UK: Action Fraud Reporting and the APP Fraud Reimbursement Rules Explained

If you're researching UK scam recovery, you may come across references to the "CRM Code" — it's important to know that this was replaced by a stronger, mandatory scheme in October 2024, so the rules have changed since many older articles were written.

Step 1: Report to Action Fraud

Action Fraud (actionfraud.police.uk) is the UK's national reporting centre for fraud and cybercrime. Reporting here is separate from, and in addition to, contacting your bank — it feeds into national crime data used by the National Fraud Intelligence Bureau to identify patterns and repeat offenders.

What changed: from the CRM Code to mandatory reimbursement

Until October 2024, UK banks that voluntarily signed up to the Contingent Reimbursement Model (CRM) Code committed to reimbursing victims of authorised push payment (APP) fraud under certain conditions — but it was voluntary, and not every bank participated, and payouts weren't always consistent.

On 7 October 2024, the CRM Code was retired and replaced by a statutory reimbursement scheme regulated by the Payment Systems Regulator (PSR). Under the new rules:

• Reimbursement is now mandatory for eligible APP fraud claims, not just for banks that opted in.
• Banks must generally reimburse victims within five business days of receiving a valid claim.
• Reimbursement is capped at £85,000 per claim, in line with the Financial Services Compensation Scheme limit.
• Claims must generally be submitted within 13 months of the last related payment.
• The cost is shared between the sending and receiving payment provider, rather than falling solely on the sending bank as under the old code.

What can still get a claim declined

Reimbursement isn't automatic in every case. Claims can be refused where the customer is found to have acted fraudulently themselves, or with what the scheme defines as gross negligence — for example, ignoring clear, specific warnings from your bank during the transaction. If your claim is declined and you disagree, the Financial Ombudsman Service can review individual disputes.

What to do practically

• Contact your bank's fraud team immediately if money has just been sent — before filing anything else, since speed still affects whether funds can be intercepted before withdrawal.
• File your Action Fraud report as soon as possible afterward.
• If your bank declines reimbursement and you believe the decision is wrong, escalate to the Financial Ombudsman Service.

For UK-specific guidance on what personal data companies hold on you and how to request it, see GDPR Explained: What You Can Actually Request. For the payment-method-specific steps — wire transfer, gift card, or crypto — see the complete international recovery guide. If you want to understand what personal data might have made a scam call or message convincing in the first place, a Scan My Shadow check covers your phone number and email.

Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.