A scammer tricks a person or business into sending money to an account the scammer controls. The victim authorizes the payment themselves, after impersonation, a fake invoice, an investment pitch or an urgent request.
Authorized push payment fraud: Types, risks and prevention
What authorized push payment fraud is, the six steps of an APP scam, the types from BEC to pig butchering, who is at risk and the controls that stop it.
On this page
- What authorized push payment fraud is
- Push payments and pull payments
- The six steps of a push payment scam
- Types of APP fraud
- The newer threats
- Who is at risk
- The psychology behind APP fraud
- How banks detect APP fraud, and why they miss it
- Prevention checklist for businesses
- Where APP fraud is heading
- Where to start
Authorized push payment (APP) fraud is a scam where the victim sends the money themselves. Nobody breaks in. A finance clerk or a consumer approves a transfer to an account a fraudster controls, because the request looked right. Deloitte puts US APP fraud losses at nearly $15 billion by 2028.
It is one of the fastest-growing fraud types because it needs no vulnerability. It runs on trust, urgency and a moment of inattention, and because the payment was authorized, the bank's controls and the chargeback process mostly do not apply.
What authorized push payment fraud is
APP fraud happens when a person or business is tricked into sending money to a fraudster, believing the payment is legitimate.
The payer approves the payment. The information behind it is false. That is what makes it hard to manage: every step of the transfer looks normal to the bank, because it is normal. Only the destination is wrong.
The typical business case: a spoofed email from a known supplier, with the right logo, the right tone and a plausible reason, asks your finance team to update bank details before the next payment run.
Everything checks out, the approval goes through, and the transfer lands where it was aimed: in the fraudster's account.
Hours later the real supplier calls about the unpaid invoice. They never sent that email. The account was never theirs. The money is gone, and because a real person authorized every step in good faith, it falls into the hardest category of financial crime to recover from. Not a hack, not a breach: the victim was the instrument.
Push payments and pull payments
Every business payment is one of two types. The type decides who controls the money, who carries the risk, and how easy the money is to get back.
This is why APP fraud is so hard to reverse, and why bank fraud controls, built mostly for pull payments, protect businesses less than many owners assume.
| Aspect | Push Payment (APP Context) | Pull Payment |
|---|---|---|
| Who initiates the payment | You (payer) send the money | Merchant/service collects the money |
| Control | Fully controlled by the payer | Controlled by the merchant (with consent) |
| How it works | Money is transferred directly to another account | Money is deducted from your account |
| Examples | Bank transfer, UPI payment | Card payments, subscriptions |
| Fraud risk | Higher in APP fraud (payer is manipulated) | Lower due to built-in protections |
| Reversibility | Hard to reverse once sent | Easier (chargebacks/refunds possible |
Most APP attacks follow the same six steps. Each one is a place to intervene.
The six steps of a push payment scam
Step 1: find the target. The fraudster collects information on the victim from:
- Social media profiles
- Data breaches
- Professional platforms
Example: a fraudster finds a company's finance manager on LinkedIn and learns their role and which vendors they pay.
Step 2: build trust with a believable identity.
The attacker impersonates a trusted party using:
- Spoofed email domains
- Fake websites
- Lookalike phone numbers
Example: an email arrives from a known supplier, sent from a domain one character off the real one.
Step 3: create urgency.
A situation that demands fast action:
- "Urgent invoice update"
- "Security issue with your account"
- "Limited-time investment opportunity"
Example: the finance team is told payment must go out today to avoid a service cut-off.
Step 4: the ask.
Clear, convincing payment details:
- New bank account information
- Revised beneficiary details
Example: "Please send all future payments to this updated account due to internal changes."
Step 5: the transfer.
The victim initiates the payment believing it is legitimate. Because it is a push payment, it is authorized, and this is the point where the fraud succeeds.
Step 6: the exit.
The money moves through several accounts, often mule accounts, within minutes. That is what makes recovery so hard.
Example: the funds are split and sent on to different accounts before the victim has left the desk.
Types of APP fraud
APP fraud is a family of scams, each working on a different weakness. Some are old and familiar. Generative AI has made the newer ones cheaper to run and harder to spot.
The established types
Purchase scams are the most common. More than half of consumers surveyed reported a shopping scam in 2024: fraudulent listings, fake sellers, goods that never arrived.
Investment scams are now a major loss category. UK consumers lost an estimated £98 million to investment fraud between January and June 2025.
Romance scams build a fake relationship and then ask for money. The US Federal Trade Commission's 2023 figures put romance scam losses above $1.4 billion, with a median loss over $2,000 per victim, among the highest of any scam type.
Impersonation scams have the criminal pose as a bank, HMRC, the IRS or the police and press the victim into an urgent payment.
Invoice and mandate fraud targets businesses: the payment details on a legitimate invoice are swapped so the money goes to the fraudster.
The newer threats
These are growing fastest, and most fraud programs are least ready for them.
A. Deepfake-enabled APP fraud
Generative AI lets a fraudster clone an executive's voice for a phone call or put a synthetic face on a Microsoft Teams or Zoom meeting. What needed rare technical skill now runs at scale from a laptop.
B. Business email compromise (BEC)
BEC combines social engineering with payment fraud. US businesses' BEC losses reached $2.7 billion in the 2024 figures, not through system breaches but through employees talked into skipping procedure and approving transfers to fraudulent accounts.
C. Pig butchering
Pig butchering is a long-con investment fraud. The scammer spends weeks or months building trust through a dating app or social media, then introduces an "exclusive" investment opportunity. By the time the victim learns the platform is fake, the money is gone.
