APP Fraud & Mandatory Reimbursement
APP signal
reimbursement
mentions
UK Mandatory Reimbursement Regime — Reference Model
APP Fraud Liability Framework and Mandatory Reimbursement
The UK's Payment Systems Regulator (PSR) introduced a mandatory reimbursement requirement for authorised push payment (APP) fraud effective 7 October 2024 (PS24/5). The requirement applies to Faster Payments and CHAPS rails; a cap of £85,000 per claim was initially set (reduced from the proposed £415,000 following industry consultation). Liability is split 50/50 between the sending and receiving firm in the default model; banks and payment service providers are required to reimburse victims within 5 business days unless the consumer acted with gross negligence or under an exception. Claim volumes rose materially in Q4 2024 following the go-live date; the PSR's annual APP fraud report (2024 data) showed £459.7m in APP losses in H1 2024, with reimbursement rates improving from 62% to an anticipated higher level post-mandatory-regime. Cross-JID comparison: the UK's mandatory reimbursement model is the most prescriptive globally; EU PSD3 / PSR proposals reference the UK approach as a comparator. No numeric fraud score is assigned; all data is sourced verbatim from PSR publications.
APP Fraud Liability Framework and Mandatory Reimbursement
The UK's Payment Systems Regulator (PSR) introduced a mandatory reimbursement requirement for authorised push payment (APP) fraud effective 7 October 2024 (PS24/5). The requirement applies to Faster Payments and CHAPS rails; a cap of £85,000 per claim was initially set (reduced from the proposed £415,000 following industry consultation). Liability is split 50/50 between the sending and receiving firm in the default model; banks and payme
Consumer Protection & APP Fraud
Sanadak, established in 2023 and operational since 2024 as the first independent financial and insurance ombudsman in the MENA region, resolves consumer complaints against licensed institutions free of charge, though consumers must first complain to the institution and wait 15 calendar days before escalating. No UK-style statutory mandatory reimbursement regime for authorised push payment fraud exists, so redress for digital-payment fraud remains case-by-case, with the burden on the i
Consumer Protection & APP Fraud
Consumer-protection and APP-fraud liability is a fast-escalating frontier in an under-indexed emerging market. The Central Bank of Nigeria is drafting APP-fraud rules establishing structured reimbursement mechanisms, strict investigative timelines and Board-level fraud oversight, shifting liability for user-authorised scams across Nigeria's payment system. Mandatory APP-fraud reimbursement would impose UK-PSR-style liability on Nigerian PSPs — a material conduct cost for both bank and
Consumer Protection & APP Fraud
Singapore's Shared Responsibility Framework went live on 16 December 2024, following an October 2023 consultation. It assigns banks and telcos duties to mitigate phishing scams using a 'waterfall' accountability model, with mandatory consumer compensation where duties are breached but no fines. Banks must send outgoing transaction alerts and telcos must implement SMS Sender ID controls; the framework covers phishing scams with a digital and Singapore territorial nexus and excludes cor
Consumer Protection & APP Fraud
Argentina's consumer-protection regime allocates fraud liability without a statutory reimbursement mandate. Financial consumer protection rests on BCRA user-protection rules plus Consumer Protection Law 24,240 and the Civil and Commercial Code. There is no UK-style statutory APP-fraud mandatory reimbursement scheme, but the BCRA assigned credit/debit-card payment fraud liability to the interoperable-wallet provider in defined cases, set maximum commissions, and requires banks to reimb
Consumer Protection & APP Fraud
Austrian consumer protection in payments is structurally split between collective and individual redress. The FMA cannot obtain individual redress for complainants; it refers them instead to alternative-dispute-resolution bodies such as the Joint Conciliation Board and the customer ombud, and acts only for collective consumer protection. Fraud prevention has been strengthened at the EU level: Verification of Payee became mandatory under the Instant Payments Regulation for SEPA credit
Consumer Protection & APP Fraud
The Scams Prevention Framework, established under Part IVF of the Competition and Consumer Act 2010 via the Scams Prevention Framework Act 2025 and commenced 21 February 2025, is a principles-based, whole-of-ecosystem regime - govern, prevent, detect, disrupt, respond, report - applying first to banks (regulated by ASIC), telecommunications carriers (ACMA) and digital platforms (ACCC), with civil penalties reaching A$50 million per contravention. Unlike the UK Payment Systems Regulato
Consumer Protection & APP Fraud
Bangladesh Bank's Customer Interest Protection Centre provides a formal consumer-complaint escalation path from provider complaint cells to Bangladesh Bank Head Office; no UK/PSR-style mandatory authorised-push-payment fraud reimbursement regime is in force. MFS users suffer an estimated 9.3% fraud victimisation rate averaging Tk 9,000 loss per victim, driven by PIN-compromise scams, fake apps, and the SikkahBot malware campaign intercepting one-time passwords.
Outlook
Absent a m
Consumer Protection & APP Fraud
A 19 March 2026 Brussels Commercial Court ruling ordered a bank to reimburse EUR40,960.56 to a business owner victimised by cyber fraud, confirming that Belgium's 'reimburse-first, litigate-later' protection under Articles VII.43-VII.44 of the Code of Economic Law extends into a business-to-business context, not merely retail. The underlying regime otherwise carries a EUR50 liability cap for lost or stolen payment instruments.
Outlook
The March 2026 ruling strengthens reimburseme
Consumer Protection & APP Fraud
IBAN-spoofing fraud losses in Bulgaria exceeded EUR 16 million in 2024, with the largest single case reaching USD 10 million; BORICA launched a Verification of Payee ('Recipient Verification') service from October 2025 under EU Regulation (EU) 2024/886. The Commission for Consumer Protection (CCP/KZP) administers the Consumer Protection Law and ten sectoral laws, handling complaints, inspections and sanctions across the domestic market, including financial-services complaints escalate
Consumer Protection & APP Fraud
Brazil's consumer-redress regime for instant payments centres on the Pix Special Return Mechanism (MED), introduced in November 2021, which provides an 80-day registration period, 7-day review and full or partial refund. The regime is being upgraded substantially. MED 2.0, under BCB Resolution 493/2025, traces and blocks funds across cascading account hops; it became optional on 23 November 2025 and mandatory on 2 February 2026, with a sanctioning grace period to 10 May 2026 under Res
Consumer Protection & APP Fraud
A material consumer-protection gap persists relative to the UK model. Canada has no nationwide statutory APP-fraud reimbursement regime equivalent to the UK PSR mandatory reimbursement; Interac e-Transfer is explicitly not covered by zero liability; credit-card liability is capped at $50 under Bank Act s.627.33; the voluntary EFT Code of Practice is the enforceable floor; and OBSI has been the sole external complaints body for all banks since November 1, 2024. The cited contrast is th
Consumer Protection & APP Fraud
Bill C-15 Fraud Regulations, scheduled to come into force July 1, 2027, will require banks to detect and prevent consumer-targeted fraud, obtain express consent before enabling e-Transfer, wire or global money transfer capabilities on personal accounts, and report fraud data annually to the Financial Consumer Agency of Canada. The regulations do not change existing liability allocation: Interac's e-Transfer reimbursement policy remains discretionary rather than a guarantee.
Outloo
Consumer Protection & APP Fraud
Bank Act amendments require banks to obtain express consumer consent before enabling e-Transfer or wire capabilities, allow consumers to disable such capabilities or adjust limits, and mandate fraud-data reporting to the FCAC. The federal government launched consultations on Canada's first-ever National Anti-Fraud Strategy on March 30, 2026; Canadians lost over $704 million to fraud in 2025 per the Canadian Anti-Fraud Centre.
