Table of Contents
Authorized Push Payment (APP) fraud occurs when a person or business is manipulated into authorising a payment to an account controlled by a fraudster. Unlike unauthorised fraud, the customer initiates and authenticates the transaction themselves, which makes the payment appear legitimate and much harder to reverse.
For banks, fintechs, payment service providers and other regulated financial institutions, APP fraud is now one of the most urgent payment-fraud risks. UK Finance reported £576.4 million in APP fraud losses across 248,070 cases in 2025, up 19% year on year. As instant payments expand, institutions have less time to detect suspicious behaviour before money moves through mule accounts, while reimbursement rules and customer-protection expectations raise the cost of getting controls wrong.
Effective APP fraud detection requires more than transaction rules. It needs transaction, behavioural, device, beneficiary and network intelligence working together within a broader fraud monitoring framework. This article explains how APP scams work, how they differ from unauthorised fraud, why they are difficult to detect, which indicators and prevention controls matter most, how APP fraud connects with AML risk, and how ZIGRAM helps institutions detect, prevent and manage APP fraud exposure in real time.
What Is Authorized Push Payment Fraud?
Authorized Push Payment fraud is a payment scam in which a victim is deceived into sending money to a fraudster-controlled account. The payment is “authorised” because the victim approves it, but the decision is based on manipulation, impersonation or coercion.
Fraudsters may impersonate banks, police, tax authorities, suppliers, investment firms, family members, romantic partners or senior executives. The scam may involve a single urgent transfer or weeks of grooming before the victim sends funds.
APP Fraud vs Unauthorised Fraud
Feature | APP fraud | Unauthorised fraud |
|---|---|---|
Who initiates payment? | Victim, under deception | Fraudster, without consent |
Main attack method | Social engineering | Account, card, or credential compromise |
Authentication | Often appears valid | Often shows compromise signals |
Detection challenge | Context is suspicious, not always the login | Technical anomalies may be clearer |
Recovery | Difficult once funds move | Chargeback or dispute routes may exist |
The key lesson for banks is simple: authentication does not prove that a payment is safe.
How APP Scams Work
Most APP scams follow a similar lifecycle:
Contact: The fraudster reaches the victim through phone, email, SMS, social media, marketplace platforms, or messaging apps.
Trust-building: The criminal impersonates a trusted person or institution and uses personal details to appear credible.
Pressure: The criminal convinces the victim to act quickly by exploiting the victim’s trust with a believable story, threat, or authority cue.
Payment instruction: The victim is told to transfer money to a “safe account,” new supplier account, investment account, or emergency recipient.
Fund movement: Money is quickly moved through mule accounts, cash-out channels, or further transfers.
Common APP scam types include purchase scams, investment scams, romance scams, impersonation scams, invoice redirection, CEO fraud, family/friend impersonation and advance-fee scams, and educating customers about common authorised push payment scams can help reduce fraud risks.
Purchase scams made up 71% of APP cases in the UK in 2025, while investment fraud caused the highest losses at £221.5 million, according to UK Finance, and fake investment scams can drain personal savings and retirement funds.
Why APP Fraud Is Difficult to Detect
APP fraud is difficult because criminals attack the customer’s decision-making process rather than only the payment infrastructure.
The customer may log in normally, use their usual device, pass authentication, and approve the transfer. Traditional fraud systems can therefore see a technically valid payment while missing the manipulation happening through a phone call, chat, or email thread. APP fraud often starts in online or mobile banking only after manipulation has already occurred outside the payment flow.
Real-time payments make this harder. In instant payment environments, firms may have seconds to assess risk, challenge the customer, or hold the payment. Once funds reach a mule account, they can be rapidly dispersed.
APP fraud also creates reporting delays. Victims may feel embarrassed, confused, or unaware that they have been scammed. This reduces the chance of recovery and makes post-event investigation more complex.
APP Fraud Red Flags and Detection Indicators
Banks should assess authorised push payment fraud using layered signals rather than a single rule.
