Scam Liability Is Reaching Past Banks to the Platforms and Phone Networks Where Fraud Starts
UK banks have reimbursed 88% of APP scam losses, yet most scams start on platforms and phone networks. The EU and Australia are writing duties for those origins while UK rules lag, leaving payments, treasury and risk leaders a repricing window to 2029.
Produced using Shaping Tomorrow’s six-stage process for converting external change into decision-ready intelligence.
Scanned and filtered by AI. Stress-tested and judged by humans.
The consensus treats the UK's mandatory scam reimbursement as a bank cost that works: the regulator estimates losses fell by £73 million per year (PSR, 01/07/2026). The signal sits beneath it. The same evidence shows 30% of fraud by value and 69% by volume originates via online platforms (Bratby Law, 06/07/2026), where banks control nothing. Australia has put duties on platforms and telecoms, and the EU has drafted them. The reimbursement bill is looking for a second payer, and between now and 2029 treasury, payments and risk leaders should decide how much of it their own balance sheets will keep carrying.
Signal Identification
A regulatory pivot in progress. Liability for scams has moved from victims to payment firms in the UK. Three jurisdictions are now testing the next step, toward the platforms and networks that carry the scam. On the available evidence, only Australia has a second payer in force; the others have drafts, duties or intent.
What's Changing
UK banks have absorbed the scheme: 88% (£316m) of the money lost to APP scams has been reimbursed (PSR, 30/07/2026), and in-scope claims are reimbursed at 97% (PSR, 01/07/2026). Reimbursement rates range from 21% to 94% across payment firms (Bratby Law, 06/07/2026), and three firms saw materially larger cost increases, one equivalent to 2.6% of revenue (Grant Thornton, 21/09/2026). Meta platforms were linked to 54% of 2023 scam incidents and 18% of losses, while telecoms were linked to 12% of cases but 31.5% of losses (Grant Thornton, 21/09/2026).
Elsewhere the second payer is arriving. Under Australia's Scams Prevention Framework, fines of up to $50 million per contravention apply and the rules commence on 1 September 2026 (Dynamic Business, 02/07/2026). The EU package obliges electronic communications providers to prevent impersonation fraud, including manipulation of calling line identification, and very large platforms to verify regulated financial advertisers; both instruments apply 21 months after entry into force, subject to formal adoption (PwC, 30/04/2026).
Scams start outside the banks; the benefit of paying is smaller than it looks
Sources: Grant Thornton (21/09/2026), citing the PSR evaluation. Faded bars show the first measure; solid bars the second. Crypto exchange losses compare 2023 with 2025; the origin shares are 2023 data.
Disruption Pathway
Stage one, to 2027, is consultation: the PSR consults in December 2026 and sets revised directions in May 2027 (Bratby Law, 06/07/2026), including proposed reporting requirements covering the platforms and services fraudsters use (Grant Thornton, 21/09/2026). Stage two, 2027 to 2028, is allocation: Australia's proposed $3,000 automatic reimbursement threshold and AFCA complaint handling from 1 January 2027 (Dynamic Business, 02/07/2026) show how cost can be passed to origin. Stage three, from about 2028, is enforcement as EU duties on telecoms and platforms begin to apply (PwC, 30/04/2026).
Stress concentrates in three places: small payment firms facing revenue-scale swings; receiving banks, since liability is split 50/50 between sending and receiving institutions (Thomson Reuters Institute, 24/09/2026); and displacement, as international APP scams rose from £21m in 2023 to £60m in 2025 (Bratby Law, 06/07/2026). Two adaptations follow. Operationally, banks should record where each scam began so recourse claims are ready when a route to platforms exists. Financially, treasury should carry scam reimbursement as a recurring loss line with a range, not a one-off cost.
Why This Matters Now
Chief risk officers, heads of payments, general counsel and treasurers own this. A plan that treats reimbursement as a settled bank cost prices only the first payer. Victims' losses from financial scams reached approximately $20 billion in 2025, a 26% increase (Thomson Reuters Institute, 24/09/2026), and Australian losses totalled $2.18 billion (Dynamic Business, 02/07/2026), so the pool is growing. The evidence that platforms will pay is thinner than the evidence that banks do: Australia is in force, the EU texts await formal adoption, and the UK has no mechanism. Banks should model scam cost under three allocations (bank pays, shared, origin pays) and name the trigger at which spend moves from customer friction to recourse capability.
