Unauthorised Payments From Your Account: The 13-Month Rule, Next-Day Refunds and When a Bank Can Refuse

When money leaves a bank account without the account holder’s consent, a specific set of rules applies, different from the rules on scams in which a person is tricked into making a payment. This article summarises the Financial Conduct Authority’s consumer guidance on fraudulent payments (last updated 15 May 2026) and the relevant sections of the Payment Services Regulations 2017, which the legislation.gov.uk site shows as up to date with all changes known to be in force on or before 21 September 2026. The regulations apply across the UK.

Unauthorised is not the same as authorised

The FCA draws a line. An unauthorised payment is one taken from an account without the account holder’s authorisation. An authorised payment is one the person made, even if they were tricked into it, such as an authorised push payment or bank transfer scam. The FCA says the rules and regulations differ between the two. For payments made by bank transfer on or after 7 October 2024, reimbursement rules set by the Payment Systems Regulator apply to Faster Payments and CHAPS, and this site’s guide to bank transfer scams covers them. The rest of this article concerns unauthorised payments.

Tell the bank quickly, and within 13 months

The FCA advises contacting the bank or payment provider immediately after noticing an unauthorised payment and asking for a refund. Regulation 74 of the 2017 Regulations gives the legal deadline: a payment service user is entitled to redress only if they notify the provider without undue delay, and in any event no later than 13 months after the debit date, on becoming aware of the unauthorised transaction. The FCA gives the same 13-month figure and says that otherwise a claim may not be possible.

The refund timetable

Regulation 76 says that where a payment was not authorised, the provider must refund the amount and, where applicable, restore the account to the state it would have been in without the payment. The refund must be made as soon as practicable, and no later than the end of the business day following the day on which the provider becomes aware of the unauthorised transaction. The FCA describes this as the refund being in the account by the end of the next business day, together with any charges and interest paid, or credit interest lost, because of the payment. The FCA also says the bank may ask questions or ask for a form to be completed, but this should not delay the refund.

Who has to prove what

Under regulation 75, where a customer denies authorising a payment, it is for the payment provider to prove that the transaction was authenticated, accurately recorded, entered in its accounts and not affected by a technical breakdown or other deficiency. The regulation also says that the use of a payment instrument recorded by the provider is not, in itself, necessarily sufficient to prove that the payment was authorised or that the payer acted fraudulently or with intent or gross negligence. The FCA echoes this, saying the use of a password, card or PIN might not on its own be proof that a payment was authorised.

The GBP 35 limit and when a customer can be liable

Regulation 77(1) allows a provider that is liable under regulation 76 to require the payer to bear losses of up to a maximum of £35 from the use of a lost or stolen payment instrument or its misappropriation. The FCA gives the same figure and says a person whose card was lost or stolen and who did not report it may have to pay up to £35, but not if it was impossible to detect the loss or theft or if the bank was at fault. The regulation lists further points:

the £35 limit does not apply if the loss, theft or misappropriation was not detectable before the payment (unless the payer acted fraudulently), or if the loss was caused by acts or omissions of the provider’s staff, agents or branch;
the payer is liable for all losses if they acted fraudulently, or with intent or gross negligence failed to comply with the duties in regulation 72 on payment instruments and security credentials;
except where the payer acted fraudulently, the payer is not liable for losses arising after they notified the provider, where the provider failed to provide appropriate means of notification, where strong customer authentication was required but not applied by the provider, or where the instrument was used in connection with a distance contract (subject to exceptions).

When the bank can refuse

The FCA states that in an unauthorised payment claim a bank can refuse a refund only if the customer authorised the payment, acted fraudulently, or failed to protect the details of their card, PIN or password in a way that allowed the payment. For credit card payments and overdrawn accounts, the FCA says the bank can refuse only if the customer, or someone acting on their behalf, authorised the payment, or the person who used the card, including a virtual card, had it with the customer’s consent. It warns that deliberately making a false claim for a refund is fraud and may be reported to the police.

If the bank says no

The FCA says a customer who disagrees with a refusal can complain and, if unresolved, refer the complaint to the Financial Ombudsman Service. Where a customer has been scammed, the FCA advises keeping records of all contact with the scammer, contacting the bank immediately, contacting the police on 101 and reporting to Report Fraud on 0300 123 2040. In Scotland, it says to report to Police Scotland on 101 or contact Advice Direct Scotland on 0808 164 6000.

The bottom line

For payments made without consent, UK rules put the burden on the provider to prove the transaction was authorised and, as a general rule, to refund by the end of the next business day. Customers should notify the bank without undue delay and always within 13 months, expect to bear at most £35 in some lost or stolen card cases, and be aware that gross negligence with security details can shift liability. Payments a person was tricked into making fall under different rules.