Outlook
No binding authorised-push-payment fraud reimb
Consumer Protection & APP Fraud
The Ombudsman for Banking Services and Investments became the sole external complaints body for federally regulated banks on November 1, 2024; its recommendations, while capped at $350,000, remain non-binding on banks, and fraud complaints to OBSI nearly doubled year-on-year to 1,815 cases in 2025. New Financial Consumer Protection Framework Regulations capped non-sufficient-funds fees at $10, effective March 12, 2026, a change of particular relevance as pre-authorized debits increasi
Consumer Protection & APP Fraud
Quebec's Bill 72, amending sections 65.1-65.2 of the Consumer Protection Act, passed unanimously by the National Assembly on November 7, 2024, and limits consumer liability for unauthorized and certain authorized deposit-account fraud in a manner parallel to existing credit-card protections. No equivalent to the United Kingdom's mandatory APP-fraud reimbursement regime exists federally or in Quebec. The Ombudsman for Banking Services and Investments (OBSI) became the sole national ext
Consumer Protection & APP Fraud
Switzerland has no EU/UK-style mandatory APP-fraud reimbursement regime. Consumer protection rests on FinSA conduct and disclosure duties, contract and banking law, and AMLA onboarding controls. Card fraud is mitigated mainly via near-universal 3D Secure — around 84% of card payments were contactless in 2024 — and OTP, with fraud rates below many European peers, though online card fraud and TWINT phishing remain live risks. Redress flows through bank complaint channels, the general Sw
Consumer Protection & APP Fraud
Financial consumer protection in Côte d'Ivoire is a BCEAO competence spanning banks, microfinance institutions and e-money issuers, supplemented by national consumer-protection, telecom and data law. Instruction n°04/06/2014 mandates a list of free banking services. The country is establishing a national Observatoire with a consumer-complaint channel, with World Bank assistance. Crucially, there is no UK-style mandatory APP-fraud reimbursement regime; fraud mitigation rests on KYC, 3D
Consumer Protection & APP Fraud
Chile's card-fraud reimbursement regime is the local analogue to the international authorised-push-payment fraud debate, combining a fast statutory refund with a recent tightening against customer-side abuse. Ley 20.009 requires a fraud victim to be refunded or have unrecognised transactions cancelled within 5 working days for claims at or below 35 UF; Ley 21.673 (May 2024) strengthened banks' ability to contest 'autofraude' and placed more responsibility on customers through a sworn
Consumer Protection & APP Fraud
Cameroon's consumer-protection infrastructure for payments is incident-handling rather than reimbursement-based. Instruction No 001/GR/2021 (9 February 2021) defines the operating modalities of the Central Payment Incident Unit, CEMAC's regional payment-incident-handling infrastructure, operating alongside Regulation 01/20/CEMAC/UMAC/COBAC's consumer-protection baseline. There is no CEMAC or Cameroon-specific mandatory APP-fraud reimbursement scheme equivalent to the UK's PSR regime.
Consumer Protection & APP Fraud
Consumer protection in payments runs through Ley 1328 de 2009, the SFC's SAC, per-entity Defensores and the jurisdictional Accion de Proteccion al Consumidor Financiero (maximum one year, extendable six months). Critically, there is no dedicated mandatory APP-fraud reimbursement regime equivalent to the UK PSR model. The SFC launched 'Protegete de los fraudes' on 11 June 2026, an education and disclosure approach. The absence of mandatory reimbursement shifts instant-payment fraud los
Consumer Protection & APP Fraud
A SIM-recycling scam known as "Sinpe mediante comando PASE" and a newly prevalent WhatsApp verification-code takeover scam are driving fraud growth: 25,498 fraud complaints were recorded between 1 January 2025 and 30 March 2026, with reported instant-transfer fraud losses near ₡3 billion, up about 88% year-on-year. Financial consumer protection rules derive from the Law on the Promotion of Competition and Effective Consumer Defense and National Consumer Commission provisions, which ap
Consumer Protection & APP Fraud
Consumer protection rests on PSD2-derived conduct rules and EBA consumer-protection guidance adopted by the CBC. The Financial Ombudsman, under Law 84(I)/2010, handles complaints against banks, PIs/EMIs and other financial institutions up to EUR 250,000, with a EUR 20 fee and decisions binding only if accepted by both parties. For instant-payment fraud, the EU Instant Payments Regulation's mandatory Verification of Payee is the principal APP and misdirection control. Critically, Cypru
Consumer Protection & APP Fraud
The Czech Republic has no standalone domestic regime mandating reimbursement for authorised-push-payment fraud victims. That gap is expected to narrow only once the EU-level PSD3/Payment Services Regulation package, politically agreed in November 2025 to introduce harmonised online-fraud protections and platform liability, is formally adopted -- a date not yet confirmed in available sourcing. In the meantime, the Ministry of Industry and Trade routes consumer complaints about unfair p
Consumer Protection & APP Fraud
German consumer protection rests on PSD2 (via ZAG and BGB §§675c ff.) and the UWG: unauthorised payments are refundable within one bank working day, and payer card liability is capped at EUR 50. APP/authorised-push-payment fraud has no general mandatory reimbursement regime, unlike the UK PSR model; the PSR/PSD3 deal concluded 27 November 2025 introduces only a narrow reimbursement duty limited to PSP-impersonation (spoofing) fraud, leaving most investment and pig-butchering scams out
Consumer Protection & APP Fraud
Danish payers are entitled to immediate refund for unauthorised payment transactions under the Payment Services and Electronic Money Act, absent indications of payer fraud, with MitID authentication and 3D Secure serving as core fraud-mitigation layers. The Global Anti-Scam Alliance's State of Scams in Denmark report found nearly half of Danish adults reported falling victim to a scam in the prior 12 months, with combined estimated losses of DKK 6.9 billion, roughly $1 billion, drivin
Consumer Protection & APP Fraud
General consumer protection in the Dominican Republic runs through Law No. 358-05, enforced by Pro Consumidor, which has authority to receive complaints, investigate, mediate, sanction non-compliant businesses, and promote consumer education. This general consumer-law baseline sits alongside, and is complemented by, the sector-specific ProUsuario regime discussed in W1b.
On Authorised Push Payment (APP) fraud specifically, no Dominican Republic-specific mandatory-reimbursement scheme
Consumer Protection & APP Fraud
Algeria's consumer-protection framework for electronic commerce rests on E-Commerce Law No. 05/18 (10 May 2018), which establishes legal mechanisms protecting electronic consumers throughout the contractual lifecycle, including the right to demand contract annulment for defect of consent. This operates alongside Law 09-03, as amended by Law 18-09, on consumer protection and fraud suppression more broadly.
