Livia Firth's Battle Against APP Fraud Highlights Systemic Failures

When Livia Giuggioli Firth's sustainability consultancy fell victim to a payment scam in 2023, it took barely any time for the money to disappear. After criminals imitated a legitimate client's email address and inserted a fraudulent invoice into an existing email chain, an employee transferred £324,634 straight to the scammer's account.

Within days, the fraudsters had funnelled the money to a network of accomplices, breezing past a query from their bank, HSBC, over a six-figure sum arriving in an account with a balance of £2.62.

But when Firth realised what had happened, the fight to get her money back would be long and hard. According to filings in a civil claim she brought against the fraudsters, she only obtained the details of what they'd done after applying for a costly court disclosure order to override HSBC's customer confidentiality obligations.

It was the start of a gruelling process that, Firth says, swallowed 11 months and £100,000 in legal fees. Struggling to recover, and following an unrelated theft from the business, in 2024 she declared her company insolvent.

"There's the 'what the fuck' when you discover the fraud, the 'what the fuck' when you realise that the police are not going to do anything, the 'what the fuck' when you discover how the bank is going to behave," Firth says. "We basically got crippled by this system."

An HSBC UK spokesperson says, "We consider all cases on a case-by-case basis, based on the information available at the time."

Scams of this type — in which the victim is duped into authorising the transfer of their money as opposed to having their account compromised or card stolen — are known as "authorised push payment fraud", or APP fraud for short. According to UK Finance, a lobby group that represents banks and financial companies, in 2023, the most recent year for which there is complete data, APP fraud accounted for 40 per cent of all fraud losses in the UK, totalling £460 million.

Since the autumn, new regulations have made it mandatory for payment firms to reimburse customers up to £85,000 if they fell victim to APP fraud on or after October 7 2024. (Previously, a voluntary code led to wide discrepancies in reimbursal rates between banks.) The UK is the first country in the world to introduce a mandatory scheme like this.

However, Firth is one of more than a dozen fraud victims and experts the FT has spoken to who say that, while the new rules are welcome, the system is broken in many other ways. Cases that occurred before the new regulations came into force show victims being failed by multiple factors: police inaction, regulatory loopholes, and varying treatments of consumer rights by large financial institutions.

The rules offer guarantees of recompense in certain cases, but experts say they will not solve the problem of rising fraud. Banks have warned they may even encourage criminals to attempt to game the system by posing as victims themselves.

The impact on those affected can be profound. Individuals the FT spoke to were left with shattered livelihoods, relationships, and life savings. Most requested anonymity, anxious about being judged publicly for having been duped by scammers — a crime still often blamed on victims.

"Sometimes the battle to get your money back is as traumatic as being scammed," says Kathryn Westmore, a senior research fellow at the think-tank RUSI. "It's very difficult to navigate."

Adding to the challenge is the fact that the UK has become a hotspot for global fraud, thanks to its fast payment systems, sophisticated digital services, and the fact that English is a global language.

And the problem appears to be getting worse. According to Cifas, a fraud prevention association, fraud cases in the UK increased by 15 per cent in the first six months of 2024, compared to the same period the year before. UK Finance's data from 2023 previously showed a 12 per cent jump in APP fraud cases from 2022.

Artificial intelligence has added "rocket fuel" to the fire, says Westmore. Consumers are now being duped more easily than ever by cloned websites, deepfake videos, and messages impersonating banks or tax authorities.

Victims' groups, experts, and even police are looking to the new government to address what the chair of the City of London Police Authority Board, Tijs Broeke, has called a "fraud epidemic". Last summer, Lord David Hanson, a former Labour MP, was appointed a Home Office minister with special responsibility for fraud.

"There's been a political tolerance and a societal tolerance of fraud for so long," says Simon Miller, director of policy at Cifas. "If that recent political pressure goes away [because of the new bank compensation rules], there's a genuine concern that this will be it, and no more will happen."

Lord Hanson declined to be interviewed by the FT. In a statement, he said he was "deeply concerned about the current levels of APP fraud" and pledged to leave "no stone unturned".

