Which? Warns: Card Scam Victims Face $0 Automatic Refund Risk

Fraudsters are now repurposing the social-engineering tactics that made authorised push payment scams so costly and aiming them at the card rails. Instead of stealing credentials, attackers are walking victims through an approval flow, which means the transaction passes existing authentication checks. That makes this a threat-intelligence problem as much as a consumer protection issue.

On 13 August 2026, consumer group Which? warned that criminals are combining the social-engineering tactics of authorised push payment scams with the card payment system, convincing UK consumers to approve card transactions that are actually going to fraudsters. The warning, carried in syndicated reports by the Clacton and Frinton Gazette and the Hereford Times from USA Today copy, described the threat as a 'critical wake-up call' after years in which banks and policymakers concentrated anti-fraud efforts on unauthorised card fraud and bank-transfer APP scams. The new pattern shifts the point of compromise from thieves stealing credentials to victims themselves authorising payments, which creates a materially different liability picture.

“

Lisa Webb, a consumer law expert at Which?, said the scam is especially dangerous because card payments fall outside the automatic refunds that banks are obliged to provide.

The distinction matters because UK consumer protections are arranged around two principal scenarios. Unauthorised card fraud, where a transaction takes place without the cardholder's knowledge or consent, is generally refunded. Victims of APP fraud, where a person is manipulated into sending a bank transfer, have access to a reimbursement scheme. Which? warns that cardholders who are tricked into approving card payments may fall into a grey area: the payment is authorised, so it does not meet the classic unauthorised card fraud definition, yet the manipulation resembles APP fraud, which conventionally involves bank transfers rather than card transactions. Lisa Webb, a consumer law expert at Which?, said the scam is especially dangerous because card payments fall outside the automatic refunds that banks are obliged to provide.

That gap has practical consequences. Fraudsters gain a route that may preserve the card network's authentication strength—chip and PIN, biometric approval, 3-D Secure or in-app confirmation—while removing the consumer's later ability to argue that they did not authorise the payment. A victim who taps a card or approves a mobile wallet prompt under false pretences may be treated by their bank as having made a legitimate payment, leaving them to pursue discretionary reimbursement or complaint channels. The convergence of card and APP fraud also means that the hardening of bank transfer controls, including mandatory reimbursement frameworks and improved transaction monitoring, may be pushing criminals toward the card rails as an alternative that is less uniformly covered.

For payment providers, card networks, and fraud-security teams, the warning has operational implications. Real-time fraud models that look for unusual merchant categories, payment velocities, or device anomalies may need to be retrained to detect authorised scams where the victim's own device or card is used in a legitimate-looking flow. Merchant monitoring will need to address the fact that fraudsters may process card payments through apparently ordinary acquiring channels, making the scam harder to block at the point of transaction. Regulators and consumer advocates will likely scrutinise whether card dispute rules should be expanded to account for psychologically manipulated authorisations, particularly as APP fraud controls mature.