September 29, 2026
Authorized push payment fraud happens when a victim is tricked into authorizing a payment to a fraudster themselves. This is different from card fraud or account takeover, where a criminal moves money without the real account holder's knowledge or consent.
With this fraud type, the victim is the one who logs in, enters the details, and hits send. That single fact changes everything about how it gets caught and who ends up liable for the loss. Traditional fraud tools were built around the assumption that a criminal, not the real customer, initiates the transaction, which is precisely the assumption that breaks down here.
The payment itself typically clears instantly and looks completely normal from the bank's side, since it came from a genuine, authenticated account holder.
That is exactly why this type of fraud has become such a difficult problem for banks and payment providers to solve using traditional fraud tools built to catch stolen cards or hacked logins.
Nearly every authorized push payment scam follows the same basic shape, even though the specific story changes. A fraudster builds a convincing reason for the victim to move money quickly, often while creating a sense of urgency or fear that discourages the victim from checking with anyone else first.
That reason might be a fake invoice from a supplier, a call claiming to be from the victim's own bank, or a romantic relationship built over weeks or months before the request for money ever comes up. Whatever the story, it is designed to feel plausible enough that the victim does not pause to question it.
Two-thirds of these cases now start on a digital platform, whether that's a social media message, a dating app, or a fake ad. Another 17% starts with a phone call or text message, often spoofing a legitimate company's number to look convincing.
Once the victim is convinced, they authorize the payment themselves, using their own login credentials and their own device. The money usually moves through a real-time payment rail, which means it can reach the fraudster's account and get moved onward again within minutes, well before most banks would have any reason to intervene.
This fraud category is not one single scam. It covers several distinct patterns, and each one calls for a slightly different detection approach:
This is the most common type by volume, accounting for 71% of all UK cases. A victim pays for goods or services, often through a fake online listing or a seller demanding an unusual payment method, and the item never arrives.
These scams frequently show up on social media marketplaces and classified ad sites, where a listing can be taken down and reposted under a new account within hours of getting reported.
A price that looks noticeably lower than anywhere else, combined with pressure to pay by bank transfer instead of a protected payment method, is a pattern that shows up again and again across real cases.
These represent the largest category by value, with UK losses reaching £221.5 million in 2025 alone, up 40% year on year.
A fraudster promises unusually high, low-risk returns, often using a fake trading platform or a manufactured sense of exclusivity to get the victim to invest larger and larger amounts over time.
Cryptocurrency and foreign exchange trading have become common backdrops for this scam, since both markets have enough real-world volatility to make an implausible return story sound just believable enough.
Victims often see a fake dashboard showing steady gains, which keeps them investing more until they try to withdraw funds and discover the platform never actually held any real money at all.
A fraudster builds a relationship with the victim over weeks or even months, often without ever meeting in person. Once trust is established, they invent a financial emergency and ask for money.
These scams often lead to larger losses because the victim already trusts the fraudster. Many now begin on mainstream dating apps and social platforms.
Fraudsters also use scripted conversations, AI-generated photos, and voice messages to maintain multiple convincing identities at once.
A fraudster impersonates a bank, government agency, or trusted company, often using a spoofed phone number or a convincing fake website.
They claim the victim's account is at risk and persuade them to transfer money to a "safe" account that actually belongs to the fraudster.
These scams are especially convincing because callers can display the bank's real customer service number and often use personal information obtained from previous data breaches to build trust quickly.
A business receives a fake invoice, or a supplier's bank details appear to change, causing a legitimate payment to be sent to a fraudster's account. Because these payments are often large, a single successful attack can result in significant losses.
Fraudsters typically compromise a business email account and monitor conversations for weeks.
They send the fake payment request at the right moment, making it appear as a routine part of an ongoing invoice or delivery discussion.
A fraudster convinces a victim that their bank account has been compromised and instructs them to transfer their money to a "safe" account.
In reality, that account belongs to the fraudster. The scam works because the caller often has enough personal information to appear legitimate. Recent news about data breaches or fraud makes this tactic even more convincing.