No dedicated statutory scheme for authorised-push-payment fraud reimbursement w
Consumer Protection & APP Fraud
COSEDE deposit insurance covers up to USD 32,000 per depositor for banks, mutualistas and segment-1 cooperatives, tiered down to USD 11,250 for segment 2, USD 5,000 for segment 3 and USD 1,000 for segments 4 and 5. A 3 April 2026 Junta de Política y Regulación Financiera y Monetaria resolution changed COSEDE's liquidation priority so insured depositors are first transferred to a healthy financial entity rather than waiting for direct insurance payout, a change tested during the Q1 202
Consumer Protection & APP Fraud
Estonia recorded 18,300 card-fraud incidents in 2023, with EUR2.6 million lost and a fraud rate of 4 per 100,000 transactions — below the EU average of 15 — alongside 5,800 fraudulent payment-order transactions totalling EUR10.6 million, a figure comparatively worse than card fraud relative to EU peers. The EU's PSR/PSD3 reform reached provisional political agreement in late 2025, mandating PSP reimbursement for impersonation-fraud victims and platform liability for fraud originating
Consumer Protection & APP Fraud
EEA consumer-fraud liability is converging on an impersonation-focused model. Article 59 of the PSR introduces a compensation model obliging PSPs and electronic communications service providers to fully reimburse a consumer victim of impersonation ('spoofing') fraud for the full fraudulent amount; online platforms become liable to reimbursing PSPs if informed of fraudulent content and failing to remove it, building on the Digital Services Act. The analytically important point is that
Consumer Protection & APP Fraud
Consumer protection in Egyptian payments rests on the February 2019 Consumer Protection Instructions and Articles 216-220 of Law 194/2020. Banks must give a complaint reference number within two working days, respond within 15 business days, and report complaints quarterly to the CBE within 30 days of quarter-end; customers may escalate to the CBE only after exhausting bank-level responses. Notably, there is no UK-style APP-fraud mandatory reimbursement regime—a significant contrast w
Consumer Protection & APP Fraud
Finland has no UK-style mandatory APP-fraud reimbursement rule: banks must refund unauthorised payment transactions, with liability capped absent gross negligence, but are not required to refund authorised transfers where the customer was deceived into authorising the transaction. FIN-FSA observed increasing variations of scams during 2024 and issued more penalty payments than before, prompting it to flag payment fraud and scam-related consumer harm as a standing supervisory priority
Consumer Protection & APP Fraud
Where a transaction is recognised as unauthorised, the payer is usually entitled to immediate reimbursement, no later than the end of the first business day after dispute, subject to refusal only for user fraud or, in limited cases, gross negligence; the OSMP recommends strong authentication when accessing online banking from a new terminal, and ACPR Recommendation 2024-R-02 (2 July 2024) governs complaint-handling. These reimbursement obligations and the gross-negligence carve-out de
Consumer Protection & APP Fraud
Ghana's consumer-protection and redress regime is structured around BoG's Investigation and Consumer Reporting Office (ICRO), complaints procedures, the Consumer Recourse Mechanism Guideline (2017) and Disclosure/Transparency guidelines, with PSPs (DEMIs and EPSPs) serving as the first level of redress. There is no UK-style mandatory APP-fraud reimbursement regime — a structural contrast to the UK PSR approach that applies across bank and non-bank participants.
The fraud picture is d
Consumer Protection & APP Fraud
Gibraltar's consumer-protection position carries a material divergence from the UK. Under the Financial Services (Payment Services) Regulations 2020, Gibraltar PSPs are only required to reimburse consumers for 'unauthorised' payments. Because authorised push payment (APP) fraud involves the victim authorising the payment, such transactions fall outside the regulations and victims are not guaranteed reimbursement — a material divergence from the UK PSR mandatory reimbursement regime in
Consumer Protection & APP Fraud
Hong Kong lacks a single statutory scam or APP-fraud reimbursement regime, unlike the UK PSR's mandatory reimbursement or Singapore's SRF, and this absence is confirmed rather than a silent omission. Protection relies on HKMA-led, largely non-statutory measures: the Suspicious Account Alert (FPS proxy plus account-number, launched November 2023 and expanded August 2024), Police Scameter/Scameter+, the Anti-Scam Consumer Protection Charter (3.0 launched 9 July 2025), mandatory app-base
Consumer Protection & APP Fraud
MAS and IMDA implemented the Shared Responsibility Framework (SRF) for phishing scams on 16 December 2024, assigning FIs and telcos anti-scam duties and requiring payouts to victims under a 'waterfall' liability approach — FI first, then telco, then consumer. Investigations must complete within 21 business days for straightforward cases or 45 for complex ones, with recourse via FIDReC or the courts. Revised E-Payments User Protection Guidelines took effect on the same date. A fraud-su
Consumer Protection & APP Fraud
Ireland's approach to authorised push payment fraud diverges sharply from the UK. Ireland has no mandatory reimbursement scheme, unlike the UK, where the PSR introduced mandatory APP reimbursement from 7 October 2024; APP losses of around EUR 9.9m in 2022 are addressed via CBI Consumer Protection Outlook expectations and a whole-of-system National Payments Strategy approach, with a legislated shared fraud database to be developed by BPFI and the Department of Justice to legislate, and
Consumer Protection & APP Fraud
The Isle of Man Financial Services Ombudsman Scheme, established 2002, can award up to GBP 150,000 for defined financial loss against Isle of Man-based suppliers, plus small sums for distress and inconvenience, subject to a six-year time limit on bringing complaints -- a redress ceiling materially lower than the UK Financial Ombudsman Service in absolute terms. Any money or assets provided to a virtual currency business is not covered by any compensation scheme and is not subject to p
Consumer Protection & APP Fraud
India's APP-fraud compensation framework is moving toward an imminent effective date. Draft Third Amendment Directions 2026 (Responsible Business Conduct), proposed 6 March 2026 and effective 1 July 2026, provide that a customer suffering genuine fraud loss up to INR50,000 may receive 85% of net loss or up to INR25,000, whichever is lower, once per lifetime, for transactions on or after 1 July 2026 at commercial banks — excluding small finance banks, payments banks, RRBs and local are
Consumer Protection & APP Fraud
No mandatory authorised-push-payment fraud reimbursement rule comparable to the UK's Payment Systems Regulator regime was identified in Central Bank of Iceland, Financial Supervisory Authority, or Consumer Agency material; redress instead relies on general consumer law together with European Consumer Centres Network support for cross-border disputes. This is treated as a genuine, confirmed regulatory gap rather than a research coverage failure, following a direct and specific search o
Consumer Protection & APP Fraud
Consumer liability for unauthorised payments under the PSD2-derived regime is capped at EUR50, but no automatic reimbursement scheme exists for authorised push-payment fraud in Italy; recovery instead depends on bank goodwill, fund recall, Arbitro Bancario Finanziario escalation, or criminal reporting. The absence of a mandatory APP-fraud reimbursement scheme, unlike the UK's PSR-style model, is a structural consumer-protection gap relevant to future PSD3 debate.
