Guardian Money set out on Sunday how the bank impersonation scam works: a text saying a payment has been set up on your account, a number to call, and a person on the other end who moves you to a “safe account” or asks for your card. It is a good consumer piece and the advice in it is sound. It is also written for a household, and that is where it leaves a hole worth filling, because the protection most business owners assume they have does not follow them into the company.
Here is the part nobody says out loud. Since October 2024 the UK has had a mandatory reimbursement rule for this exact fraud — money back in five business days, up to £85,000, with only two narrow exceptions. It covers individuals. It covers micro-enterprises. It does not cover a company with ten or more people on the payroll. So the business that has grown enough to hold real money in its current account is precisely the business that has lost the automatic right to get it back.
What the reported figures actually say
The Guardian's numbers come from two lenders and they point the same way. Lloyds reports that fraudsters posing as trusted organisations — banks, the police, HMRC, phone providers — took 10% more from its customers in the year to the end of June than in the twelve months before. The number of its customers reporting a scam fell by 3% over the same period, while the average sum taken rose 10% to £3,516. Fewer victims, bigger hits. Santander reports more than £3m taken from its customers through bank impersonation scams so far this year, at an average loss of £6,000.
Nationwide's head of fraud analytics makes the mechanical point in the piece: it nearly always starts with a text rather than a call, because people are more sceptical of a stranger ringing them than of a message arriving. Some versions ask you to reply “N” if the payment was not yours, and the reply is what triggers the call. Santander's head of fraud risk management gives the one instruction that defeats all of it: “Stop, check and contact your bank directly using a trusted number.”
None of that is new advice. What is new, and what the piece does not cover, is how differently that same ninety seconds plays out depending on what is written on your bank mandate.
The reimbursement ladder, and where your company sits on it
The Payment Systems Regulator's reimbursement requirement started on 7 October 2024. Its consolidated policy statement sets the terms precisely: reimbursement within five business days, a maximum claim excess of £100, no minimum claim value, a maximum of £85,000 per claim on both Faster Payments and CHAPS, a thirteen-month window to claim, and exactly two exceptions — the customer acted fraudulently, or the customer acted with gross negligence.
And it applies, in the regulator's own words, to payments made by individuals, micro-enterprises and charities. A micro-enterprise, under the Payment Services Regulations, is an enterprise employing fewer than 10 people whose annual turnover or balance sheet total does not exceed €2 million. Both limbs must hold. Here is what that means in practice.
| Who is paying | Automatic reimbursement? | What you actually do | Ceiling |
|---|---|---|---|
| Sole trader, personal or business account | Yes | Claim to your bank | £85,000 |
| Company, 8 staff, £900k turnover | Yes — micro-enterprise | Claim to your bank | £85,000 |
| Company, 14 staff, £1.9m turnover | No — too many staff | Complain, then Ombudsman | £455,000 award limit |
| Company, 9 staff, £3m turnover | No — too much turnover | Complain, then Ombudsman | £455,000 award limit |
| Company, £8m turnover | No | Goodwill, then court | None |
Read rows three and four together, because that is the whole point. Fourteen staff on modest turnover fails the rule. Nine staff on strong turnover also fails it. Neither company would describe itself as anything other than small, and the owner of either would tell you with total confidence that the bank has to refund a scam.
The fallback is genuine but it is a different animal. Under the FCA's complaint-handling rules, an enterprise that is not a micro-enterprise still reaches the Financial Ombudsman Service as a small business if its annual turnover is under £6.5 million and it either employs fewer than 50 people or has a balance sheet total under £5 million — a threshold that has been in place since 1 April 2019. The Ombudsman's award limit rose to £455,000 on 1 April 2026 for acts or omissions from April 2019 onwards. But that is a complaint decided on what is fair and reasonable, argued over months. It is not a rule that pays you in five days. And above £6.5 million of turnover, you have neither.
What £6,000 is on a real set of accounts
Averages hide the damage, so put Santander's £6,000 next to an illustrative but ordinary company: £420,000 of turnover on a 7% net margin. That is £29,400 of profit for the year. The scam takes a fifth of it in a single phone call.
The better way to feel it is in sales. To replace £6,000 of profit at a 7% margin you have to win roughly £86,000 of additional turnover. Lloyds' lower average of £3,516 still costs you just over £50,000 of replacement sales. A quarter of a trading year, undone by a text message and a callback to the wrong number.
And that assumes the money was yours. Frequently it is not. A company with £600,000 of standard-rated turnover collects £120,000 of VAT a year at the 20% standard rate — £30,000 sitting in the account each quarter waiting for HMRC, on top of the month's PAYE and National Insurance. A scammer looking at a healthy balance in the fortnight before a VAT quarter-end is very often looking at HMRC's money rather than yours. If it goes, the due date does not move and the penalty does not care why the account is empty.
HMRC is the other name being used
The Guardian names HMRC alongside banks and the police as an impersonated body, and the scale on that side is documented. HMRC reported in December 2025 that customers had flagged more than 135,500 HMRC-related scams in the previous ten months, including 29,000 referring to fake tax refund claims, with more than 4,800 Self Assessment scams reported since February 2025.
The rule to teach your team is simple and absolute: HMRC does not notify a tax rebate by text message, and does not ask for personal or payment details that way. Genuine HMRC emails come from an address ending hmrc.gov.uk. Forward suspicious texts to 60599, forward suspicious emails to phishing@hmrc.gov.uk, and report suspicious calls through HMRC's reporting page. Anyone who handles your post or your inbox needs to know this, not just you.
Five things to do this week
- Work out which side of the line your company sits on. Count the people on the payroll and check last year's turnover against €2 million. Ten or more staff, or turnover above that, and the automatic reimbursement rule does not reach you. That single fact should change how tightly you run the bank account.
- Write the one-sentence rule and circulate it. Nobody here moves money because of an incoming call, text or email — no exception for the owner, no exception for urgency. Verification always runs outward: hang up, call the number on the back of the card or inside the banking app.
- Turn on dual authorisation for new payees. Most business banking platforms support it. One person sets up a beneficiary, a second releases the payment. It is free, it takes an afternoon, and it breaks the script the fraudster is reading from, which depends entirely on one person acting alone under pressure.
- Stop holding the tax in the trading account. Move the VAT and the PAYE to a separate reserve as they accrue. It removes the balance the scam is aiming at, and it fixes the cashflow problem you already had. This is what our business banking and cashflow and budgeting work is for.
- Reconcile the bank daily, not monthly. The thirteen-month claim window is generous, but a bank's ability to freeze and recall funds at the receiving end is measured in hours. A daily feed in your bookkeeping is the difference between spotting an unrecognised payee that afternoon and finding it at month end.
What is still open
Two things genuinely are not settled. The first is whether the reimbursement rule will ever be extended past the micro-enterprise line. The PSR notes in its policy statement that the scope largely echoes who can already complain to the Ombudsman, and no proposal to widen it to larger businesses has been published, so for now the ten-employee test stands as written. The second is supervision: the PSR is being consolidated into the FCA, which changes who oversees the rule rather than the rule itself, and the reimbursement requirement continues to apply on the terms above throughout.
What is settled is the arithmetic. If you employ ten or more people, or turn over more than €2 million, you are running your bank account without the safety net the newspapers are describing. Controls are the substitute, and they cost nothing.
If you would rather someone else watched the bank every day than found out at month end, that is what our virtual finance team and management accounts exist to do, and it is the same conversation as getting the payroll and tax money out of harm's way before anyone comes looking for it. If you run a small business that has quietly grown past ten people, this is worth an hour of your week.