Signal | What it may indicate | Detection control |
|---|---|---|
First-time beneficiary | New recipient risk | Beneficiary risk scoring |
Unusually high payment | Behavioural deviation | Transaction anomaly detection |
Multiple payments in minutes | Scam pressure or mule movement | Velocity monitoring |
Long hesitation on payment screen | Possible coaching | Behavioural biometrics |
Repeated edits or copy-paste | Scripted payment instruction | Session behaviour analytics |
New device, IP or location | Contextual anomaly | Device intelligence |
Rapid inbound and outbound funds | Mule activity | Network analytics |
Many unrelated senders to one account | Coordinated scam activity | Graph analytics |
Firms should calibrate controls to known fraud typologies and evolving fraud patterns so layered detection can stop a suspected scam and other fraudulent transactions before funds move. Customer warnings based on these indicators also support prevention by educating customers about APP fraud threats.
This approach helps institutions detect suspicious circumstances around otherwise authorised payments.
How Banks Detect APP Fraud in Real Time
APP fraud detection should combine five intelligence layers:
Transaction + Behaviour + Device + Beneficiary + Network
Transaction Behaviour
Transaction monitoring should identify unusual payment values, abnormal frequency, unusual timing, first-time beneficiaries, high-risk recipients, and deviations from a customer’s historical profile.
A single anomaly should rarely decide the outcome. Risk should be scored across multiple signals to reduce unnecessary friction and false positives.
Behavioural Indicators of Manipulation
APP scams often change how a customer behaves during the payment journey. Warning signs may include unusual hesitation, repeated data entry, abnormal navigation, copy-and-paste behaviour, longer-than-normal sessions or interaction patterns that differ from the customer behavior baseline used to detect manipulation-related anomalies.
Behavioural biometrics can help identify when a genuine customer may be acting under pressure or remote coaching, and can flag a suspected scam even when the customer is genuine.
Device and Contextual Signals
Device intelligence adds important context, including new devices, unfamiliar IPs, location anomalies, SIM-swap indicators, remote-access signals, unusual authentication patterns and sudden account-setting changes.
Beneficiary and Network Signals
The recipient side is critical because firms must assess whether the recipient is a genuine payee before releasing higher-risk payments. Fraud teams should assess whether a beneficiary is newly added, linked to previous fraud, receiving payments from unrelated customers or rapidly moving funds onward, with shared signals from other banks strengthening beneficiary-risk assessments.
This is where graph analytics for fraud detection becomes valuable, connecting accounts, customers, devices, transactions and beneficiaries to reveal hidden mule networks.
How Banks Can Prevent APP Scams
APP prevention must happen before and during payment execution, not only after a claim is filed.
Key controls include:
Confirmation of Payee or Verification of Payee Checks on receiving bank account details
real-time transaction monitoring
behavioural biometrics
device and identity intelligence
new-payee risk scoring
payment warnings tailored to scam type
step-up authentication
temporary payment holds
manual review for high-risk transfers
inbound monitoring for mule accounts
Confirmation of Payee can reduce misdirected payments by checking whether the account name matches the intended recipient. Banks and building societies should also use scam-specific warnings to prevent push payment scams before customers transfer money. However, it cannot stop every APP scam, because fraudsters may persuade victims to pay an account that appears correctly named.
The strongest model is risk-based friction: intervene when the payment context is suspicious, while avoiding unnecessary disruption for legitimate customers. This also supports efforts to reduce false positives in financial crime monitoring.
UK APP Fraud Reimbursement Rules
Regulation is shifting APP fraud from a customer-loss issue into a direct operational and financial risk for payment firms.
The UK Payment Systems Regulator introduced the reimbursement scheme for eligible APP scams from 7 October 2024, and under the PSR rules reimbursement mandatory applies to qualifying claims. This reimbursement requirement is capped at £85,000 per claim, and a customer must report the scam within 13 months. For faster payments in scope, the sending PSP must reimburse within five business days, which creates immediate potential liability for each bank and PSP.
