Book a demo

United Kingdom

UK scam and impersonation rules, explained.

There's no single UK scams law. The Online Safety Act, the APP fraud refund rules and Ofcom's telecoms rules do the work. Here's what they mean when fakes use your name, and how Unphish finds them, takes them down and keeps the evidence.

Book a demoRequest a takedown
Legislation briefUK

Online Safety Act 2023 and the APP fraud reimbursement rules

In forceOfcom’s final scam ad codes due by mid-2027
Applies to
Online platforms, search services, banks and payment firms
Regulators
Ofcom for online safety, the PSR (moving into the FCA) for scam refunds
Platforms
Must reduce and remove fraud. Fraud is a priority offence under the Online Safety Act
Refunds
Most APP scam victims can be refunded up to £85,000, split between the two payment firms
Max penalty
Up to £18m or 10% of worldwide revenue (Online Safety Act)

No single UK scams law. Summary as of October 2026, not legal advice.

What the rules cover

Six ways UK rules reach impersonation.

What each one covers, in plain words, and what Unphish does for it.

Online Safety Act

Platforms must reduce and remove fraud, including fake accounts.

We find fake accounts and pages using your name and report them to the platform.

Scam ads

The biggest platforms and search engines will have to tackle paid scam ads.

We report scam ads using your name and track what happens to each one.

APP scam refunds

Banks and payment firms refund most APP scam victims, up to £85,000.

We take down the fake sites and accounts that trick people into paying.

Calls and texts

Ofcom expects phone companies to block calls from invalid or spoofed numbers.

We take down the scam sites that texts and calls point people to.

Trade marks and domains

Trade mark law, passing off and Nominet’s dispute service cover lookalike names.

We watch for lookalike domains and request suspension from registrars and hosts.

Reporting fraud

Report Fraud is the national service for reporting fraud and cybercrime.

We give you case packets you can pass to police, platforms and counsel.

Based on the Online Safety Act, the PSR’s APP reimbursement rules and Ofcom guidance. Summary as of October 2026.

Key dates

Where the UK rules are up to.

  1. 7 Oct 2024APP scam refunds start

    Up to £85,000 per claim

    Done
  2. 17 Mar 2025Illegal content duties apply

    Platforms must tackle fraud

    Done
  3. 10 Jul 2026Biggest services named

    Draft scam ad codes published

    Done
  4. 2 Oct 2026Scam ad consultation closes

    Ofcom reviews responses

    Done
  5. Dec 2026Refund rules review

    PSR consults on changes

    Next
  6. By mid-2027Final scam ad codes

    Duties for the biggest platforms

    Coming

Dates from Ofcom, the PSR and UK Finance. Later steps may change.

Who it covers

Who the UK rules reach.

The duties sit with platforms, search engines and payment firms. Brands being copied don't have a direct duty.

PlatformsOfcom

Social media, messaging and other sites where users post must reduce and remove fraud, including fake accounts.

01
SearchOfcom

Search engines must minimise fraud in their results. The biggest will have to tackle scam ads too.

02
BanksPSR

Sending and receiving payment firms split the cost of refunding most APP scam victims.

03
BrandsNo direct duty

The rules protect your customers, but finding and removing fakes using your name is still up to you.

+
£1.28bnstolen by fraudsters in 2025
£576mlost to authorised push payment scams, up 19%
66%of APP scam cases started online

Source: UK Finance Annual Fraud Report 2026, covering 2025.

Check your business

What do the UK rules mean for you?

There’s no single UK scams law, so it depends on your business. Pick the one closest to yours.

What to do now

    A general guide, not legal advice. Check your position with your legal team.

    What’s at stake

    Why getting this right matters.

    Fraud losses£1.28bn

    Stolen by fraudsters in the UK in 2025, according to UK Finance.

    APP scams£576m

    Lost to authorised push payment scams in 2025, up 19% on the year before.

    Max fine10%

    Of worldwide revenue, or £18 million if higher, under the Online Safety Act.

    What we take down, across all clients

    98%of scam websites99%of phishing sites99%of impersonation accounts92%of fake apps

    Loss figures from UK Finance; fine levels from the Online Safety Act. Our results cover all Unphish clients, January to June 2026, rounded.

    Who’s accountable

    Who owns impersonation in your business.

    Dealing with fakes spreads across teams. Here’s a typical split, and where Unphish fits.

    TeamMonitorEvidenceTakedownReportLegalCustomers
    Fraud and financial crimeMonitorEvidenceTakedownReportLegalCustomers
    SecurityMonitorEvidenceTakedownReportLegalCustomers
    Legal and complianceMonitorEvidenceTakedownReportLegalCustomers
    Marketing and socialMonitorEvidenceTakedownReportLegalCustomers
    Customer careMonitorEvidenceTakedownReportLegalCustomers
    UnphishMonitorEvidenceTakedownReportLegalCustomers
    LeadsSupportsA typical split. Yours may differ.

    Around the world

    How the UK compares.