Outlook
This rem
Consumer Protection & APP Fraud
Japan has no single APP-fraud mandatory-reimbursement scheme equivalent to the UK PSR model. Redress runs through the Act on Damage Recovery Benefit Distributed from Funds in Bank Accounts Used for Crimes (2008), under which crime-linked account funds are frozen and distributed to victims pro-rata. The Consumer Affairs Agency and National Consumer Affairs Center (hotline 188) handle complaints. Combined special-fraud, romance and social-media investment scam losses reached a record JP
Consumer Protection & APP Fraud
The forward-looking consumer-protection signal is the CBK's plan, developed under the Kenya National Financial Inclusion Strategy 2025-2028 with the Competition Authority, to establish formal compensation rules for e-money and digital-wallet fraud. It is committed for implementation by end-2026 and would add digital complaint systems, pricing transparency and provider capacity-building. Crucially, no UK-PSR-style mandatory APP-fraud reimbursement regime is in force yet — this is a pen
Consumer Protection & APP Fraud
Cambodia's consumer-protection architecture layers the National Bank's Prakas on Resolution of Consumer Complaints, the 2019 Consumer Protection Law, the 2019 E-commerce Law's liability-shift rules for lost or stolen payment instruments, and the 2021 tiered-KYC transaction-limit circular into a reasonably comprehensive framework on paper. That framework sits in sharp tension with enforcement reality in the scam-compound context: Amnesty International's June 2026 report found that none
Consumer Protection & APP Fraud
Korea's APP-fraud (voice-phishing) regime rests on the 2011 Telecommunications Fraud Refund Act, enforced by the FSS via account-freeze and 'extinguishment of claims' reimbursement from frozen funds, with institutions liable where they failed identity-verification duties. Voluntary bank compensation is low — about 10% of reported cases in 2025, 18 of 92 reviewed — and losses were projected to top KRW 1tn in 2025. The current negligence-based standard yields very low reimbursement, whi
Consumer Protection & APP Fraud
Kazakhstan's consumer-protection framework is consolidating around a single forthcoming institution. The pending Unified Financial Ombudsman will replace separate banking, insurance and microfinance ombudsman mechanisms with a three-tier complaints system - institution, then ombudsman, then the Agency - covering the full range of financial-services complaints rather than sector-specific channels. This sits alongside a broader package of anti-fraud consumer measures, including biometri
Consumer Protection & APP Fraud
Consumer-protection redress in Laos runs through Decree 225/GOV (2020, with an updated translation uploaded January 2026), which requires financial service providers to update consumers every 15 days on unresolved complaints, escalating unresolved matters first to BOL and then to the Economic Dispute Resolution Center or the Lao People's Courts. No authorised-push-payment fraud mandatory-reimbursement scheme exists in Laos comparable to the UK Payment Systems Regulator's model; redres
Consumer Protection & APP Fraud
Brazil's MED refund channel is LATAM's flagship instant-rail consumer-redress regime. Created in 2021, the Mecanismo Especial de Devolução operates as follows: on trigger, funds are blocked at the recipient institution, both banks have around seven days to review, refunds occur within roughly 11 days, and claims can be raised up to 80 days after the transfer. Resolution 589 mandated self-service in-app MED by October 2025, and Resolution 493 added in-app appeals. MED 2.0, arriving aro
Consumer Protection & APP Fraud
Liechtenstein's consumer-protection framework for payments rests on general civil-law instruments rather than a payments-specific statute: the ABGB's warranty rules, the KSchG's 14-day distance-selling withdrawal right, and UWG unfair-competition law, together with FMA supervision. Dispute resolution runs through the extrajudicial conciliation board domestically and the EEA-wide FIN-Net network for cross-border cases, a channel corroborated by both BaFin and European Commission source
Consumer Protection & APP Fraud
The Bank of Lithuania acts as the out-of-court dispute resolution body for consumer disputes with financial market participants. Consumers must first complain to the provider, which has 15 working days to reply, extendable to 35, and may then apply to the Bank within one year; the Bank's decisions are recommendatory rather than binding. Payment services dominate the complaint caseload at 62%, with banks at 41% and EMIs at 23%, and the Bank applies a risk-based complaint-handling model
Consumer Protection & APP Fraud
Luxembourg's consumer-protection architecture is ADR-centred and non-binding. The CSSF acts as an ADR entity for out-of-court resolution of consumer disputes, registered under Article L.431-1 of the Consumer Code and on the European Commission's ADR list, with a free, voluntary, confidential written procedure; complaints must first go to firm management and reach the CSSF within one year, with non-binding conclusions. Critically, Luxembourg has no UK-style mandatory APP reimbursement
Consumer Protection & APP Fraud
Consumer protection in Morocco rests on Law 31-08 and Law 103-12, enforced by BAM. The dispute route requires an internal complaint first, then escalation to the Centre Marocain de Médiation Bancaire (CMMB, 'Al Wassit Al Banki'), created in March 2014 as a free, voluntary out-of-court mediation body governed by Law 31-08 and Circular 9/W/16; a client may escalate after 40 working days. A May 2026 expansion signed consumer-federation partnerships, and approximately 99% of cases over a
Consumer Protection & APP Fraud
Myanmar's mobile-payment consumer-protection regime substitutes tiered KYC transaction limits for a dedicated authorised-push-payment fraud reimbursement regime: Level-1 customers are capped at 400,000 kyat per day, roughly US$135, and Level-2 customers at 2,000,000 kyat per day, roughly US$670, with provider terms disclaiming liability and requiring user indemnification rather than guaranteeing reimbursement. Set against that thin consumer-protection layer is the scale of Myanmar's b
Consumer Protection & APP Fraud
Malta lacks a UK-style mandatory APP-reimbursement regime, and the de facto allocation framework is set by the Office of the Arbiter for Financial Services. The OAFS published a model allocating responsibility between PSPs and payment-service users in payment-fraud scam cases, setting criteria and weightings to determine the gross negligence required to deny full reimbursement under PSD2. This model defines PSP liability exposure for scam reimbursement in the absence of an EU-wide man
Consumer Protection & APP Fraud
Consumer redress in Mexico runs through CONDUSEF, established under the 1999 Law to Protect and Defend Financial Services Users. CONDUSEF mediates and conciliates complaints, runs arbitration, registers standard-form contracts, controls abusive clauses, can bring class actions and impose sanctions, and covers banks, non-banks and FTIs via a dedicated fintech-complaints portal. Critically, Mexico has no UK-style mandatory APP-fraud reimbursement regime; redress runs through CONDUSEF co
Consumer Protection & APP Fraud
Malaysia has no statutory mandatory reimbursement scheme for authorised-push-payment fraud victims equivalent to the UK's PSR-mandated model. Instead, BNM requires banks to ensure fair redress for victims of unauthorised transactions who took reasonable protective steps and did not act fraudulently, with case coordination running through the National Scam Response Centre alongside the police (PDRM) and the communications regulator (MCMC). Redress channels were consolidated on 1 Januar
Consumer Protection & APP Fraud
Mozambique has no dedicated financial-consumer protection agency; complaint handling and enforcement for financial-consumer issues sit within Banco de Moçambique itself, rather than with a separate specialised body. This structural point sits alongside a historic conduct-enforcement gap - an industry Board of Ethics that was never established - predating the current Notice-based conduct regime addressed under W1b.
Within that BdM-run complaints function, ATM-related disputes dominate
Consumer Protection & APP Fraud
The headline development is the CBN's draft Guidelines for Handling Authorised Push Payment (APP) Fraud, an exposure draft dated 26 November 2025, introducing mandatory reimbursement: institutions acknowledge complaints within 24 hours with a unique case reference, investigate within 14 working days, and reimburse within 48 hours of conclusion (16 working days end-to-end); customers must report within 72 hours; and where neither sending nor receiving bank is at fault but the customer
Consumer Protection & APP Fraud
Consumer protection rests on PSD2/Wft conduct rules supervised by the AFM, with Kifid as the recognised out-of-court ombudsman for consumers and small businesses. The key divergence from the UK is structural: there is no statutory APP-fraud mandatory-reimbursement scheme equivalent to the UK PSR regime. Reimbursement is driven by bank goodwill policies and Kifid case law. The bank-PSP focus is relevant here, since liability sits with banks under goodwill and case-law frameworks rather
Consumer Protection & APP Fraud
No dedicated mandatory APP-fraud reimbursement scheme akin to the UK PSR model was identified for Nepal this cycle. Cyber-enabled fraud response instead runs through Nepal Police's Cyber Bureau and FIU-Nepal's STR/SAR analysis - an investigative and reporting-based response model rather than a bank-liability redress framework that would compel reimbursement to defrauded customers. This represents a consumer-protection gap relative to the Anglosphere and EU norm of mandatory or presump
Consumer Protection & APP Fraud
New Zealand has no statutory mandatory authorised-push-payment fraud reimbursement regime. Redress runs through four approved dispute-resolution schemes, principally the Banking Ombudsman, with compensation up to NZ$500,000 for direct loss. The New Zealand Bankers' Association's voluntary scam compensation scheme, in force from December 2025, broadens eligibility and pledges payment within 30 business days, but Consumer NZ criticises it as voluntary, carrying no penalties and being we
Consumer Protection & APP Fraud
Under Law 45 of 2007, ACODECO can decide directly only on consumer complaints up to US$5,000 (US$30,000 for vehicles under Law 14 of 2018); beyond those thresholds consumers must pursue ordinary courts, and no dedicated APP-fraud mandatory-reimbursement regime exists in Panama's regulatory architecture.