Fraudsters also stay on the phone throughout the transfer, preventing victims from stopping to verify the request independently.
A fraudster pretends to be a relative or close friend in urgent need of money, often using a hacked messaging account or AI-generated voice clone to sound convincing. The initial request is usually for a small amount to avoid suspicion.
These scams have become more believable with voice cloning technology, which can recreate a loved one's voice from a short audio clip.
Fraudsters also create urgency by contacting victims late at night or when the real person is unlikely to be reachable.
The mechanics stay similar everywhere, but the specific risk profile shifts depending on which payment method carries the transfer.
Given below, is a deeper dive on how APP fraud shows up across different payment rails:
These rails settle within seconds, which is exactly why they have become the preferred channel for this kind of fraud.
Once a payment clears, there is essentially no window left to intervene before the money reaches the fraudster's account and potentially moves onward again.
Consumer-facing transfer apps often carry lighter friction by design, since speed and convenience are core to the product experience.
That same design choice makes them an attractive target, since a scammer can walk a victim through a transfer in a familiar, low-friction interface they already trust.
International transfers add another layer of complexity. Recovering funds across borders often involves multiple banks, jurisdictions, and currencies, slowing the response.
Fraudsters exploit this delay.
Business email compromise and mandate fraud schemes frequently route stolen funds internationally, giving criminals more time to move the money before recovery efforts begin.
Several factors are driving APP fraud higher, and none are likely to reverse on their own:
While anyone can fall victim to this fraud type, certain groups face disproportionate risk, and understanding why helps shape smarter detection and prevention.
Recognizing these patterns also helps institutions decide where to focus limited fraud team resources first, since not every customer segment carries the same level of exposure:
Investment and romance scams disproportionately target older adults, partly because fraudsters assume larger savings balances and partly because these scams rely on patience and a longer relationship-building period that a busier, younger target might not tolerate.
Financial institutions serving an older customer base often see a higher proportion of high-value cases as a result.
Invoice and mandate fraud specifically targets business accounts, since a single successful attempt against a company can yield a much larger payout than a typical consumer scam.
Smaller businesses are especially vulnerable, since they often lack the dedicated finance staff and formal verification processes that larger companies use to double-check unusual payment requests.
Someone using a new banking app, a new digital wallet, or a new investment platform for the first time is less familiar with what normal behavior looks like on that platform, which makes it harder for them to recognize when something feels off.
Fraudsters specifically target onboarding moments and early account activity for this reason.
Scams that promise a quick financial fix, whether through an investment opportunity or a supposed emergency involving a loved one, land hardest on people already dealing with financial stress or an emotionally vulnerable moment.
This is precisely why urgency and emotional pressure remain the two most consistent ingredients across nearly every authorized push payment scam.
While the UK's mandatory reimbursement scheme and the EU's PSD3 framework get the most attention, similar pressure is building in other markets too.
Australia introduced its own mandatory industry codes targeting banks, telecommunications companies, and digital platforms, reflecting a similar view that no single sector should bear the full burden of stopping this fraud alone.
Singapore has taken a comparable approach, assigning shared responsibility across banks and telecom providers for losses tied to scam calls and messages.
The pattern across these markets is consistent: regulators increasingly expect financial institutions to demonstrate active fraud prevention, not just after-the-fact reimbursement.
A bank that can show it caught a mule account pattern early, or that it flagged a suspicious payment before it cleared, is in a materially different position than one relying entirely on manual customer complaints to catch fraud after the damage is already done.
The direct financial loss is only part of the picture. This fraud type now carries real regulatory and reputational weight for the institutions involved, not just the victims.
In the UK, a mandatory reimbursement scheme took effect in October 2024, requiring payment providers using Faster Payments or CHAPS to reimburse eligible victims, with the cost split between the sending and receiving institution.
Around 89% of in-scope losses were reimbursed within the first 15 months, and banks paid out £354.3 million to victims in 2025 alone.