The PSR’s Q4 2025 dashboard reported that between 7 October 2024 and 31 December 2025, 89% of in-scope APP scam losses, equal to £243 million, had been reimbursed. It also reported around 352,000 claims, with 82% closed within five business days.
An app scam claim can be rejected where the case is a civil dispute rather than fraud, or where gross negligence is established under the consumer standard of caution; however, extra protection applies to a vulnerable customer.
Regulatory protections for APP fraud victims can vary by region, so victim reimbursement outcomes depend on the local framework.
This matters for banks and PSPs because reimbursement is not prevention. Firms still need stronger controls to stop scams before funds leave the account, and customers who have fallen victim and remain dissatisfied can escalate complaints to the financial ombudsman service.
APP Fraud and FRAML
APP fraud should not be treated as a standalone payment issue. Stolen funds often move through mule accounts, layered transfers and networks that overlap with money laundering typologies.
The Financial Action Task Force reported in 2026 that 90% of assessed jurisdictions identify fraud as a major money laundering risk. That makes APP fraud highly relevant to AML, transaction monitoring, and financial-crime investigations.
A modern workflow should look like:
APP risk event → fraud scoring → beneficiary risk → network analysis → AML review → case management
This is why APP fraud detection belongs inside a unified FRAML model, where fraud and AML teams share intelligence, alerts, entity risk, and investigation workflows.
How ZIGRAM Helps Detect and Prevent APP Fraud
ZIGRAM helps banks, fintechs, and financial institutions detect APP fraud through real-time monitoring, behavioural analytics, entity intelligence, and graph-based risk detection.
ZIGRAM Fraud Fighter supports fraud teams by analysing customer behaviour, transaction patterns, device signals, behavioral biometrics, and beneficiary risk before suspicious payments are completed. It helps identify both outbound scam payments and inbound mule-account activity.
ZIGRAM’s Complete FRAML System connects fraud detection with AML monitoring, screening, entity risk assessment, and case management. This unified approach helps institutions detect APP scams, investigate mule networks, and maintain stronger audit trails for regulators and risk committees.
Future APP Fraud Risks
APP scams are becoming more sophisticated. Criminals are using generative AI to create personalised phishing messages, deepfake audio for CEO fraud, cloned websites for investment scams, and multilingual scripts for call-centre-style manipulation.
At the same time, AI can strengthen defence. Behavioural analytics, anomaly detection, graph intelligence and privacy-preserving risk sharing can help institutions detect scam patterns faster.
The institutions best positioned for the next phase of APP fraud will be those that combine real-time prevention, customer-context analysis, mule-account detection, and FRAML integration.
Frequently Asked Questions
What is an APP scam?
An authorised push payment app scam occurs when a victim is tricked into sending money to a fraudster-controlled account.
How do banks detect APP fraud?
Banks detect APP fraud using transaction monitoring, behavioural biometrics, device intelligence, beneficiary risk scoring and graph analytics.
Why is APP fraud hard to stop?
APP fraud is hard to stop because the victim authorises the payment, making it appear legitimate unless the surrounding behaviour and recipient risk are analysed.
How can APP fraud be prevented?
APP fraud can be prevented through payee verification, real-time monitoring, behavioural analytics, risk-based warnings, payment holds and mule-account detection.
Why does APP fraud matter for AML?
APP fraud proceeds often move through mule accounts and laundering networks, making it important for fraud and AML teams to work together.
Conclusion
APP fraud represents a major shift in financial crime: the payment is authorised, but the decision is manipulated.
As instant payments grow and scams become more advanced, banks and PSPs need controls that detect suspicious behaviour, risky beneficiaries and hidden networks in real time. The future of APP fraud prevention lies in AI-driven, behaviour-aware and FRAML-integrated systems that stop scams before funds leave the customer’s account.
Book a demo with ZIGRAM Fraud Fighter to assess your APP fraud controls and strengthen real-time fraud prevention.
