card fraud. Which? described the development as a critical wake-up call, with years of security effort focused on fighting bank transfer fraud now leaving the card payment rails relatively exposed.

“

Mandatory APP reimbursement pushed protection onto bank transfer rails, but card payments remain governed by a patchwork of chargeback and Section 75 rules that Which?

The mechanics of the scam matter. In many authorised scams, victims are psychologically manipulated into sending money directly from their bank account to a fraudster. But the newer tactic involves convincing a victim to approve a card payment to a company that appears legitimate. That company may actually provide a service, but it is part of a chain of fraud, with the money ultimately ending up in the hands of criminals. Victims may have no idea they are being tricked at the moment of approval, and because the payment is authorised by the cardholder, the transaction looks genuine to banks and card networks.

The refund problem is at the heart of Which?'s concern. Unauthorised card fraud, where spending occurs without the cardholder's permission, is generally refunded. APP fraud victims now benefit from a reimbursement scheme, notably strengthened by the Payment Systems Regulator's mandatory reimbursement requirements that took effect in 2024. But authorised card fraud falls into a gap. If a person authorises a card payment directly to a retailer or trader who turns out to be a scammer, they may be able to use chargeback or Section 75 of the Consumer Credit Act. Yet Which? warns that these mechanisms are primarily designed for unauthorised charges or problems such as non-delivery, faulty goods, or a merchant failing to supply. They were not designed for a situation where a legitimate company has provided the intended services, even if that service is part of a fraudulent chain. In that scenario, victims may face a much higher hurdle to get their money back.

The implications are broad. For consumers, the result is potentially devastating financial loss without a reliable path to recovery. For banks and card issuers, the fraud represents a shift in criminal tactics as APP protections improve: fraudsters are moving to a rail where liability is less certain. For regulators, the warning exposes a fragmented UK fraud refund framework. APP transfers have a dedicated reimbursement scheme, unauthorised card transactions have chargeback and general bank refunds, but authorised card fraud to legitimate front companies sits between these regimes. It is a classic boundary problem in consumer protection law.