D. Crypto-specific APP fraud
Cryptocurrency is the preferred destination for APP proceeds. Nearly $10 billion in crypto was lost to scams across 2024. Transfers are irreversible and the perceived anonymity makes recovery and prosecution harder, which is why crypto fraud prevention is now its own discipline.
Who is at risk
Small and medium-sized businesses
SMEs move money every week and rarely have the controls larger companies do. A fake invoice from a trusted supplier, a request to update payment details, an email from a senior manager asking for an urgent transfer: these are ordinary days for a small finance team.
The core problem is that the people with authority to pay often have no verification step to follow before they do. One transfer to the wrong account can cost thousands, sometimes far more.
Corporate and enterprise businesses
Against large organizations the fraud is targeted and researched. Attackers study the leadership chart, the vendor list and the internal workflow before they send anything.
BEC and supply chain fraud work because the emails look real and because of organizational psychology: nobody wants to slow down a senior leader or delay a critical vendor payment. The attacker does not need to break your security stack, only your approval culture.
What makes large organizations vulnerable
- Complexity hides anomalies. In a company processing thousands of transactions, one fraudulent wire can sit in the noise until month-end reconciliation.
- Siloed verification. Finance may not know the CEO's travel schedule, so an "I'm in a meeting, handle this quietly" email is hard to cross-check.
- Vendor relationship age. Long-standing suppliers are trusted without question. Attackers target them because "we've worked with them for years" short-circuits the check.
Crypto investors
Most platforms scammers use are unregulated, so there is little consumer protection. Once funds reach a crypto wallet, tracing or recovering them is close to impossible: no bank to call, no chargeback to file, no regulator to escalate to.
Individual consumers
Ordinary people, older adults above all, are often the easiest targets. They tend to hold more savings, know digital payment systems less well, and trust an unexpected call or message more readily. Scammers use spoofed caller IDs, manufactured urgency and fear, such as a warning that the bank account has been compromised. By the time the victim sees it, the money has gone.
What this means for business owners
If you run a business of any size, you are a target. The common thread is trust in familiar names, known contacts and routine processes. Knowing who gets hit, and how, is the first step to not being next.
The psychology behind APP fraud
APP fraud tricks people, not systems, by working on ordinary human instincts.
- Authority bias makes us comply with someone who sounds official. A caller from "your bank", the police or a government agency lowers the guard at once.
- Urgency and scarcity switch off careful thinking. Act now or face consequences leaves no time to verify.
- Social proof removes doubt. "Your colleague already approved this" makes an odd request feel routine.
- Fear and loss aversion push people to act out of panic. A frozen account or legal trouble is enough to make careful people move fast.
- Love bombing, in romance scams, builds deep emotional trust over weeks or months so the eventual request for money feels natural.
How banks detect APP fraud, and why they miss it
Banks run fraud monitoring, and APP fraud still gets through much of the time. The comparison below shows what the bank watches and where that leaves you exposed.
What to do in the first 24 hours after a fraudulent payment
The order matters, because recall windows close fast.
- Within minutes: call your bank's fraud line and ask for a recall or freeze.
- Within 1 hour: report to the national fraud authority (Action Fraud UK, FTC US, ACCC Australia).
- Within 24 hours: file a formal complaint citing the reimbursement scheme that applies in your jurisdiction.
- Document everything: screenshots, emails, call logs, transaction references.
- Report to the police. A crime reference is needed for a formal investigation and for insurance claims.
- Notify your employer if a business account was involved.
- Check for identity compromise: change passwords and turn on MFA.
Prevention checklist for businesses
The loss from one push payment is large and mostly unrecoverable, so prevention is where the money is.
The checklist below lists the controls to put in place.
Checklist for individuals
Individuals are hit by the same scams. The checklist below is what to do before you send money to anyone new.
Where APP fraud is heading
1. AI makes social engineering scalable and convincing
Deepfake audio and video let a fraudster impersonate a CEO or finance director live on a call. Personalised phishing scripts built from LinkedIn and Companies House data cost almost nothing at scale. Voice familiarity and email tone are no longer trust signals.
Deloitte's aggressive scenario has US APP fraud losses rising from $8.3B (2024) to $18.2B by 2028 if AI-driven attacks outpace defences.
2. Real-time payments widen the fraud window worldwide
As instant rails spread across the US (FedNow), the EU (SEPA Instant) and Asia, the no-intervention window that makes APP fraud work spreads with them. Businesses operating internationally will face the same irreversibility in every currency they pay in.
3. Cross-industry coalitions are setting the US standard
The Aspen Institute's National Task Force for Fraud and Scam Prevention brings together 33 cross-industry players, including banks, telecoms, tech firms and federal agencies, to coordinate a US response. The bipartisan TRAPS Act, proposed June 2025, would set up a federal task force on digital payment scams. Deloitte's baseline forecast for US APP fraud losses by 2028 is $14.9B.
Where to start
APP fraud is a manipulation problem, not a technology problem. Fraudsters rarely touch the bank's systems; they talk a person into sending the money.
It will keep growing as AI makes the scripts more convincing, instant payments leave less time to react, and the tooling gets cheaper.
The pattern never changes: someone is rushed into paying a new account without a second check. The businesses that stop it are the ones that make that structurally hard, not the ones hoping the bank catches it. Start with one rule: no bank detail change is actioned without a call back to a number you already had on file.
Sensfrx scores each payment as it is submitted, from device, network and behavior signals, and flags signs of pressure, urgency and suspicious behavior before the payment is processed. Start a free Sensfrx trial to run it on your own payment flow.