Authorized Push Payment (APP) Fraud: A Global Threat

What is Authorized Push Payment Fraud?

Authorized push payment fraud, also called push payment fraud, is a scam in which a criminal persuades a victim to send money from their own account to an account the criminal controls. The victim approves the transfer, often in real time, through a bank transfer or instant payment system, so the payment looks legitimate to the bank.

The fraud typically relies on social engineering tactics, where attackers impersonate trusted figures such as bank officials, company representatives, or even friends and family members. Through deception, urgency, or emotional manipulation, the fraudster convinces the victim that the payment is legitimate and necessary. UK Finance’s Annual Fraud Report 2026 counted 248,070 APP cases and £576.4 million in losses across UK banks and payment firms in 2025.

Reversing the payment can be difficult because the victim “authorized” the transaction. Controls built to spot an intruder often see nothing wrong when the account holder makes the payment, which makes authorized push payment scams harder to stop than unauthorized fraud such as card theft.

How Does Authorized Push Payment Fraud Work?

Authorized push payment fraud works in six stages, from choosing a target to moving the stolen money through mule accounts. The preparation starts well before the victim pays. 

Group-IB research found that fraudsters spend 4 to 8 weeks preparing mule accounts, building transaction histories that avoid basic fraud checks.

1. Target identification. Fraudsters choose individuals or businesses using public data, breached data, social media profiles, and company websites.
2. Impersonation or pretext setup. The attacker assumes the identity of someone the victim trusts, such as:

• A bank representative.
• A supplier or colleague.
• A government official.
• A romantic interest (in personal scams).

They may contact the victim by phone, email, SMS, or messaging apps.

3. Social engineering. The fraudster builds urgency or emotional pressure to convince the victim that the payment is legitimate. Common social engineering tactics are listed below.

• Claiming an account has been compromised.
• Requesting payment for an urgent invoice.
• Asking for a donation or financial help.
• Offering a “secure account” for fund transfer.

4. Payment authorization by the victim. Believing the request to be genuine, the victim voluntarily authorizes a bank transfer or instant payment to the fraudster’s account.
5. Funds are redirected to mule or offshore accounts. The money is quickly moved through multiple accounts, often via money mules or crypto, making tracing and recovery difficult.
6. Discovery. The victim later realizes the request was fraudulent, usually after the money has gone. Whether the bank must refund the loss depends on the country and the payment type.

Types of APP Fraud Attacks

The six most common types of APP fraud are purchase scams, invoice scams, investment scams, romance scams, CEO fraud, and impersonation scams. According to UK Finance data, purchase scams make up the most cases, and investment scams cause the highest losses. Two related identity crimes are not APP scams, but they supply the accounts these scams rely on. The last part of this section covers them.

The table below compares the six APP scam types by who they target and the red flags that give them away. The sections that follow cover each type in detail.

1. Purchase scams

Purchase scams trick victims into paying by bank transfer for goods or services that never arrive. Many start on online marketplace sites and social media. UK Finance reported that purchase scams made up 71% of UK APP cases in 2025, with losses up 20% to £118.1 million. 

2. Invoice scams (also called mandate fraud)

Invoice scams, also called mandate fraud, trick a business into paying a fake invoice or switching a supplier’s bank details to a criminal’s account. The fraudster impersonates a supplier, contractor, or service provider and sends a convincing invoice with matching branding. Australia’s National Anti-Scam Centre recorded A$166.8 million in payment redirection losses in 2025, the second-largest scam category by loss.

3. Investment scams

Investment scams lure victims into fake opportunities, often online, that promise high returns, minimal risk, and fast profits. In the U.S., the FBI’s Internet Crime Complaint Center (IC3) recorded $8.65 billion in investment fraud losses in 2025, the largest category in its report.

Group-IB’s Computer Emergency Response Team (CERT-GIB) tracked 11,197 domains in one scam infrastructure that targeted nine European countries. Call centers guided victims through a fake dashboard showing invented profits, then demanded more deposits.

