Last reviewed June 2026. Laws and bank schemes change — always confirm with the linked authority or your bank before acting. This is general information, not legal advice.
How to claim a refund after a scam — in any country
The exact rights differ by country, but the order of operations is the same everywhere. Speed is the single biggest factor.
The one distinction that decides everything
Unauthorised fraud — a stolen card, an account takeover, a payment you never made — is broadly refundable, usually with a small liability cap. Authorised fraud (APP fraud) — where a scammer manipulates you into sending the money yourself — is treated as a valid instruction, and in most countries isn't automatically refunded. The UK changed that in October 2024; most of the world hasn't. If you remember one thing: the word the bank applies to your payment, authorised or unauthorised, usually decides whether you ever see the money again.
What's changing in 2026
The map above is not frozen, and two separate EU instruments are often run together — including, until we corrected this page, by us. "Verification of Payee" — the name-and-IBAN check that warns you before a transfer goes through — is already law and already live. It comes from the Instant Payments Regulation (EU) 2024/886, whose Article 5c obliges your bank to check the payee's name against the account number, tell you when they do not match, and do it free of charge. Banks in euro-area countries have had to comply since 9 October 2025; banks in EU countries outside the euro have until 9 July 2027. That single split is where the confusion comes from: both dates are real, and they apply to different countries.
The Payment Services Regulation (PSR / "PSD3") is the separate, later package, on which the European Parliament and Council reached a provisional agreement in November 2025. What it would add is the part that matters for this index: a refund right for impersonation ("spoofing") fraud, where a criminal poses as your own bank's staff. It is not blanket APP cover — romance and investment scams would not be automatically reimbursed — and it is not yet in force, with realistic application around 2027 after a transition period. If it lands as agreed it would move much of Europe from "weak" toward "partial." Verification of Payee is a warning at the moment of payment; it does not, on its own, give you a right to your money back afterwards.
Two cautionary notes for 2026. Singapore's Shared Responsibility Framework (live since December 2024) sounds like reimbursement but explicitly excludes the classic con — it pays out only for narrow digital-phishing breaches, not the investment or romance scams most victims actually face. Australia's Scams Prevention Framework (in force from 2025) is prevention-led, with penalties up to A$50 million for firms that fail their duties, but it carries no automatic reimbursement — a proposed A$3,000 auto-refund threshold remains just a proposal. And the UK kept its mandate but capped it at £85,000 per claim (down from an originally proposed £415,000) — a level the regulator says still covers the value of roughly nine in ten claims. The direction of travel is toward more protection; the pace is slow, and the gap between a scheme's name and what it actually pays remains the thing to read carefully.
How this index is built
The ranking rests on a single factual question, applied identically to all 27 countries: does national law force a bank to refund an authorised scam payment — one you were deceived into sending yourself (authorised push-payment, or APP, fraud)? We deliberately don't score sub-factors or invent a composite number; the reality is close to binary, and a tier is more honest than false precision.
Each country sits in one of three tiers — Strong (a law mandates reimbursement for the con), Partial (a scheme or court ruling covers some deception, or reimbursement is case-by-case), Weak (only unauthorised transactions are refunded). Every row is aggregated from our own country-by-country guide for that market, and each links out to the primary authority behind the verdict — the regulator, statutory banking code, or court ruling — so the claim can be checked at source. Figures appear only where a named authority publishes them; where a number couldn't be verified, we state the position in words rather than invent a statistic.
The data was last reviewed June 2026 and is re-checked as laws change (the EU's PSR / "PSD3" and several national schemes are in motion — see above). It is compiled by Tutela Digitalis, an independent fraud-education resource with no bank or industry funding.
For journalists
This index is free to cite, and the two graphics above are free to republish, with credit (CC BY 4.0). The one-line finding: of 27 countries, only the United Kingdom legally requires banks to refund victims of authorised (deception) scams — everywhere else the law refunds the hack, not the con.
The dataset is archived with a permanent DOI, so it stays citable and resolvable independently of this site: 10.5281/zenodo.21454098 (CSV + JSON + methodology, 1.0.0).
Suggested citation: Tutela Digitalis (2026). The Tutela Digitalis Scam-Refund Index (Version 1.0.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.21454098
Need the underlying country-by-country data, an updated figure, or a quote? Email press@tuteladigitalis.com.
Go deeper
The country-by-country detail behind this index:
Common questions
Which countries make banks refund scam victims?
Of the 27 countries in this index, the United Kingdom is the only one that legally MANDATES reimbursement for authorised push-payment (APP) scams — money you were tricked into sending yourself — up to £85,000, under the PSR rule in force since 7 October 2024. Three are 'partial': the Netherlands (a voluntary scheme reimburses bank-impersonation/spoofing fraud), New Zealand (a voluntary banking code, in force since November 2025, allows discretionary reimbursement), and Belgium (courts have ordered banks to refund phishing victims). Every other country covers only UNAUTHORISED transactions (where someone took your money without permission); a transfer you authorised under deception usually isn't refunded.
Does my bank have to refund a scam I authorised myself?
In almost every country, no. The dividing line is 'authorised' vs 'unauthorised.' If someone accessed your account or used your card without permission, that's unauthorised and your bank generally must refund it (often with a small liability cap like €50 or $50). But if you were deceived into approving the payment yourself, that counts as authorised — and outside the UK (and, in narrower ways, the Netherlands, New Zealand and Belgium), no law forces the bank to give it back. That single word decides most scam-refund outcomes.
Why does the UK refund scams when other countries don't?
Since 7 October 2024 the UK's Payment Systems Regulator (PSR) has required banks to reimburse victims of authorised push-payment fraud, up to £85,000 per claim, with the cost split between the sending and receiving banks. No other country in this index has an equivalent mandatory rule yet — the EU's PSD2 still only covers unauthorised transactions, and proposals under PSD3/PSR would cover only narrow cases like bank-impersonation.
What's the difference between authorised and unauthorised fraud?
Unauthorised fraud is when a payment leaves your account without your permission — a stolen card, account takeover, or a transaction you never made; this is broadly refundable. Authorised fraud (also called APP fraud, or 'the con') is when a scammer manipulates you into sending the money yourself — a fake bank call, a romance scam, a bogus invoice. Because you pressed send, banks classify it as a valid instruction, and in most countries it is not automatically refunded.
How is the protection ranking decided?
It's built on a single factual axis: does the law force a refund for an authorised (deception) scam payment? 'Strong' means a mandate exists (the UK). 'Partial' means a scheme or court ruling covers some deception, or reimbursement is case-by-case (the Netherlands, New Zealand, Belgium). 'Weak' means only unauthorised transactions are covered. We use tiers rather than invented scores, every row links the authority and our detailed country guide, and the data is reviewed periodically (last reviewed June 2026).
Scammed, and not sure what you're owed? Send us the details.
A real expert reviews every case and replies within 24 hours — what to say to your bank, which body to escalate to, what's realistic. Free, confidential, no pressure.