Upon realising what had happened, Livia Firth called Action Fraud, the national reporting centre for cyber crime that sits within the City of London force. Action Fraud does not investigate cases itself, but passes reports to another police unit, the National Fraud Intelligence Bureau, which is responsible for cross-checking cases and passing them on to a local force where appropriate.

In the overwhelming majority of cases, victims are told no further action will be taken. Although fraud in the UK accounts for over 40 per cent of recorded crime in England and Wales, according to a 2023 parliamentary report, it only receives 1 per cent of police resources. The fact that most cases also involve an overseas element complicates investigations still further. Less than 2 per cent of reports received by Action Fraud annually lead to criminal charges or prosecution. (The comparison is an imperfect one, as frauds can take years to investigate.)

The Home Office and the City of London police are working to replace Action Fraud with a new reporting centre partly outsourced to Capita and PwC, which was originally meant to launch in 2024 but has been delayed to some time this year. For now, experts commonly — and only half-jokingly — refer to the organisation as "Inaction Fraud".

"It's just shocking that you can lose these huge sums of money and the police essentially say, 'Sorry, we can't do anything,'" says one woman in her late 30s, who runs an electric vehicle business.

Her company was drained of £85,000 last year when fraudsters purporting to be from Revolut tricked her business partner into handing over a login code.

The woman traced the payments to an east London address but received a "no further action" letter from Action Fraud without having been asked to share evidence, she says. This experience was echoed by six people the FT spoke to.

Firth, meanwhile, was eventually able to discover both the identity and address of the scammers who had taken her money: a network of car dealers and photographers in north London. Again, she was told the police were unable to do anything — something she found "shocking". "[The police] are legalising money laundering and fraud," she says.

Under the new rules, victims can expect to be reimbursed up to £85,000 by their bank within five days of reporting an APP fraud. If losses are above this amount, it is up to financial institutions whether to reimburse more, and whether to apply a £100 excess. (Individuals whose cases the FT reviewed lost between £27,500 and £850,000.) Consumers will not be entitled to a payout, however, if they are deemed to have been "grossly negligent". This carve-out and the £100 excess cannot be applied to customers deemed vulnerable.

The regulator defines gross negligence as "a significant degree of carelessness" — higher than the standard of negligence under common law. But it is still not clear exactly what behaviour would qualify.

"There are quite a lot of get-outs for the banks," says Westmore. "If you ignore five pop-up alerts, is that gross negligence?"

The Financial Ombudsman, an independent body, is tasked with arbitrating disputes between financial firms and customers, APP fraud cases among them.

But what counts as gross negligence in the new rules is still a grey area, says Westmore. "It will take several challenges to the financial ombudsman to define what is meant."

The new rules are also far from a catch-all. The UK payments regulator defines APP frauds as authorised transfers from one UK bank account to another. This means that some common scams — such as funds being transferred via a crypto wallet — are still not eligible for reimbursement, and are not even counted in UK Finance data.

"No one is thinking of this when they are making payments, 'Am I covered by this regulation if I do it this way?'," says William Ayles, co-founder of Refundee, an investigative company that helps victims recover funds. "From a consumer's perspective, it's so random."

Crypto scams now account for 37 per cent of Refundee's roughly 5,000 annual cases, Ayles says.

Other common scams that can fall through the cracks are investment frauds. In 2022, Will Collins, a 55-year-old former investment banker, filed a claim with his bank, First Direct, after a property investment scheme he put six figures into was revealed to be a fraud. The bank told Collins that this was a "civil dispute" — in effect an investment gone wrong — and did not count as APP fraud.

"There's often a fine line between fraud and highly complex financial situations," says Ayles. "But we've seen banks overly relying on that . . . We've had cases of criminals going to jail and the banks in some of those situations still call them 'civil disputes'.

