Cross‑border payments: the gap in fraud protection

What has changed

Authorised push payment (APP) fraud occurs when a payer is deceived into authorising a payment to a fraudster. Business email compromise (BEC) can be one route to that outcome: an owner or employee receives a false or altered payment instruction and sends money believing it is legitimate. The payment may be authorised by the business, even though the instruction was fraudulent. That distinction has mattered to the design of reimbursement protections.

The UK has introduced a defined reimbursement framework for APP fraud. Since 7 October 2024, eligible consumers, micro-enterprises and charities can seek reimbursement of up to £85,000 per claim. The cost is shared equally between the sending and receiving payment service providers. International payments are excluded from this protection.¹ The framework is therefore a significant domestic safeguard, but not a universal answer for a small business that pays across a border or falls outside the stated eligibility categories.

The first-year evaluation reported two encouraging results: APP fraud fell by 21%, and the share of victims reimbursed increased from 54% to 65%.² Those figures indicate progress under the UK framework. They do not show that every eligible business was reimbursed, that all forms of business fraud were covered, or that a similar result applies to international transfers. The distinction matters: a national measure can improve protection within its perimeter while leaving gaps beyond it.

Another development addresses prevention. The EU Instant Payments Regulation requires verification of payee from October 2025. In practical terms, the requirement is to check whether the payee name matches the payment details. A check before funds are sent can help address misdirection, but it is not the same as a promise to return money after a business has been deceived. Prevention and redress are different stages of protection.

Why the cross-border gap matters

Small firms often operate with limited staff and little room to absorb a sudden loss. A payment that cannot be recovered may affect payroll, stock purchases, supplier relationships or the owner’s ability to keep trading. These figures do not measure those consequences, but they explain why speed and clarity after a fraud report matter. A business needs to know where to report the incident, whether its payment can be recalled, what evidence is required and who will decide whether reimbursement applies.

Cross-border payments add a boundary to that process. A transfer may involve payment providers operating in different countries, with different rules and procedures. The UK framework described here excludes international payments. The EU measure requires payee verification, but it does not establish a common reimbursement right for a small business whose payment crosses a border. A name-check rule and a reimbursement rule should not be treated as interchangeable.

This is not a claim that every payment provider or every country lacks protections. The UK and EU measures described here do not provide a complete map of the law in all 49 countries where Reseated members are seated. For an owner, the practical question is narrower: what applies to this payment, this business, these providers and this route? A protection that depends on the sender’s status or the destination of the money can be difficult to assess before a fraud happens.

The scale of small business helps explain why a usable system matters. The United Nations estimates that micro-, small- and medium-sized enterprises make up about 90% of businesses, account for 60–70% of employment and contribute around half of GDP worldwide.³ The International Labour Organization estimates that MSMEs account for about 70% of employment worldwide and that around 80% operate in the informal economy.⁴ These global figures do not measure payment fraud. They do show why protections designed only around large organisations or a single domestic payment route may leave many owners needing clear, accessible procedures.

What Reseated’s evidence shows

As of 12 October 2026, Reseated had 1,698 members in 49 countries and had received 5,208 reports from 50 countries. The Fair Play Council had 204 members from 42 countries and 659 reports from 48 countries. The median amount at stake in those reports was approximately US$4,498. There were 126 Fair Play reports in the preceding 30 days.

The reports came from a wide range of places. The largest country totals were the United Kingdom, 93; the United States, 90; Nigeria, 37; Canada, 32; India, 32; South Africa, 31; Kenya, 30; and Brazil, 21. These are counts of reports submitted, not population-adjusted rates. They should not be read as a ranking of which countries are most affected, or as proof that one country’s payment system is safer than another’s. Reseated had reports from 48 countries, and the listed totals are only the largest country counts.

All 659 Fair Play reports were classified as fraud. The reported business sizes were varied: 41% of reports came from owners identifying as “just me,” 39% from businesses with 2–9 team members, 15% from businesses with 10–49, and 6% from businesses with 50–249. The percentages are as recorded in the dossier and may not total exactly 100 because of rounding. The pattern is not limited to one size of small operation: a solo owner and a business with a larger team can both face a deceptive payment instruction.

These figures describe the evidence gathered by a member assembly. They are not a census of businesses, a verified measure of total losses, or a count of successful reimbursement claims. They do not establish how many reports involved cross-border payments, how many were APP fraud or BEC, or how many owners recovered their money. Reseated does not use these totals to accuse a named company. The figures help identify a recurring problem for review; they cannot, by themselves, determine the responsibility or conduct of a particular provider.

