The UK Fraud Strategy 2026–2029 and the Online Crime Centre: Implications for Bank Fraud Detection

Two Responses to the Same Problem

The Online Crime Centre

In March 2026 the government published the Fraud Strategy 2026–2029, carrying £250 million in funding over three years. The strategy took shape through fifty roundtables with financial services, telecoms, technology, law enforcement and victim organisations.¹

Its centrepiece is the Online Crime Centre (OCC): a £31 million public-private intelligence hub the Home Office and National Crime Agency lead together, operating from April 2026. The OCC’s mandate is direct. Identify and dismantle the accounts, websites and phone networks that organised fraud relies on.

The Online Crime Centre is not another layer of financial services compliance. It is a national infrastructure play: cross-sector, intelligence-led and designed to operate upstream of everything the fraud industry currently does. The aim is reducing the volume of fraud reaching your customers at all.

The reimbursement requirement

You will already be well-versed in the other half of this picture. Since October 2024, payment service providers have operated under the PSR’s mandatory reimbursement requirement. The framework requires institutions to reimburse victims of Authorised Push Payment fraud, with liability split 50/50 between sending and receiving institutions.

The FCA will absorb the PSR’s oversight functions with legislation expected by end of 2026. The substance of the obligation stays the same; only its regulatory home changes.⁸

Towards fraud prevention

These two developments address different dimensions of the same problem. The reimbursement requirement manages the financial consequences of fraud that has already occurred. The Online Crime Centre aims to reduce the volume of fraud that occurs at all. Both are necessary. Neither, on its own, is sufficient.

The interaction between them is what this series is about: the fraud kill chain, where intervention is most effective, and where the regulatory direction of travel now consistently points.

The expectation of upstream detection from financial services matches what the industry has called for. The Online Crime Centre operationalises it at scale. The practical question is what contributing to that actually requires and how it connects to your existing investment in fraud prevention. That is what the rest of this piece addresses.

Where Transaction-Layer Detection Operates and Where It Runs Out

The structural timing problem

UK bank fraud teams have built genuinely sophisticated detection capabilities. Behavioural analytics, payment friction, transaction monitoring and vulnerability flagging have all improved substantially. Those controls prevent a significant volume of fraud.

The limitation that persists is structural rather than one of capability or investment. Transaction-layer detection operates at a point in the fraud journey where manipulation has already done its work in APP fraud cases.

When a consumer falls victim to an impersonation scam, the sequence of events unfolds before your systems see anything. A convincing smishing link, a spoofed portal, a call from someone who appears to have authority: by the time a payment instruction arrives, the consumer genuinely believes they act voluntarily and legitimately.

The transaction monitoring signal arrives after that belief forms. The intervention window is by its nature late and narrow.

What the reimbursement data actually shows

The PSR’s own data shows that in the first year of mandatory reimbursement, 88% of money lost to in-scope APP scams returned to victims.⁴ That is a meaningful outcome for consumers and reflects genuine operational effort across the industry.

It does not mitigate the underlying cost. Reimbursing 88% of losses is not the same as preventing them. The tap is still running; the industry has just got better at mopping the floor.

That is the gap the Online Crime Centre addresses at a national level. It also creates the most direct pressure on bank fraud detection architecture: the fraud that most drives reimbursement liability is precisely the fraud that transaction monitoring cannot reliably stop. By the time it becomes visible, the consumer’s decision is already made.

The OCC as Cross-Sector Infrastructure

Who owns the APP fraud problem

The OCC’s design reflects a consensus that has built for years across the fraud prevention landscape: no single sector owns the APP fraud problem and no single sector can resolve it.

Fraud reaches consumers through a chain of infrastructure (social media platforms, search results, telecoms networks, spoofed websites and payment systems) spanning multiple industries and regulatory regimes. The OCC addresses this chain collectively for the first time.

The Fraud Strategy 2026–2029 sets out direct expectations for each sector in parallel, not in sequence. Technology platforms must share signals and remove fraudulent content at pace. Telecoms providers must maintain maximum scam blockage and contribute emerging threat data. Financial services must drive upstream detection and share intelligence swiftly. Law enforcement and intelligence agencies, including the NCSC and elements of the UK Intelligence Community, sit within the OCC itself.¹

The legal foundation for data sharing

It is worth being direct about the context here. Banks have carried a disproportionate share of the reimbursement burden for fraud that frequently originates outside their systems and beyond their direct control. The frustration this generates within the industry is legitimate.

The Fraud Strategy’s multi-sector architecture acknowledges it: the OCC exists because financial services cannot solve the fraud infrastructure problem alone. The Strategy distributes accountability across every sector that forms part of the fraud delivery chain.

The OCC draws on precedents from Singapore and Australia, where comparable cross-sector disruption hubs have delivered measurable upstream impact. The architecture for participation exists. The question for each institution is what they can contribute to it.

The Converging Pressures on Fraud Detection Architecture

What the regulatory environment now rewards

The practical consequence of this landscape for fraud and financial crime leaders is sustained pressure toward earlier detection. No single framework mandates a specific architectural change today. Several together reward it.

The mandatory reimbursement requirement creates a direct financial incentive to reduce APP fraud volume rather than manage its consequences. The Online Crime Centre creates a policy architecture and legal basis for cross-sector intelligence sharing that had no structured equivalent before.

The Fraud Strategy signals that upstream detection performance is now under scrutiny. The Fraud Minister has been explicit: “Where this doesn’t stack up, I just give notice that new initiatives and incentives may be needed.”⁷ FCA Consumer Duty creates an obligation to prevent foreseeable financial harm — which is more naturally satisfied by earlier intervention.

None of these frameworks specifies the technical form that earlier detection should take. Neither the reimbursement requirement nor the OCC targeted a specific detection architecture in its design. What they do, collectively, is describe an environment that consistently rewards getting further upstream. What that requires in practice is the subject of the next article: The Fraud Journey Your Systems Never See.