4. Romance scams

Romance scams build a fake emotional relationship online to manipulate the victim into sending money. UK Finance reported that romance fraud losses rose 23% to £39.2 million in 2025.

Group-IB supported INTERPOL’s Operation Contender 2.0, which targets romance scams, Business Email Compromise, and financial grooming. Nigerian police arrested two people on April 27, 2024, for a romance scam that caused substantial losses for a victim in Finland.

5. CEO fraud (business email compromise)

CEO fraud is a Business Email Compromise (BEC) attack in which criminals impersonate a senior executive to push staff into wiring company funds or sharing confidential data. The FBI recorded $3.05 billion in BEC losses across 24,768 complaints in 2025. 

Group-IB Business Email Protection stops phishing, malicious attachments, and BEC with link and attachment analysis and threat intelligence-driven detection.

6. Impersonation scams

Scammers pose as trusted entities like banks, police, or family members to manipulate victims into transferring money. UK Finance reported that impersonation losses fell 12% in 2025, but AI voice cloning is changing how these scams sound.

Group-IB’s  Digital Risk Highlights 2025 datasheet tracks how impersonation scams, including Classiscam and deepfake impersonation, differ by region.

Crimes that supply APP scams

Demand deposit account (DDA) application fraud

Demand deposit account (DDA) application fraud involves opening checking or savings accounts with stolen or fake identities, and criminals use those accounts for check fraud, fake deposits, or to receive money from APP scam victims. 

Group-IB research shows criminals warm up these accounts with normal-looking activity, so they pass basic fraud checks before receiving scam proceeds.

For example, a mule opens a DDA with fake documents and then receives payments from multiple romance scam victims. They quickly withdraw or forward the money, obscuring the fraud trail.

Credit card application fraud

Credit card application fraud involves using stolen or synthetic identities to obtain credit cards and then make fraudulent purchases or cash withdrawals.

For example, a synthetic identity is created using a real Social Security number and fake personal details. The fraudster builds a credit profile, gets a card approved, and racks up charges, never intending to repay.

Global Impact of APP Fraud

APP fraud costs victims billions of dollars each year, and reported losses are still rising in the UK and the US. Different countries count these crimes differently. 

The following two tables compare the closest published figures from three markets instead of one global total.

Financial losses

UK APP fraud losses rose 19% to £576.4 million in 2025, with personal customers losing £500.8 million and businesses losing £75.6 million. Banks reimbursed £354.3 million, or 61% of losses. 

The figures in the table below use data from UK Finance (2026), FBI IC3 (2026), and the National Anti-Scam Centre (2026). This data covers categories that include payments victims authorize, but those agencies do not label them specifically as APP fraud.

Number of victims

UK banks recorded 248,070 APP fraud cases in 2025, and US and Australian agencies logged more than a million complaints and nearly half a million scam reports under broader categories. 

The following table shows the main counts from three markets. These counts include only cases that victims or institutions report, so the true numbers are higher.

In the US, people aged 60 and over filed 201,266 complaints and reported $7.7 billion in losses.

Challenges in Stopping APP Fraud

Challenges in stopping APP fraud include social engineering, real-time payments, and a lack of awareness of how the scams work.

1. Social engineering

Social engineering is the hardest challenge because it turns the victim into the person who bypasses the bank’s controls. Scammers prey on stress, urgency, and emotion, whether someone’s going through financial pressure or just trying to do the right thing fast.

Generative artificial intelligence (GenAI) now enables scammers to do this at scale with fake voices, deepfakes, and convincing phishing messages. The IC3 received 22,364 AI-related complaints with $893 million in losses in 2025.

Group-IB’s Balonx Sistema investigation shows the next step. Its CallFlow module uses AI services and a synthetic voice to impersonate a bank representative, so the scheme needs no human call-center staff to target customers of more than 20 Mexican financial institutions. Group-IB expects this model to spread to other regions through criminal networks.