That shift matters enormously for how banks and payment providers think about this fraud. A payment that clears normally can still turn into a direct financial liability weeks later, once a victim reports the scam and a reimbursement claim gets filed.
The European Union is heading in a similar direction. PSD3 reached political agreement in late 2025, with final compromise texts published in April 2026, and a phased rollout expected to stretch into 2027 and 2028.
Once in force, it is expected to introduce reimbursement protections modeled closely on the UK's approach. For institutions still relying on manual fraud reviews or basic transaction limits, this regulatory shift changes the math entirely.
The cost of missing a case is no longer just reputational. It is now a direct, quantifiable financial exposure that regulators are actively measuring and reporting on.
Detecting this fraud type is fundamentally harder than catching stolen card fraud, since every signal that would normally raise a flag looks completely normal. The right account holder is logged in, using their usual device, entering their own correct credentials.
That means detection has to shift from asking "is this the real account holder" to asking "does this payment fit how this person actually behaves." A few signals consistently show up across real cases.
None of these signals work well in isolation, and that is worth stating plainly before going through them one by one.
A model built to catch this fraud type needs to weigh several of these factors together, since a fraudster who has studied a bank's detection rules will often manage to avoid triggering any single check on its own.
Here’s how you can detect APP fraud:
A payment going to a brand-new payee, especially one that has never received money from this account before, is one of the more reliable early signals, particularly when paired with an unusually large amount.
This signal gets stronger when the new payee also happens to be a business or individual account that has recently started receiving payments from several unrelated senders.
A single new payee on its own is common and mostly harmless, but a new payee that fits a known scam or mule pattern deserves a much closer look.
A victim being coached by a fraudster on a phone call often behaves differently than usual: hesitating at unfamiliar screens, pausing to read instructions aloud, or moving through a transfer more slowly and carefully than their typical pattern.
These behavioral shifts are subtle enough that a human reviewer would rarely catch them without dedicated tools, since nothing about the transaction itself looks wrong.
Session analytics that track typing rhythm, mouse movement, and time spent on each screen can surface this kind of coaching pattern even when every other signal on the payment looks completely routine.
A sudden transfer that represents an unusually large share of an account's typical balance, especially one requested urgently, deserves a closer look before it clears.
Fraudsters coaching a victim often push for the maximum amount available in a single transaction, since they rarely get a second chance once a victim starts to suspect something is wrong.
A model that compares a requested transfer against an account's historical spending pattern, rather than relying on one fixed dollar threshold for every customer, catches this kind of outlier far more reliably.
Many fraudulent payments end up in accounts that have already received unusual inflows from other unrelated senders in a short window. Flagging a receiving account with this kind of pattern can stop a payment before it settles, even when the sending side shows no obvious red flags at all.
Mule accounts frequently show a distinctive pattern of rapid inflows followed almost immediately by outbound transfers to yet another account, since the goal is to move stolen funds along before anyone can freeze them.
Sharing this kind of pattern data across institutions, rather than relying on each bank to spot it independently, dramatically shortens how long a mule account stays active before getting shut down.
A payment reference mentioning romance, investment platforms, or urgent account security issues, combined with a first-time payee, is a pattern worth building specific detection logic around.
Fraudsters occasionally coach victims to leave a payment reference blank or use a vague description specifically to avoid triggering keyword-based checks, which is itself a signal worth flagging.
A payment with no reference at all, sent to a first-time payee for an unusually large amount, often warrants the same scrutiny as one with an explicitly suspicious description.
A customer who calls to ask unusual questions right before making a transfer, such as how quickly a payment clears or whether it can be reversed, is often being coached in real time by someone on another line. These questions rarely come up during a routine, self-directed transfer.
Contact center staff are often in the best position to catch this signal, provided they are trained to recognize it rather than simply answer the question and move on.
A customer who seems distracted, repeats questions they were already given a clear answer to, or appears to be relaying information to someone else in the background deserves a more careful conversation before the transfer proceeds.