Because Panamanian banking regulation prevents banks from unilaterally debiting a client's account for a misdirected transfer without authorization or a court order, Banco General add
Consumer Protection & APP Fraud
Consumer protection in Peru's payments space runs on a dual track. The Codigo de Proteccion y Defensa del Consumidor (Ley 29571) empowers INDECOPI to receive and resolve consumer complaints, fine violators, mediate through conciliation, and order corrective measures such as refunds, with serious infractions drawing fines of up to 450 UIT. The mandatory Libro de Reclamaciones mechanism requires providers to respond within 30 calendar days, with automatic fines for non-response and refu
Consumer Protection & APP Fraud
The most consequential live consumer-protection development is the Anti-Financial Account Scamming Act (RA 12010 / AFASA, 2024), which establishes prohibited acts and enforcement mechanisms — coordinated verification of disputed transactions, BSP authority to apply for cybercrime warrants under RA 10175, and criminalisation of money muling, social engineering and economic sabotage. This is the core APP-fraud and scam statute for the Philippines.
The liability model imports a safe-har
Consumer Protection & APP Fraud
Banking Mohtasib Pakistan, an independent statutory ombudsman under the Federal Ombudsmen Institutional Reforms Act 2013, processed over 25,000 complaints and delivered Rs1.26 billion in monetary relief in 2023; escalation to the Mohtasib is available if a bank's Complaint Management Unit fails to resolve a complaint within 45 days, though microfinance-bank customers are excluded and must approach SBP directly. Banks and microfinance banks are separately required to compensate custome
Consumer Protection & APP Fraud
Poland has no UK-style statutory mandatory APP-fraud reimbursement regime. BLIK social-engineering scams — for example ATM one-time-code fraud — are addressed via operator and bank real-time monitoring, education campaigns and case-by-case redress rather than a reimbursement mandate. Consumer protection runs through UOKiK on collective interests, fines and public compensation; the Financial Ombudsman on individual redress and litigation; and ADR via the KNF Arbitration Court and Bank
Consumer Protection & APP Fraud
Banco de Portugal's complaints channel recorded an 80% year-on-year increase in complaints, with fraud allegations behind 47.4% of them -- a significant escalation in consumer-facing risk signals. BdP's own remedial power under direct complaints handling is limited to compliance verification rather than compensation orders; consumers seeking financial redress must rely on the courts for that remedy, a structural limitation on the regulator's consumer-protection toolkit.
Separately, L
Consumer Protection & APP Fraud
Consumer protection in Qatar is multi-layered with a notable gap relative to UK/EU practice. QCB's dedicated Customer Protection Department handles banking and payments complaints; the QFC runs an independent Customer Dispute Resolution Scheme (maximum award QAR 400,000); and MOCI enforces Law No. 8 of 2008. There is no UK-style mandatory APP-fraud reimbursement scheme — fraud allocation runs through the EMV/3DS liability shift and QCB dispute processes. The absence of mandatory APP-f
Consumer Protection & APP Fraud
The operative APP-fraud control in Romania is IBAN-name verification. From 9 October 2025 PSPs must provide, at no extra charge, a verification service matching IBAN to beneficiary name and alert payers to discrepancies suggesting fraud or error before authorisation — the principal EU-level APP-fraud-mitigation mechanism applicable in Romania. Romania has no UK-style mandatory APP-fraud reimbursement scheme; the absence of a reimbursement mandate is confirmed as not applicable in this
Consumer Protection & APP Fraud
The NBS Department for Financial Consumer Protection provides a free complaint and mediation route for financial-service consumers, governed by the Decision on Handling Complaints of Financial Service Consumers, with findings resolved within three months. This complaint mechanism is the principal formal consumer-recourse channel in the Serbian payments market. Set against it, the NBS IPS system is designed to be final and irreversible with no reversal function, and consumer recourse f
Consumer Protection & APP Fraud
Under Federal Law 161-FZ, Article 8(3.13), banks are financially liable to individual clients for improperly implemented anti-fraud measures where payment details match the Bank of Russia's authorised-fraud database, though statutory reimbursements totalled only ₽1.23 million in 2024. Credit institutions instead paid ₽2,713.58 million in voluntary fraud-victim reimbursements in 2024, 9.9% of losses, up from ₽1,378.76 million, 8.7% of losses, in 2023, with card fraud the most frequent
Consumer Protection & APP Fraud
Consumer protection is anchored in Law N° 017/2021 and BNR Regulation N° 55/2022 (in force 7 November 2022), requiring financial service providers to embed consumer-protection responsibilities at board level, run quarterly consumer-satisfaction surveys, monitor advertising and handle consumer data, with BNR empowered to impose administrative sanctions. Grievance redress is operationalised nationally via the BNR/Proto AI chatbot INTUMWA across 591-plus institutions in Kinyarwanda, Engl
Consumer Protection & APP Fraud
Buy-now-pay-later is regulated in Saudi Arabia as a consumer-finance subcategory. BNPL falls under the Rules for Regulating BNPL Companies (Decision 450360390000, 05/06/1445H) as no-term-cost consumer financing under the Finance Companies Control Law, requiring a SAMA-licensed joint-stock company with SAR 5m minimum capital, 50% Saudization, credit limits, advertising transparency, conflict-of-interest controls and AML/CTF obligations. Tabby, Tamara and MIS Pay are permitted or licens
Consumer Protection & APP Fraud
In 2022 the Swedish Supreme Court ruled that a defrauded consumer must not be responsible for more than SEK 12,000 of transactions carried out in bank-impersonation fraud cases, establishing the domestic APP-fraud liability baseline. In May 2024, Finance Sweden presented a fraud-prevention package aligned with FI's proposals, including transaction monitoring, time delays and amount limits, and exclusion of fraudsters from services such as Swish and BankID.
Outlook
This domestic l
Consumer Protection & APP Fraud
Singapore's consumer fraud-loss model is structurally distinct from comparable regimes. The MAS-IMDA Shared Responsibility Framework (SRF) was implemented on 16 December 2024 via Guidelines. It allocates losses from defined phishing scams across FIs, telcos and consumers on a waterfall basis with no liability cap, and it adds an FI real-time fraud-surveillance duty subject to a six-month transition. The framework covers unauthorised phishing transactions (not authorised push payments)
Consumer Protection & APP Fraud
The Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes (No.2) B.E. 2568, published 12 April 2025 and effective 13 April 2025, establishes a shared-liability framework where banks, telcos, digital-wallet providers and platforms are collectively responsible for scam losses assessed on negligence, with mandatory SMS screening, mule-account penalties and a victim compensation mechanism. National Assembly approval followed on 28 May 2025. The framework mat
Consumer Protection & APP Fraud
BCT Circular n°2018-16 defines a dedicated consumer-protection mechanism for payment-institution customers, alongside governance, internal-control and agent-usage rules for licensed payment institutions. The BCT's Observatoire de l'Inclusion Financière (OIF) additionally operates a financial-complaint submission channel that refers consumers to the mediator or the relevant institution, supported by documentation requirements.