2. Real-time payments

Real-time payments leave institutions and victims only seconds to react, so recovery gets harder with every passing minute. Group-IB’s research paper, Can You Actually Stop App Fraud Before It Happens? found that with these systems, criminals only need 10 to 40 seconds to move funds out of reach. 

Group-IB Fraud Protection analyzes behavioral and device signals in web and mobile sessions, which gives institutions a chance to intervene before funds leave.

3. Lack of awareness

Lack of awareness lets scams succeed because many users assume if they authorized a payment, it must be secure. They don’t realize that being tricked into clicking ‘Confirm’ is the entire scam. Without basic awareness of social engineering tactics, people walk straight into well-crafted traps. UK Finance’s Take Five to Stop Fraud campaign teaches a simple response. Stop and think, challenge whether the request could be fake, and protect yourself by contacting your bank.

In addition to these challenges, two other factors make stopping APP fraud difficult.

• Jurisdictional issues. The cross-border nature of many APP scams makes it difficult to investigate and prosecute criminals.
• Weak systems and controls. Fraudsters can exploit differences in controls and anti-fraud measures across Payment Service Providers (PSPs), creating loopholes they can use to their advantage.

Regulatory and Authority Actions

Regulators in the UK, the EU, and Australia now push responsibility for scam losses toward banks, platforms, and telecom firms instead of leaving it with victims. 

The following table uses data from the Payment Systems Regulator, the European Parliament, and  Herbert Smith Freehills Kramer to summarize the main measures.

Mandatory reimbursement

The UK’s mandatory reimbursement rules require payment firms to refund eligible APP scam victims up to £85,000 per claim, and they have been in force since October 7, 2024. The Payment Systems Regulator (PSR) set the cap in policy statement PS24/7. 

Firms can refuse claims when the customer committed fraud or failed to meet the consumer standard of caution. Sending and receiving Payment Service Providers (PSPs) share the reimbursement cost equally. The main objective of this initiative is to protect consumers and motivate PSPs to improve their fraud prevention measures.

However, the rules do not cover civil disputes. Firms may also apply a claim excess of up to £100. The PSR is being merged into the Financial Conduct Authority (FCA), which will take over these rules.

An independent evaluation by Frontier Economics, published on July 1, 2026, found that APP fraud losses sent over Faster Payments fell about 21%, or roughly £73 million a year, after the rules began. Reimbursement rates rose from 54% to 65%. UK Finance reported that the PSR reimbursed 89% of in-scope APP fraud in the first 15 months.

The evaluation also noted a possible shift of fraud toward channels outside the rules. Reimbursement does not remove the crime either. UK Finance points out that the stolen money still ends up with organized crime groups, so banks still need to block scams before the payment.

Data sharing and collaboration

Regulators encourage banks to share fraud intelligence so that one institution’s suspicion becomes a warning for every other institution. Two initiatives stand out.

• Confirmation of Payee (CoP). CoP helps verify payee identity and alerts users to potential mismatches between account names and numbers. This can help prevent APP scams where fraudsters provide incorrect or misleading payee information.
• Information Sharing Initiatives. Regulators encourage PSPs to share information about fraudulent activities and suspicious accounts. This can help identify patterns and trends in APP fraud and enable faster responses to emerging threats.

Enhanced fraud prevention measures

Enhanced prevention measures give payment firms time and tools to stop suspicious transfers before the money leaves. 

PSPs can delay processing payment transactions if they have reasonable grounds to suspect fraud or dishonesty. This provides time for further investigation and verification, potentially preventing fraudulent transactions from being completed. PSPs have up to four business days to make further inquiries, including contacting the customer or other relevant third parties.

Consumer education and awareness

Authorities emphasize consumer education and awareness initiatives to empower individuals to protect themselves from APP fraud. UK Finance’s Take Five to Stop Fraud campaign asks people to stop, challenge, and protect. Australia’s National Anti-Scam Centre urges victims to contact their bank at once and report the scam to Scamwatch, which helps the agency spot new scam patterns.