    WhereMain rulesWho it coversImpersonationPenalties
    Australia Main rulesScams Prevention Framework (SPF)Duties from 31 Mar 2027 Who it coversBanks, telcos and digital platforms ImpersonationDraft codes: protect official channels, monitor, request removal PenaltiesUp to $50m, 3x the benefit or 30% of turnover View → United States Main rulesFTC Impersonation RuleIn force since Apr 2024 Who it coversAnyone impersonating a government agency or business ImpersonationImpersonating a business is unlawful. FTC asking about platform ad tools PenaltiesUp to $53,088 per violation, plus refunds to consumers View →
    United Kingdom Main rulesOnline Safety Act and APP fraud reimbursementScam ad codes in draft Who it coversOnline platforms, search services and payment firms ImpersonationPlatforms must tackle fraud. Draft codes add scam ad takedown PenaltiesUp to £18m or 10% of worldwide revenue You’re here
    European Union Main rulesDigital Services Act and Payment Services RegulationPSR not yet applying Who it coversOnline platforms and payment service providers ImpersonationNotice and action on illegal content. PSR adds impersonation fraud refunds PenaltiesUp to 6% of global turnover (DSA) View → Singapore Main rulesShared Responsibility FrameworkIn force since Dec 2024 Who it coversBanks and telcos ImpersonationCovers phishing scams impersonating legitimate businesses PenaltiesBanks and telcos that miss their duties cover losses View →

    A simplified summary as of October 2026, not legal advice. Rules and dates change, so check the source for your obligations.

    Get ready

    Your UK impersonation checklist.

    A starting point for dealing with fakes using your name in the UK. One list to get set up, and one for every month after that.

    UK impersonation checklistBrand impersonation

    Get set up

    • List your official channels: domains, accounts, apps, numbers and sender IDs.
    • Set up monitoring for lookalikes and impersonation.
    • Agree how fakes are reported and removed, and by whom.
    • Know where to report: reportfraud.police.uk, 7726 for scam texts, and each platform’s own tools.
    • Decide what you’ll record and who signs off.

    A starting point, not legal advice.

    Checklist
    UK impersonation checklistBrand impersonation

    Every month

    1. Review the new impersonation found.
    2. Check what was taken down and what’s still live.
    3. Keep evidence and timestamps for every case.
    4. Report repeat offenders to platforms and Report Fraud.
    5. Update your list of official channels.

    Keep records for as long as your legal team advises.

    Checklist

    Read the source

    legislation.gov.ukOnline Safety Act 2023 OfcomDraft scam ad codes (July 2026) UK FinanceAnnual Fraud Report 2026 Report FraudReport fraud and cybercrime

    FAQ

    UK scam rules questions, answered.

    Is there one UK law for scams?

    No. Ofcom enforces the Online Safety Act for online platforms and search engines, the Payment Systems Regulator runs the APP fraud refund rules (its work is moving into the FCA), and Ofcom also sets rules for phone companies. Fraud itself is a crime under the Fraud Act 2006.

    What does the Online Safety Act mean for fake accounts?

    Fraud is a priority offence under the Act. Since 17 March 2025, social media, messaging and search services have had to assess the risk of fraud on their service, reduce it, and remove fraudulent content quickly when they know about it. That includes fake accounts posing as businesses.

    When do the scam ad rules start?

    Not yet. Ofcom published draft codes for the biggest platforms and search engines on 10 July 2026 and consulted until 2 October 2026. It plans to publish the final codes by mid-2027 at the latest.

    How do APP fraud refunds work?

    Since 7 October 2024, most people tricked into sending a payment by Faster Payments or CHAPS can be refunded up to £85,000 per claim. The sending and receiving payment firms split the cost. The PSR plans to consult on changes in December 2026.

    How does Unphish help?

    We monitor for impersonation of your business 24/7, take down the fakes we find, and link related fakes into campaigns. Every case keeps its evidence, timeline and outcome, ready to share with platforms, police or your legal team.

    What are the penalties?

    Under the Online Safety Act, Ofcom can fine a service up to £18 million or 10% of its qualifying worldwide revenue, whichever is higher. Scammers themselves face criminal charges under the Fraud Act.

    Is this page legal advice?

    No. This page is a general guide to UK scam and impersonation rules and how Unphish can help. Check your obligations with your legal team.

    Solutions for UK impersonation

    The tools behind your record.

    01Threat MonitoringFind fakes using your name, 24/7.Learn more →02TakedownGet scam sites, accounts and ads removed.Learn more →03Threat IntelligenceLink campaigns and share what you find.Learn more →04Domain ProtectionCatch lookalike domains early.Learn more →

    Industries most affected

    See all solutions →

    Try it

    True or false?

    Five quick statements about UK scam rules. Which are true?

    The rules protect your customers, but finding and removing the fakes using your name is still up to you. We can help.

    Talk to us →

    See your impersonation record.

    Book a demo and we'll show you how Unphish finds the fakes using your name, takes them down and keeps the evidence.

    Book a demoRequest a takedown