Outlook
No dedicated authorised-push-payment fraud man
Consumer Protection & APP Fraud
Türkiye has no dedicated UK-style mandatory APP-fraud reimbursement scheme. Fraud control instead operates at system level, via CBRT FAST instructions, the Security Overlay Service (SIPER) for risk-data sharing, a centralised Merchant Registration System and transaction monitoring, with BKM operating centralised chargebacks under a merchant authenticity burden, and universal 2FA and the SMS-OTP ban hardening authentication. The reliance on system-level controls rather than a reimburse
Consumer Protection & APP Fraud
The Fraud Crime Hazard Prevention Act imposes anti-fraud cooperation obligations on financial institutions, virtual-asset service providers, telecoms, large online advertising platforms, third-party payment providers, e-commerce and online gaming operators, with fines of up to NT$100 million for violations.
The Cabinet has separately approved draft revisions that would lower the large-scale-fraud threshold from NT$5 million to NT$1 million in fraudulent gains and add penalty tiers up
Consumer Protection & APP Fraud
The consumer-protection regime is anchored in the Financial Consumer Protection Regulations 2019 (G.N. 884) — complaint-handling, disclosure, fair treatment and redress to the BoT — and the 2025 Guidelines for Handling Financial Consumer Complaints (revoking the 2015 banking-only guidelines) extend to all FSPs; there is no dedicated APP-fraud mandatory-reimbursement scheme unlike the UK PSR, and digital-lending harassment is a live gap. The 2025 guidelines materially broaden conduct o
Consumer Protection & APP Fraud
The NBU's consumer-complaints mechanism operates to a 30-day standard response deadline, extendable to 45 days for complex complaints. Ukraine has no UK PSR-style mandatory APP-fraud reimbursement scheme; the NBU directs criminal fraud matters to the police and prosecutor rather than mandating bank-level reimbursement.
Outlook
Absent a mandatory reimbursement scheme, Ukrainian consumers' recourse for authorised-push-payment fraud runs through general criminal-justice channels rat
Consumer Protection & APP Fraud
Bank of Uganda's April 2024 directive requires national-ID, passport, refugee or alien-ID verification for mobile-money transactions of UGX 1 million or more conducted at agent locations, citing rising fraud and scam usage of mobile-money platforms. The persistent fraud risk was illustrated by a significant SIM-swap-enabled mobile-money fraud incident resulting in an estimated $3.2 million loss, using approximately 2,000 SIM cards to infiltrate the payment system and instruct transfer
Consumer Protection & APP Fraud
The US consumer protection regime for electronic payments rests on the Electronic Fund Transfer Act of 1978, implemented by the CFPB's Regulation E at 12 CFR Part 1005. Critically, there is no mandatory authorised-push-payment reimbursement regime, unlike the UK's Payment Systems Regulator framework: Regulation E protects against unauthorised transfers, leaving authorised-but-induced payments as a continuing gap. This framework applies to both bank and non-bank participants. The Regul
Consumer Protection & APP Fraud
Consumer protection in Alaska runs through a general unfair-trade-practices statute now being actively applied to crypto-linked fraud. The Attorney General's Consumer Protection Unit Enforces the Unfair Trade Practices and Consumer Protection Act (AS 45.50.471) against unfair/deceptive practices, including a 2026 public advisory specifically warning Alaskans about scammers directing victims to crypto ATMs.
The scale of the underlying problem is substantial: Alaskans lost more than $2
Consumer Protection & APP Fraud
Alabama's consumer-protection apparatus is documenting severe elder-targeted payment fraud even as the state lacks a general APP-fraud reimbursement mandate. The Attorney General's Consumer Interest Division enforces the Deceptive Trade Practices Act and issues alerts against wire-transfer, cryptocurrency-kiosk, and gift-card scam payment methods; because Alabama has no reimbursement regime comparable to the UK's Payment Systems Regulator framework, unauthorized-transfer protection co
Consumer Protection & APP Fraud
The Arkansas Personal Data Protection Act, signed April 11, 2023 and effective July 1, 2025, grants residents rights to access, correct, delete and opt out of the sale of their personal data. Separately, the Arkansas Personal Information Protection Act (Ark. Code Section 4-110-105) requires disclosure of security breaches 'in the most expedient time and manner possible and without unreasonable delay,' with breaches affecting more than 1,000 individuals also reportable to the Arkansas
Consumer Protection & APP Fraud
HB2387 mandates full refunds, including fees, to new customers reporting crypto-ATM fraud within 30 days, alongside mandatory on-screen fraud warnings and wallet-address receipts, giving Arizona crypto-kiosk users a statutory refund right that did not previously exist.
The scale of the underlying problem is substantial: Arizonans lost an estimated $177 million to cryptocurrency scammers in 2024, a 99% rise in crypto-ATM fraud complaints per FBI data; the Attorney General recovered mo
Consumer Protection & APP Fraud
California consumer protection for payments differs structurally from the UK model on authorised-push-payment fraud. Unlike the UK, California/the US has no APP-fraud mandatory-reimbursement regime; consumer protection rests on federal Regulation E (EFTA) for unauthorised EFTs and the CCFPL's UDAAP authority plus the DFPI Consumer Services Office complaint process (Form DFPI-801). This means the consumer-protection backstop is a combination of federal unauthorised-transaction rules, s
Consumer Protection & APP Fraud
DC's Consumer Protection Procedures Act provides a private right of action: harmed consumers may sue for treble damages (or $1,500 per violation if greater), punitive damages, attorney's fees, and injunctive relief, with enforcement available through the OAG in DC Superior Court — the core consumer-protection statute underpinning DC's APP-fraud and predatory-product enforcement, including the Athena Bitcoin and EarnIn matters. Separately, DC's Security Breach Protection Amendment Act
Consumer Protection & APP Fraud
Delaware recorded 181 crypto complaints and 255 crypto-wallet complaints in 2025, totaling $26,893,098 in losses, prompting HB441, a proposed bill to ban unregulated crypto kiosks and cashier-assisted workarounds, with removal required within 90 days and penalties of up to $10,000. The Delaware Department of Justice's Consumer Protection Unit enforces the Consumer Fraud Act and Deceptive Trade Practices Act, with remedies including injunctive relief, restitution, and treble damages fo
Consumer Protection & APP Fraud
HB505 introduces new consumer-fraud protections for virtual-currency kiosks: daily transaction limits of $2,000 for new customers and $10,000 for existing customers, and mandatory full refunds within 72 hours for fraud losses, responding to more than $33 million in FBI/FTC-reported Florida kiosk-fraud losses between January 2020 and December 2025. These protections have staged effective dates: the consumer-protection provisions take effect 1 January 2027, distinct from the 1 March 202
Consumer Protection & APP Fraud
Georgia's sector-agnostic breach-notification statute, O.C.G.A. §10-1-912, requires notice "in the most expedient time possible without unreasonable delay," with no fixed deadline, and mandates nationwide consumer-reporting-agency notice where more than 10,000 residents are affected; no dedicated authorised-push-payment fraud reimbursement mandate exists in Georgia, leaving fraud recourse to federal Regulation E and card-network chargeback mechanisms.