In Collins' case, First Direct's decision also appears opposed to the view of the police. In a letter to the financial ombudsman seen by the FT, police solicitors describe the company Collins invested in as a "vehicle for fraudulent activity". In another, they tell Collins' lawyer it is "their firmly held belief that a crime has been committed and that your clients are victims."

Collins — who is challenging First Direct's decision — is particularly aggrieved because another investor who banks with First Direct received a payout under the APP fraud code, as did individuals who banked with Barclays. In evidence he submitted to the UK Treasury Committee in October, he provided examples of a number of cases where banks had categorised some claims as APP frauds and reimbursed victims, while denying other claims because they were "civil disputes".

"Banks are clearly conflicted. They had this voluntary [reimbursement] code that's now mandatory. Why on earth would they agree that a fraud is a fraud? So they fight it," Collins says. "Some [claims] slip under the net, but as soon as they realise it's a multi-hundred thousand-pound or million-dollar dispute, they'll immediately stop and call it a 'civil dispute'.

"First Direct said it considers "all cases on a case-by-case basis, based on the information available at the time." The financial ombudsman has also recently re-ruled that Collins' case was not an APP fraud.

Elsewhere, though, says Stevens, "we see banks changing their decision shortly after someone has submitted their claim to the ombudsman . . . It suggests that the bank hasn't made a very robust decision to start with."

Another individual the FT spoke to described a "torturous" year in which he waited for the ombudsman to eventually overturn his bank's decision not to reimburse a £40,000 scam.

For her part, Firth had the means to engage a lawyer: Dan Wyatt at RPC, who has built a specialism in this area. In January last year, HSBC reimbursed the full £324,634, but the bank stressed that the payment was "voluntary" and not an admission of wrongdoing. HSBC also said it is not liable for Firth's legal fees.

It was just another illustration of how opaque the system is, Firth says. "We are like, 'OK, thank you, but why — because you made a mistake? Because you suddenly recovered the money?' They never replied . . . Even when we received the money we were like, 'What the fuck, why now?'

Ben Donaldson, managing director at UK Finance, says: "The financial services sector does far more than any other to protect the public from fraud," adding that "the vast majority of fraud originates on social media and via telecommunications networks."

From April, the ombudsman will begin charging professional representatives such as lawyers and companies like Refundee £250 upfront for each case they represent, with a 70 per cent refund if they win — something intended to deter firms filing claims that lack merit.

But consumers' rights groups say the move erects yet another barrier. "When people are rebuffed, they trust their bank. They don't think to challenge it," says Wayne Stevens, head of fraud at Victim Support.

The effects of fraud can be devastating, and not just financially. The experience of being duped — particularly through frauds that involve long-term emotional manipulation — can be psychologically destructive. And because of the stigma attached to being a fraud victim, some feel unable to confide in friends or family.

According to Nik Adams, assistant commissioner at the City of London police, 300 people a year are referred to their local force immediately after reporting a scam because they "are at such risk to themselves of suicide or self-harm".

As well as increasing police resources, experts point to two key areas to tackle the crisis: cross-sector data sharing, and holding tech and telecommunications companies accountable for their role. The latter question of accountability — and liability for losses — has become a fraught debate between government, banks, and tech and telecommunications firms in jurisdictions around the world.

Singapore and Australia are often cited as setting an example. In 2023, Australia launched a national anti-scam centre to bring government, law enforcement, and the private sector together. The following year, key banks in Singapore established a shared data platform and the regulator made telecommunications firms liable for some losses.

"There's all this information out there at the moment [in the UK], but it's siloed," says Donaldson of UK Finance, adding, "We need the online services and telecommunications sectors to do even more with financial services and law enforcement."

In his statement to the FT, fraud minister Lord Hanson admitted that "a unified and co-ordinated response from government, law enforcement, and industry is required." He pointed to Labour's election manifesto last year, pledging a "new expanded fraud strategy", but did not provide any further details of what this will entail or when it will be announced.

Until then, victims like Firth are counting the cost. "We have been pushed to breaking point by institutions that seem unwilling and unable to pursue criminality," she says. "It leaves me asking why nobody holds these powerful institutions to account."