Authorized Push Payment Fraud
What is Authorized Push Payment Fraud?
Authorized push payment (APP) fraud is a scam in which a bank customer is manipulated or deceived into approving a payment to an account that a criminal controls. Because the transfer carries the customer's own credentials, device information and consent, authorized push payment fraud bypasses the traditional controls built to detect fraudulent transactions, such as device checks and step-up authentication.
The term covers any case in which the account holder starts a transfer of money after being manipulated, instead of having it removed from their account without consent or knowledge via stolen credentials or withdrawn during an account takeover. Other names for the same scam include push payment fraud, APP fraud, APP scams and authorized push payment scams. The UK Financial Conduct Authority (FCA) Handbook defines it as a transfer in which the payer was deceived into paying someone other than the intended recipient, or paid for what they believed were legitimate purposes that were in fact fraudulent.
Scammers persuade payers by impersonating a bank, a supplier, an employer or a government body, or by offering fake investments and romance. The payment itself looks ordinary, and only the reason given for making it is false. The term applies to push payments, which the payer initiates, and not to pull payments such as card transactions, where card scheme chargeback rights exist.
How does authorized push payment fraud work?
Authorized push payment fraud follows four stages, and only the second one appears in the payment record.
- Contact and manipulation. A criminal builds a believable reason for a payment, often by impersonating an organization the payer already expects to hear from, and applies time pressure so the payer does not verify through a separate channel.
- Authorization. The payer logs in normally and approves the transfer, so the transaction data shows correct credentials, a known device and behavior that fits the account's history.
- Receipt. The funds arrive in an account opened or bought to receive them, often under a synthetic or coerced identity. That account may be held by a money mule, a person who receives and moves stolen funds for criminals, knowingly or not.
- Dispersal. The funds are split across further accounts, moved between institutions and payment rails, and cashed out. Research from the Global Anti-Scam Alliance and Feedzai indicates that nearly half of scams run from first contact to payment inside 24 hours, so all four stages can finish in a single day.
How is authorized push payment fraud different from unauthorized fraud?
The difference is consent. In unauthorized fraud, a criminal moves money without the account holder's knowledge, which can leave failed authentication, an unfamiliar device or unusual behavior for traditional rules-based controls to catch. In authorized push payment fraud, the account holder makes the transfer personally, so credential, device and step-up authentication checks all pass as normal. Detection therefore has to draw on evidence outside the authorization record, because the payment itself looks like ordinary customer activity.
What are examples of authorized push payment fraud?
Authorized push payment fraud takes many forms, and the following scenarios show how different pretexts lead a payer to approve the transfer.
Supplier impersonation:
- A finance team receives notice that a known supplier has changed its bank details, which matches an invoice cycle already underway.
- The payment clears dual authorization.
- The funds reach a mule account the same day.
Safe-account transfer:
- A customer takes a call from someone presenting as the bank's fraud team.
- The caller says the account is compromised.
- The customer moves the balance to a "safe account" named on the call.
Investment offer:
- A customer transfers funds in stages to a trading platform that issues convincing statements.
- The platform allows one small early withdrawal.
- Access is blocked as the deposits grow.
How much does authorized push payment fraud cost?
UK losses alone ran to hundreds of millions of pounds in 2025, and four figures show how the cost breaks down.
- Total losses. UK Finance recorded £576.4 million in APP scam losses across 248,070 cases in 2025, with losses up 19% and cases up 7%, so each case now costs more.
- Who bears them. Of that total, £354.3 million was reimbursed to victims, about 61% of APP losses, so most of the loss now falls on the banks that reimbursed it.
- Europe. The European Central Bank and European Banking Authority put EEA credit transfer fraud at €2.5 billion for 2024, up 24%, which shows losses rising outside the UK too, although that measure covers credit transfer fraud broadly and not only APP scams.
- Speed. ACI Worldwide projects that 80% of APP scam value will move on real-time payment rails by 2028, which shortens the time between a victim's decision and a payment that cannot be recalled.
Who is liable for authorized push payment fraud losses?
Liability depends on the country, and the rules are still changing in several markets. In the UK, rules announced by the Payment Systems Regulator in 2023 and in force since October 2024 require banks to reimburse eligible APP scam victims, with the cost shared between the sending and receiving firms.
Other regimes impose prevention or detection duties without automatic reimbursement, and some leave liability to institutions' own policies. Mandates, caps and effective dates differ, so any specific obligation should be confirmed for the market concerned.
How can banks detect authorized push payment fraud?
Banks detect authorized push payment fraud by reading signals beyond the payment, mostly on the receiving side, because the payment itself passes every authorization check. Four signals carry most of the evidence:
- The beneficiary account, with unexpected credit velocity and rapid dispersal of the full balance.
- The identity used to open that account.
- Device reuse across unrelated accounts.
- The onward flow of funds across accounts and rails.
Inbound monitoring on the receiving account can show activity that outbound scoring on the sending side cannot, and the signals are most useful when read together.
Talk with a fraud solutions consultant
Each institution's exposure depends on its own payment rails, customers and data. Banks that want to assess theirs can learn more by booking a meeting with FraudNet's solutions consultants.
Related terms
- Money mule
- Impersonation scams
- Social engineering
- Entity resolution
- Fraud prevention
- Confirmation of Payee
%20(640%20x%201229%20px).png)
Get Started Today
Experience how FraudNet can help you reduce fraud, stay compliant, and protect your business and bottom line
You might be interested in…