The Fair Play Council’s position

The Fair Play Council’s proposed Business Fraud Standard, FP-001, addresses the gap between a fraud report and an effective response. Its ask is that banks and payment providers verify payee names, recall fraud payments quickly and reimburse small businesses hit by authorised push payment or business email compromise fraud,

including where a payment is cross-border. FP-001 passed the Council’s five-part pattern test on 8 September 2026. The test examines volume, frequency, consistency, spread and corroboration; it is a way to decide whether recurring reports merit a proposed fix, not a finding about any individual case.

The Council’s position is built around three linked duties. First, a payee-name check should give the payer useful information before money leaves the account. Second, when a business reports suspected fraud, providers should act quickly to try to recall or freeze the payment where possible. Third, small businesses harmed by covered APP or BEC fraud should have a clear route to reimbursement, including for cross-border payments. These are proposed standards for practice, not a statement that every provider already offers these protections.

The Council sees each duty as addressing a different point in the chain. A check can help a payer pause when the account name and intended recipient do not align. A fast recall can matter because a delay may reduce the chance of recovering funds. Reimbursement addresses the remaining harm when prevention and recovery fail. A system that provides only one of these protections leaves the owner to carry the consequences of the others not working.

Fairness also requires a process a small business can use. An owner should be able to report a suspected fraud promptly, understand what information is needed, receive a timely decision and know how a cross-border case will be handled. The standard’s central principle is that the fact a business authorised the transfer should not, on its own, end the inquiry into whether deception occurred or whether reimbursement is appropriate.

What owners can do now

Before sending a payment, confirm any change to bank details through a second, trusted channel that is already on file. Do not rely only on contact information in the message requesting the change. Check the payee name and payment details carefully, and treat an unexpected change, urgency or unusual confidentiality request as a reason to pause and verify. Where a payment service provides a payee verification result, read it rather than clicking through automatically.

Agree a simple internal process for payments, even in a one-person business. Keep supplier details in a controlled record; require an independent check for changes where staffing allows; and make clear who can approve a payment. A short written procedure can help prevent an urgent message from bypassing ordinary checks. These steps reduce avoidable risk but cannot guarantee that a business will not be targeted or that a provider will reimburse a loss.

If a payment may be fraudulent, contact the sending provider immediately using its official channel and ask it to attempt a recall. Ask the provider to record the report as suspected fraud, explain the next steps and give a reference number. Preserve the original message, invoices, payment details, dates and any communications with the intended supplier. Report the incident to the relevant authorities or reporting service in your jurisdiction. Do not delay notifying the provider while assembling every document.

Ask specific questions about scope: whether the business qualifies for a reimbursement scheme, whether the payment route is covered, what deadline applies, what evidence is needed, and how a cross-border transfer is treated. Keep a dated record of the answers and any decision. If a claim is refused, ask for the reason in writing and what review or complaint route is available. These steps do not substitute for legal advice or guarantee a particular outcome; they help an owner preserve information and understand the process.

What a fair standard should deliver

For owners, protection should be judged by what happens at each stage: whether the payment can be checked before it is sent; whether a provider acts promptly after a report; and whether a small business can obtain a reasoned decision and, where appropriate, reimbursement. The UK framework and EU verification requirement show that rules can address parts of this problem. The cross-border gap remains the central concern in the Fair Play Council’s proposal.

Reseated’s data provides a reason to keep examining the issue across countries, business sizes and payment routes. It does not settle every case or prove how often fraud succeeds. The Council’s task is to turn recurring reports into a practical standard, consult on that proposal and seek adoption by the providers able to change their practices. For a business owner, the immediate priority is to verify payment changes,

report suspected fraud without delay and keep a clear record. For the system, the test is whether those actions are met with consistent checks, rapid recovery efforts and protection that does not stop at the border.

Notes and sources

1. UK Payment Systems Regulator, APP fraud reimbursement protections. https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/ ↩
2. Grant Thornton, first-year evaluation of the APP reimbursement requirement. https://www.grantthornton.co.uk/insights/app-fraud-reimbursement-requirement-were-industrys-concerns-justified/ ↩
3. United Nations, Micro-, Small and Medium-sized Enterprises Day. https://www.un.org/en/observances/micro-small-medium-businesses-day ↩
4. International Labour Organization, Micro-, Small and Medium-sized Enterprises. https://www.ilo.org/topics-and-sectors/micro-small-and-medium-enterprises ↩

Sources

1. UK Payment Systems Regulator — APP fraud reimbursement protections
2. Grant Thornton — first-year evaluation of the APP reimbursement requirement
3. United Nations — Micro-, Small and Medium-sized Enterprises Day
4. International Labour Organization — Micro-, Small and Medium-sized Enterprises