A login from an unfamiliar device, followed immediately by a high-value transfer to a new payee, deserves extra scrutiny even when the credentials entered are completely correct. Fraudsters increasingly walk victims through screen-sharing sessions to guide the payment themselves, which leaves a device fingerprint that does not match the account's usual pattern.
Screen-sharing software leaves detectable traces that a well-built detection system can pick up on, even though the victim is technically the one controlling the device throughout the session.
Combining device fingerprinting with screen-sharing detection catches a growing share of cases where a fraudster remotely guides a victim through the entire payment process step by step.
No single control stops all of this fraud on its own. Effective prevention layers several approaches together, since a coached victim can talk their way past almost any single check if given enough attempts. The strategies below split roughly into three groups: stopping the payment before it sends, catching it once it lands somewhere suspicious, and recovering quickly when prevention fails.
A mature program needs all three, since no institution catches every case at the first stage alone.
That being said, here are strategies to prevent APP fraud:
Verifying that a payee's name matches the account details on file catches a meaningful share of impersonation and invoice fraud attempts, since fraudsters often cannot control the name attached to their receiving account.
This check works best as an early warning rather than a hard block, since a partial name mismatch sometimes reflects a legitimate reason like a recent marriage or a business trading under a different name.
Showing the account holder's actual registered name to the customer before they confirm the payment gives them one more real chance to notice something is wrong.
Scoring a session for unusual hesitation, navigation patterns, or signs that someone is reading instructions from another source adds a layer that transaction data alone cannot provide.
This kind of monitoring works continuously in the background, so it adds no visible friction for the vast majority of customers moving through a completely normal transfer.
The value comes from catching the small share of sessions where behavior genuinely deviates from someone's usual pattern, which a fixed rule built around transaction amount alone would never notice.
Adding a warning, a short delay, or an extra confirmation step for first-time, high-value payments gives customers a chance to stop and reconsider before completing the transaction, without adding friction for most legitimate payments.
The warning itself matters just as much. Generic messages are easy to ignore.
Warnings tailored to the specific scam pattern, such as an investment scam involving a crypto exchange, are far more likely to make customers pause and reconsider.
Since stolen money has to end up somewhere, monitoring receiving accounts for mule-like activity can catch fraud that sending-side controls miss. Key signals include rapid inflows from multiple unrelated sources followed by immediate outbound transfers.
This also helps protect customers whose accounts have been unknowingly recruited or hijacked as money mules.
Freezing a receiving account as soon as this pattern appears, rather than waiting for a fraud report, can prevent additional victims from sending money to the same account.
A fraudster rarely targets just one bank. Sharing intelligence on known fraudulent accounts and transaction patterns helps institutions detect threats that would otherwise go unnoticed.
A mule account flagged by one bank is often already active elsewhere.
Even sharing confirmed fraud cases gives participating institutions stronger protection than relying only on their own transaction data.
Simple, well-timed warnings that describe the specific scam a payment resembles are far more effective than generic fraud alerts.
They give customers a reason to pause before sending money. Public awareness campaigns reinforce these warnings.
Customers who recognize common scam patterns are much more likely to spot and avoid them when targeted.
Fraud doesn't only happen online. Customers may also call to request an urgent transfer or visit a branch to withdraw money for a supposed emergency. Staff need to recognize the warning signs and respond carefully.
The best approach is to ask open-ended questions, not follow a rigid checklist.
Asking customers to explain why they need the money and how they know the recipient often reveals inconsistencies that scripted yes-or-no questions miss.
Even the best prevention measures won't stop every case. That's why banks need a fast process to freeze receiving accounts as soon as fraud is reported.
Every minute of delay reduces the chances of recovering stolen funds. A clear escalation path is essential.
Teams that can freeze funds immediately, without lengthy approvals, consistently recover more money than those that respond reactively.
Most institutions start with basic rules such as flagging first-time payees, delaying large transfers, or displaying warning messages. Fraudsters quickly learn these thresholds and adapt.
That's why effective fraud prevention focuses on behavior, not fixed rules.