Technology and innovation

Regulators are advocating for technology and innovation to improve fraud prevention measures. This includes supporting the integration of advanced analytics, artificial intelligence, and machine learning to identify and stop fraudulent transactions in real time.

International cooperation

International cooperation enables investigators to follow money and infrastructure across borders that criminals cross in seconds. The FBI’s international Financial Fraud Kill Chain process handled 326 incidents in 2025 and froze $172 million. 

Group-IB supports this work as an INTERPOL Gateway Partner. In INTERPOL’s Operation Synergia II, 95 countries took down 22,000 malicious servers and arrested 41 people. Group-IB analysts identified more than 2,500 IP addresses linked to 5,000 phishing websites.

Examples of APP Fraud

The table below compares five real APP fraud cases by what happened, the amounts involved, the warning signs, and how each case played out. The data comes from the FBI’s IC3, UK Finance, and Group-IB research.

APP Fraud Trends Shaping the Threat Landscape

Four trends shape APP fraud in 2026. Investment and purchase scams are growing while impersonation scams fall, AI is automating social engineering, scams are starting online and on telecom networks, and campaigns run for weeks before any payment.

• Scams are shifting toward investment and purchase fraud. UK investment fraud losses rose 40% while impersonation losses fell. The same pattern appears in the US, where IC3 investment fraud losses grew from $6.57 billion in 2024 to $8.65 billion in 2025.
• AI is automating social engineering. The IC3 linked $632 million in 2025 investment fraud losses to complaints that mention AI. Voice cloning and AI-written messages let one criminal run thousands of convincing conversations. Group-IB’s knowledge hub explains how deepfakes work and why they defeat voice-based checks.
• Scams start online and on telecom networks. UK Finance found that 66% of APP cases began online and accounted for 32% of losses. Another 17% began on telecom networks and accounted for 28% of losses. Group-IB’s Digital Risk Protection Platform finds and takes down phishing, scams, and brand abuse across the web, social media, and the dark web, removing the lure before victims reach it.
• Campaigns run for weeks before the payment. Group-IB research shows mule account preparation takes 4 to 8 weeks, meaning payment is the last step in a long campaign. Defenders who watch only the transaction see the final moment, not the preparation.

How to Prevent APP Fraud

APP fraud prevention comes down to four habits. Verify requests, confirm changed payment details, resist pressure, and require a second approver. Individuals can apply all four, and businesses can build them into payment workflows. 

Verify payment requests before sending money

Verify every payment request through a channel you chose, not the one the request arrived on. Call the person or company on a number from your own records, and check the payee name that your bank shows before you confirm. Do not trust caller ID, because Group-IB’s research found that spoofed numbers can no longer be assumed to be genuine.

Confirm changes to payment details

Confirm any change to bank details by calling the supplier on a number you already hold before you pay. Hold the first payment to a new account until someone has checked it. Group-IB Business Email Protection helps by flagging the phishing emails and compromised mailboxes that often deliver fake bank detail changes.

Avoid urgent or high-pressure payment requests

Treat urgency as a warning sign, because pressure is the main tool criminals use to stop victims from thinking. UK Finance advises that only criminals try to rush or panic you. A short delay costs nothing when the request is real, and it gives you time to verify.

Use multi-step payment approval processes

Multi-step approval means no single employee can release a payment, so one deceived person cannot send money alone. Require two approvers above a set amount, separate the person who adds a payee from the person who pays, and call back to confirm every new payee. 

Organizations can test whether staff follow these steps through a red teaming engagement, which simulates real adversaries across people, processes, and technologies.

What to Do After APP Fraud Has Happened

After APP fraud happens, contact your bank, report it to the authorities, request a payment recall or investigation, and secure your accounts. Speed matters because freezes work best before the money moves on.