Decision-action posture for this signal: Prepare — allocation scenarios and evidence capture are justified now, but only one jurisdiction has a payer beyond banks in force.
Counter-Argument
The strongest objection is that banks will keep paying. Adjusted for slower-emerging scams and international displacement, the year-one net benefit is -£4m to £8m, not £17m to £29m (Grant Thornton, 21/09/2026), and the PSR cannot compel platforms or telecoms (Grant Thornton, 21/09/2026). The EU duties are prevention duties, not a reimbursement route, and formal adoption is still pending (PwC, 30/04/2026). Platforms can also argue that criminals, not hosts, cause the loss.
The weak net benefit supports the signal. Displacement shows that a bank-only duty leaks: losses to crypto exchanges rose from approximately £59m to £153m (Grant Thornton, 21/09/2026). This report's reading is that a duty confined to one sector pushes fraud to where no one pays, which is the argument regulators now use to widen the circle.
Implications
The shift looks durable in direction and uncertain in speed. Three jurisdictions have extended duties beyond payment firms, and the EU duties apply 21 months after entry into force (PwC, 30/04/2026). The inflection window runs from 2027 to 2029. Banks that can show where scams began, and platforms that verify advertisers early, stand to gain; small payment firms and banks in bank-only regimes stand to lose. On the available evidence, the duties differ in kind, fines in Australia and prevention in the EU, so none yet makes a platform reimburse a bank at scale.
Early Indicators to Monitor
- The PSR's December 2026 consultation proposes reporting requirements or a cost contribution for platforms or telecoms, not only consistency rules for payment firms.If this happens: The UK is moving toward origin-side accountability; weight the shared-cost scenario higher in loss provisioning.
- The PSR's revised directions in May 2027 name a non-PSP party as a contributor to reimbursement costs.If this happens: A second payer exists in UK law; the posture moves from Prepare to Decide on recourse capability.
- The EU payments package is formally adopted and published in the Official Journal before 31 March 2027.If this happens: The 21-month clock is running, so telecoms and platform duties get a fixed date; plan EU compliance work to it.
- Australia's final sector codes keep the proposed $3,000 automatic reimbursement threshold intact.If this happens: Origin-paid claims have a simple trigger in force; model comparable thresholds for other markets.
- AFCA scam complaint data after it begins handling complaints on 1 January 2027 show determinations against a platform or telecoms firm.If this happens: Non-bank firms are paying in practice, not only on paper; extend the allocation model beyond banks.
Disconfirming Signals
- The PSR's December 2026 consultation covers only consistency among payment firms, with no platform or telecoms measure.
- The PSR's May 2027 directions leave payment firms as the sole payers.
- EU adoption slips beyond 2027 or the electronic communications provider duty is removed from the final text.
- Australia drops the $3,000 automatic reimbursement threshold or defers sector codes past 2027.
- The platform share of UK fraud by value falls below 30% in the PSR's next published data.
Strategic Questions
- Should banks carry scam reimbursement as a recurring loss line now, or wait for the UK's May 2027 rules?
- Does evidence of where each scam began deserve funding before any route to platform recourse exists?
- At what mix of jurisdictions should a payments firm price scam liability by origin rather than by payer?
Keywords
Scam reimbursement; authorised push payment fraud; APP fraud; PSR evaluation; Australian scam prevention rules; EU Payment Services Regulation; impersonation fraud; shared liability; fraud displacement; platform and telecoms liability
Bibliography
Source tiers: Tier 1, governments, regulators and intergovernmental bodies. Tier 2, think-tanks, academic institutes, major consultancies and quality data providers. Tier 3, quality journalism and specialist trade press. Tier 4, vendor, company and practitioner sources, used only as directional corroboration.
- Tier 1 Payment fraud falls by £73m following PSR reimbursement scheme. PSR (01/07/2026).
- Tier 1 APP scams reimbursement dashboard for Q1 2026. PSR (30/07/2026).
- Tier 2 APP fraud reimbursement requirement: were industry's concerns justified?. Grant Thornton UK (21/09/2026).
- Tier 2 Deception in the AI Age 2026. Thomson Reuters Institute (24/09/2026).
- Tier 2 EU RegCORE client alert: the PSR and PSD3 move forward. PwC Germany (RegCORE) (30/04/2026).
- Tier 3 Banks, telcos and digital platforms are now legally accountable for scam prevention. Dynamic Business (02/07/2026).
- Tier 3 APP fraud reimbursement: the evaluation verdict. Bratby Law (06/07/2026).