Fraudio's A2A Transfer Monitoring combines real-time risk scoring with entity-level behavioral profiling, analyzing transaction patterns, device signals, and counterparty relationships to identify mule accounts before more victims are affected.
Because Fraudio's intelligence is centralized, fraud patterns detected at one institution help protect others.
The platform deploys in days to weeks, with usage-based, pay-per-transaction pricing that decreases as volume grows, and no setup, implementation, or maintenance fees.
We built Fraudio's A2A Transfer Transaction Monitoring around a simple idea: this fraud type should get caught by looking at behavior and account relationships, not just a transaction amount that a coached victim can easily move under.
Our centralized dataset scores mule account patterns and scam signals across payment types, and deployment typically takes days to weeks instead of the 5 to 14 months a legacy platform demands. Customers like Viva Wallet have seen fraud caught 3 weeks earlier than with their legacy setup, alongside an 8x return on investment.
Fraudio's centralized model already protects 2 billion transactions across 188 countries, so scam and mule patterns caught at one institution strengthen detection for every other connected customer from day one
This approach is built for issuers, digital banks, wallet providers, and payment facilitators that are watching reimbursement costs climb under mandatory schemes like the one now in force in the UK, with a similar approach expected across the EU under PSD3.
If your current setup only flags large, unusual transactions and misses the slower-building mule and scam patterns behind them, there is a faster and more accurate way to run fraud detection.
Request a Proof of Results test by sharing your historical transaction data, and see exactly how our detection compares against your current setup, with no commitment required.
Authorized push payment fraud is when a victim is tricked into authorizing a payment to a fraudster themselves, rather than having money stolen without their knowledge. It differs from card fraud since the real account holder logs in and sends the payment personally, which makes it much harder for banks to catch using traditional fraud checks. In the UK alone, this fraud type accounted for £576.4 million in losses in 2025.
This fraud type involves a victim knowingly sending a payment, even though they were deceived about the reason for doing so. Unauthorized fraud, by contrast, happens when a criminal moves money without the account holder's knowledge or consent at all, such as through a stolen card or a hacked login. This distinction matters enormously for liability, since who pays for the loss often depends on which category a case falls into.
Purchase scams are the most common type by volume, making up 71% of all reported UK cases in 2025. In this scam, a victim pays for goods or services that never arrive, often through a fake online listing. Investment scams cause higher losses per case, but purchase scams happen far more frequently overall.
Yes, banks can be held liable for these losses under mandatory reimbursement rules now in force in several markets. In the UK, payment providers using Faster Payments or CHAPS must reimburse eligible victims, with costs split between the sending and receiving institution, and around 89% of in-scope losses were reimbursed within the first 15 months of the scheme. Similar reimbursement rules are expected across the European Union under PSD3.
Authorized push payment fraud is hard to detect because the real account holder authorizes the transaction themselves, using their correct login and their usual device. Every signal that would normally indicate fraud, like a matching identity and a familiar device, looks completely normal here. Detection has to shift toward behavioral signals and account relationship patterns instead of identity verification alone.
Yes, real-time payment rails have made this fraud significantly worse, since instant transfers remove the delay that used to give banks time to flag a suspicious payment before it settled. Once a payment clears, recovering the funds depends entirely on how quickly the receiving institution can freeze the account. This is a major reason this fraud type has grown faster than most other fraud categories in markets with real-time payments.
Contact your bank immediately if you believe you have sent money to a scammer, since faster action gives the receiving institution a better chance of freezing the funds before they move again. Report the case formally, since many markets now require a formal report before a reimbursement claim can be considered. Do not contact the suspected fraudster directly, and avoid sending any further payments in an attempt to recover the loss yourself.
Fixed transaction limit rules catch some obvious cases, but a fraudster coaching a victim can easily structure payments to stay under a known threshold once they learn where it sits. These rules also do nothing to catch a mule account receiving smaller amounts from several different victims at once. Layering behavioral signals, velocity patterns, and receiving-side APP fraud prevention on top of basic limits catches significantly more fraud than limits alone.
How about trying our solution and experiencing the next generation for yourself?