1. Contact Your Bank or Payment Provider Immediately

Call your bank or payment provider as soon as you suspect fraud, using the number on your card or in the official app. Say that you were tricked into authorizing the payment, and give the payee name, account details, amount, and time. The FBI advises that time is of the essence and that you should ask for a recall of the funds right away.

2. Report the fraud to the relevant authorities

Report the fraud to the authority in your country, because each report helps investigators link cases. Use the right channel for your location.

• In the UK, report to the police at reportfraud.police.uk or on 0300 123 2040.
• In the US, file a complaint at ic3.gov, regardless of the amount lost.
• In Australia, report the scam to Scamwatch and contact your bank.

3. Request a payment recall or fraud investigation

Ask your bank in writing for a payment recall and a formal fraud investigation, and keep every message, receipt, and screenshot. In the UK, eligible victims can claim reimbursement under the mandatory rules described above. 

Businesses that need to trace how an attacker compromised a mailbox or system can use Group-IB Digital Forensics to reconstruct the timeline and produce admissible evidence.

4. Secure compromised accounts and credentials

Secure every account the criminal may have accessed by changing passwords, enabling multi-factor authentication, and signing out all active sessions. For business email, check for forwarding rules and unfamiliar devices. Organizations facing an active compromise can contact Group-IB’s Incident Response team, where 24/7 responders contain active threats and investigate the root cause.

Technology’s Role in Fraud Investigations

Technology speeds up fraud investigations by linking accounts, devices, and infrastructure that look unrelated and by preserving the evidence prosecutors need. Three capabilities do most of the work.

• Data analysis tools. These tools help identify patterns and anomalies indicative of fraud, such as unusual transaction amounts, suspicious beneficiary information, or deviations from typical customer behavior. Group-IB Threat Intelligence Platform uses Graph Network Analysis to map scam infrastructure and trace fake investment domains. 
• Artificial intelligence (AI) and machine learning (ML). AI and ML algorithms can detect complex fraud schemes by analyzing vast amounts of data and identifying subtle patterns that human investigators miss. 
• Digital forensics. Digital forensics is crucial in gathering and preserving electronic evidence related to fraud, such as emails, transaction logs, and device data. Investigators use this evidence to track down criminals and build a prosecution case.

How Group-IB Helps Organizations Detect and Prevent APP Fraud 

Group-IB helps financial institutions, payment providers, and enterprises stop APP fraud before funds move by combining session analytics, cross-institution intelligence, and takedown and investigation expertise. 

The capabilities below map to the stages of an APP scam and support APP fraud prevention from the first lure to the last payment.

• Institutions catch manipulated payments by analyzing sessions in real time. Group-IB Fraud Protection Platform uses device fingerprinting, behavioral analytics, and fraud intelligence to detect and block bots, malware-assisted fraud, and account abuse across web and mobile channels.
• Banks block mule accounts weeks before first use when they share risk signals. Group-IB Cyber Fraud Intelligence Platform exchanges tokenized signals between institutions, keeps customer data inside each participant’s environment, and responds within 100 milliseconds.
• Brands and banks cut off scams at the source by removing fake sites and impersonating accounts. Group-IB Digital Risk Protection finds and takes down phishing, scams, brand abuse, and data leaks across the web, social media, and the dark web.
• Companies stop executive and supplier impersonation by email before staff acts on it. Group-IB Business Email Protection analyzes links and attachments and uses threat intelligence to catch phishing, malware attachments, and Business Email Compromise.

Group-IB works with international law enforcement agencies, including INTERPOL and Europol, to share real-time threat intelligence, assist in investigations, and disrupt criminal infrastructure.

To size the problem first, use the Fraud Exposure Calculator, which estimates your institution’s annual exposure to APP fraud, account takeover, and mule cash-out from your own data.

Request a demo to see how Group-IB stops APP fraud before funds leave your customers’ accounts.