Authorized Push Payment (APP) Fraud

Authorized push payment (APP) fraud is a scam in which the victim is manipulated into initiating a payment to an account the attacker controls. The word authorized is what makes it dangerous: no account was hacked and no card was cloned — the legitimate account holder pressed send. That authorization strips away many of the technical defenses and recall mechanisms built for unauthorized fraud, which is why APP losses keep climbing even as banks get better at blocking account takeovers. In the UK, which measures it most rigorously, APP fraud reached £576.4 million in 2025, up 19% year on year, with two-thirds of cases originating online.

How it works

Every APP scam pairs a pretext with urgency. Consumer variants include purchase scams (goods that never arrive), impersonation of a bank's own fraud team ("your account is compromised — move your money to this safe account"), investment and romance-baiting schemes, and invoice redirection on house purchases. The enterprise twin is business email compromise: a finance employee is persuaded that a supplier's bank details have changed or that an executive urgently needs a wire sent, and the employee — fully authorized — executes the transfer. Funds land in a money mule account and are dispersed within hours, often before anyone questions the instruction.

How to defend against it

Because the payment itself is legitimate, defense has to happen before the send button. Enforce out-of-band verification for any new payee, any bank-detail change, and any urgent or unusual payment request — a callback to a number already on file, never one supplied in the message. Regulation is moving the same way: since October 2024, UK payment firms have been required to reimburse most APP fraud victims, converting employee and customer gullibility into a direct balance-sheet cost. For organizations, the durable control is behavioral: train and test payment-handling roles against the exact pretexts attackers use, and measure whether verification actually happens under pressure. Our guide to human risk in financial services covers how to build that program.