Outlook
The new SB 111 priva
Consumer Protection & APP Fraud
Consumer protection for Hawaii payments users runs through the general HRS Chapter 480 unfair-or-deceptive-practices framework, enforced by the Office of Consumer Protection, with treble-damages and attorney-fee remedies available to injured consumers; there is no Hawaii-specific authorized-push-payment fraud mandatory-reimbursement scheme.
FBI Honolulu-cited IC3 data show Hawaii elder-fraud losses nearly tripling from about $10 million to $28 million over the preceding three years,
Consumer Protection & APP Fraud
Iowa's Attorney General-led Stop the Scammers Tour has generated 211 fraud investigations across 96 Iowa communities since January 1, 2026, run through general consumer-protection and insurance-division channels rather than a dedicated APP-fraud reimbursement scheme.
Outlook
Iowa lacks a UK/PSR-style mandatory APP-fraud reimbursement scheme; consumer protection continues to run through general Attorney General and insurance-division enforcement, a structural gap worth watching fo
Consumer Protection & APP Fraud
Idaho's most acute and fastest-growing payments consumer-harm vector is cryptocurrency-related fraud. The Idaho Attorney General reported cryptocurrency-related consumer fraud losses rising from $19 million in 2023 to over $35 million in 2024, with seniors the largest victim group, driven substantially by crypto-ATM/kiosk scams; FBI Internet Crime Complaint Center 2025 data puts Idaho crypto-fraud losses above $48 million. A legislative response was mounted in 2026: Senate Bill 1359 w
Consumer Protection & APP Fraud
Illinois consumer protection in payments spans both longstanding credit-cost limits and newer crypto-specific fraud safeguards. The Predatory Loan Prevention Act, in force since March 2021, caps APR at 36% on most consumer loans in Illinois; a Woodstock Institute study found Illinois consumers saved over $600 million in interest and fees on payday, installment, and title loans between 2019 and 2022. On the digital-asset side, the Digital Asset Kiosk Act requires operators to implement
Consumer Protection & APP Fraud
The Indiana Consumer Data Protection Act (ICDPA, IC 24-15) took effect 2026-01-01, applying to entities processing personal data of at least 100,000 Indiana residents annually, or 25,000 residents where more than half of revenue derives from data sales; enforcement is Attorney-General-only, with a 30-day cure notice and penalties of up to $7,500 per violation. This sits alongside EWAA-specific consumer safeguards, including the $100,000-$250,000 surety bond and fee caps described in W
Consumer Protection & APP Fraud
The KCPA empowers the Attorney General to investigate deceptive and unconscionable acts, seek court orders blocking a business from selling/advertising in Kansas or revoking its license, and refer cases for criminal prosecution; private plaintiffs may recover statutory penalties up to $10,000 per violation plus attorney fees. Kansas's 2026 kiosk act requires fraud-warning disclosures, mandatory transaction receipts, live customer service and blockchain-analytics screening against frau
Consumer Protection & APP Fraud
The Kentucky Attorney General's Office of Consumer Protection enforces the Kentucky Consumer Protection Act through civil penalties, restitution, and injunctive relief, but Kentucky has no authorized-push-payment fraud mandatory reimbursement regime comparable to the UK's Payment Systems Regulator model, with redress instead running through Regulation E, voluntary bank practice, and general complaint mediation. The Attorney General has also partnered with the Kentucky Chamber and the
Consumer Protection & APP Fraud
Louisiana has no PSR-style mandatory authorised-push-payment fraud reimbursement regime. Consumer redress instead relies on LUTPA private actions and Attorney General enforcement, the criminal bank-fraud restitution statute, and DOJ-led elder-fraud and imposter-scam alerts specific to Louisiana's federal districts.
Outlook
Without a mandatory reimbursement framework, Louisiana APP-fraud victims will continue to depend on LUTPA, criminal restitution, and DOJ awareness campaigns; m
Consumer Protection & APP Fraud
Governor Maura Healey signed the money-transmission overhaul explicitly to protect consumers using payment apps like Venmo, Cash App and PayPal. Separately, Massachusetts consumers affected by a data breach involving Social Security numbers are entitled to no less than 18 months of free credit monitoring from the breached entity. Active enforcement against deceptive practices continues via the Attorney General's Bitcoin Depot suit.
Outlook
The explicit consumer-protection framing
Consumer Protection & APP Fraud
SB94, signed April 28, 2026 and in force October 1, 2026, closes app-based payday-loan-style loopholes in earned wage access products; a 2024 Market Inquiry had found Maryland consumers paid more than $35 million in fees on 5.5 million EWA transactions between 2019 and 2024, with dark-pattern tip pricing averaging more than $280 per user. The 2023 Access to Banking Act was expanded in 2026 via SB43/HB259 to create a collaborative model and Maryland Opportunity Accounts, channeling fee
Consumer Protection & APP Fraud
The Michigan Attorney General's Consumer Protection Team maintains active alerts warning consumers about peer-to-peer payment-app scams, including "return the money" patterns exploiting stolen funds, directing victims to the app host, the FTC, or the CFPB. In April 2026, during Money Smart Week, Attorney General Dana Nessel reissued an AI Scams consumer alert warning of AI-generated deepfake voice-cloning fraud that impersonates loved ones to solicit payment-app transfers.
Outlook
Consumer Protection & APP Fraud
Enacted HB1625 requires Mississippi virtual currency kiosk operators to display fraud warnings describing common scam tactics, a statement that no government agency requests kiosk payment, and a suspected-fraud reporting phone line, the state's first payment-channel-specific APP-fraud mitigation mandate.
The enacted kiosk provisions also cap total fees and commissions at 15% and impose daily transaction limits.
Outlook
No general, non-kiosk statutory APP-fraud bank-reimbursement
Consumer Protection & APP Fraud
Crypto-ATM fraud has emerged as Montana's fastest-growing consumer-protection concern, with approximately $2 million in losses reported in 2025 alone. Montana is one of six US states with a legislature-authorized restitution fund for such losses, but crypto ATMs remain unregulated at both the state and federal level. State Representative Sprunger is drafting legislation for the 2027 Montana Legislature to close this gap, working alongside the Commissioner of Securities and Insurance.
Consumer Protection & APP Fraud
House Bill 1447 is North Dakota's most concrete recent consumer-protection action in payments, requiring virtual currency kiosk operators to cap daily transactions at $2,000 per customer, provide risk, fee and transaction disclosures and receipts, deploy fraud-detection measures, and staff live customer service from 8am to 10pm Central Time. The statute responds directly to documented harm: NDDFI Commissioner Lisa Kruse testified that the FBI reported $5.6 billion in nationwide crypto
Consumer Protection & APP Fraud
Crypto-kiosk fraud remains Nebraska's most active consumer-protection vector. LB609 establishes licensing, disclosure, fraud-prevention, transaction-limit, and refund obligations for crypto-kiosk operators, administered by NDBF, motivated by 239 Nebraska crypto-kiosk fraud complaints in 2023 totalling approximately $14.6 million in losses. Municipal ordinances in Omaha (Ord. 44007), Lincoln (November 2025), and Grand Island (Ord. #10051, November 2025) require standardized fraud-warni
Consumer Protection & APP Fraud
The NH Department of Justice's Consumer Protection & Antitrust Bureau enforces state and federal unfair-and-deceptive-practices laws and investigates and prosecutes the most serious cases of elder abuse and financial exploitation, running sustained 2025-2026 scam-prevention and AI-fraud-awareness campaigns. Separately, the NH Banking Department explicitly warns consumers that PayPal, Venmo, Cash App and other non-bank payment apps are not protected by federal deposit insurance, direct
Consumer Protection & APP Fraud
The Consumer Fraud Act remains New Jersey's consumer-protection backbone, providing treble damages and both Attorney General and private rights of action. It is reinforced by the New Jersey Data Protection Act, effective January 15, 2025, whose notice-and-cure grace period sunsets July 15, 2026; by a gift-card anti-fraud notice mandate effective October 1, 2025; and by the June 2026 Attorney General/Division of Consumer Affairs Enforcement Statement targeting junk fees. No authorised-
Consumer Protection & APP Fraud
Nevada has no dedicated payments-conduct or mandatory app-fraud reimbursement statute of the UK Payment Systems Regulator type; consumer protection instead runs through the general deceptive-trade-practices regime under NRS Chapter 598, enforced by the Attorney General's Consumer Affairs Unit and the Commissioner of Financial Institutions.
Outlook
Absent a UK-style mandatory reimbursement mandate, Nevada consumers facing authorised-push-payment fraud will likely continue to rely
Consumer Protection & APP Fraud
New York's VC consumer-protection conduct is defined by two recent measures. NYDFS guidance requires VCEs to maintain monitored phone and electronic-text channels, resolve complaints timely and fairly, provide quarterly complaint tabulations (by channel, topic and average resolution time) from Q3 2024, make documents available to DFS from November 1 2024, and retain records at least seven years under 23 NYCRR 200.12. Separately, the September 30 2025 guidance updates expectations for
Consumer Protection & APP Fraud
The Oklahoma Consumer Data Privacy Act (Senate Bill 546), in force 2027-01-01, grants consumers rights to access, correct, and delete their personal data and to opt out of targeted advertising, data sales, and profiling, backed by Attorney-General-exclusive enforcement and penalties of up to $7,500 per violation. Separately, Senate Bill 1083's digital-asset kiosk provisions require refunds to defrauded new and existing customers, mandatory fraud-warning disclosures, and live customer-
Consumer Protection & APP Fraud
Under ORS 646A.295, Oregon requires clear presentation of auto-renewal terms and affirmative consent before charging a credit card, debit card, or third-party payment account for subscription services, treating unauthorized shipments as unconditional gifts. DFR's consumer-facing cryptocurrency guidance warns that crypto holdings are not FDIC-insured and cautions on market volatility, functioning as Oregon's primary consumer-facing crypto and payments-fraud prevention material in the a
Consumer Protection & APP Fraud
Pennsylvania has no APP-fraud-specific reimbursement regime comparable to UK PSR mandatory reimbursement; PA relies on federal EFTA/Reg E and card-network dispute rules for authorised-push-payment fraud loss allocation, with the UTPCPL and the Attorney General's Consumer Financial Protection Unit acting as a general UDAAP analogue rather than a dedicated fraud-reimbursement mechanism. This is an under-indexed area in prior baseline research and remains a state-level divergence point r
Consumer Protection & APP Fraud
South Carolina's 2021 elder financial exploitation law (S.425) allows financial institutions, including banks, credit unions, broker-dealers and investment advisers, to decline, delay, or report transactions suspected of financially exploiting vulnerable adults aged 55 and older, without requiring such action, and exempts good-faith actors from liability. No South Carolina-specific authorized-push-payment fraud mandatory reimbursement regime comparable to the UK's exists; reliance is
Consumer Protection & APP Fraud
South Dakota capped consumer loan rates at 36% APR on money-lender and payday loans per Initiated Measure 21 (2016)/SDCL 54-4-36; 121 payday lenders did not renew South Dakota licenses in 2017 following enactment, and the cap remained highly popular in follow-up polling. Separately, South Dakota's Security Breach Notification Law (SDCL 22-40-19 to -26, SB62 2018) requires resident disclosure within 60 days of discovery, Attorney General notification if over 250 residents are affected,
Consumer Protection & APP Fraud
The Utah Consumer Privacy Act, effective 2023-12-31, gives the Attorney General exclusive enforcement authority with no private right of action, requires a 30-day non-sunsetting cure period, and caps civil penalties at $7,500 per violation. Utah has no dedicated authorised-push-payment fraud reimbursement mandate; consumers instead rely on the federal Regulation E and Electronic Fund Transfer Act unauthorised-transfer framework, with no primary source located that directly negates an
Consumer Protection & APP Fraud
Vermont has embedded specific anti-fraud conduct requirements directly into its virtual-currency kiosk statute. Under 8 V.S.A. §2577, kiosk operators must arrange a live screening call for any new customer over the age of 60 before that customer's first kiosk transaction, and for any customer attempting more than $5,000 in transactions over a ten-day period.
This sits alongside a 2025 legislative addition requiring kiosk operators to refund new-customer fraud victims who report the c
Consumer Protection & APP Fraud
Washington has no state-specific mandatory Authorised-Push-Payment fraud reimbursement scheme analogous to the UK Payment Systems Regulator's rules; consumer recourse instead rests on the broadly-interpreted Consumer Protection Act, the statutory money-transmitter refund right, and federal Regulation E error-resolution procedures. Licensees must maintain Reg E-compliant error-resolution policies and procedures, enforced via DFI examination.
Outlook
Absent a dedicated APP-fraud re
Consumer Protection & APP Fraud
Wyoming's Consumer Protection Act (W.S. 40-12-101 to -114), enforced by the Attorney General's Consumer Protection and Antitrust Unit, covers deceptive trade practices in payments-adjacent transactions but contains no payments-specific authorised-push-payment fraud reimbursement mandate or ombudsman scheme. Enforcement is complaint-driven, with civil penalties of up to $10,000 per violation, rising to $15,000 for violations targeting elderly or disabled victims. This is a stable gener
Consumer Protection & APP Fraud
Consumer protection in Venezuela rests on the 2004 Ley de Protección al Consumidor y al Usuario and SUNDDE's Ley Orgánica de Precios Justos, with a bank-specific redress layer running through SUDEBAN's Defensoría; no PSR-style mandatory authorised-push-payment fraud reimbursement regime was identified.
Outlook
Absent a statutory reimbursement mandate, consumer redress for push-payment fraud will likely continue to run through the slower Defensoría/SUDEBAN claims-reconsideration r
Consumer Protection & APP Fraud
Vietnam's consumer-fraud protection is structurally prevention-led rather than reimbursement-led. Decision 2345/QD-NHNN (effective 1 July 2024) sets a tiered authentication model: transactions under VND 10m use OTP (daily total under VND 20m), but transfers over VND 10m or daily totals over VND 20m require biometric authentication via chip-based ID, VNeID or stored biometric data — a response to around US$744m in 2024 online-fraud losses. The mandate was extended to corporate accounts
Consumer Protection & APP Fraud
The defining consumer-protection feature this cycle is an absence: South Africa has no mandatory APP-fraud reimbursement regime equivalent to the UK PSR scheme. Authorised push-payment losses are generally treated as voluntary and borne by the consumer. This is confirmed via dedicated APP-fraud and ombud searches. APP and social-engineering fraud is rising sharply, with SA banks recording roughly 98,000 digital fraud incidents and about R1.9bn in losses in 2024. Industry is deploying
The dedicated APP Fraud & Reimbursement sub-strand of W10 covers mandatory reimbursement jurisdictions. W10 / W5 / W1b entries reference APP fraud in a broader consumer protection or AML/CFT context. Coverage updates with each pipeline cycle.