Authorised Push Payment Fraud
What Is Authorised Push Payment (APP) Fraud? Definition and How It Works
Definition
Authorised Push Payment (APP) fraud occurs when a fraudster manipulates a victim into willingly authorising a payment to a fraudulent account, by impersonating a trusted entity such as a bank, government agency, supplier, or romantic partner. Because the victim themselves authorises the payment, it bypasses automated fraud controls designed to detect unauthorised transactions, making APP fraud one of the most damaging and fastest-growing fraud categories globally.
How it works
APP fraud exploits the authentication model of push payment systems. In standard unauthorised fraud, a stolen card used without the cardholder's knowledge, fraud controls can block the transaction. In APP fraud, the victim is the person who authorises the payment; the authentication is genuine. Fraud systems cannot flag it as unauthorised because it is technically authorised.
Common typologies: impersonation fraud (posing as the victim's bank, HMRC, or police, instructing a transfer to a 'safe account'); purchase fraud (fake seller accepting payment for goods never delivered); invoice fraud (intercepting or spoofing a supplier invoice substituting the fraudster's account details); romance fraud (building a fake online relationship before requesting transfers); and investment fraud (persuading victims to transfer to fake investment platforms).
Once the victim authorises the payment, funds move instantly to a mule account, often a compromised legitimate account, and are quickly withdrawn or transferred onward, making recovery difficult.
Why it matters
APP fraud is the largest fraud category by value in the UK, overtaking card fraud in 2021. The shift toward instant payment infrastructure amplifies losses: the window between payment authorisation and funds being moved out of the receiving account is extremely narrow.
UK regulators implemented mandatory APP fraud reimbursement rules effective 7 October 2024: banks and payment firms must reimburse victims up to £85,000 per claim within five business days, with costs shared between sending and receiving institutions. This shifted liability from victims to institutions, creating strong incentives for investment in prevention.
The EU Instant Payments Regulation introduces mandatory Verification of Payee (IBAN-name verification) across the euro area as a primary countermeasure, warning payers when account names do not match the intended payee before payment executes.
With PXP
PXP supports merchants and partners across the payments value chain. To talk through APP fraud prevention as part of your payment strategy, get in touch with our team.
Frequently asked questions
How is APP fraud different from card fraud?
Card fraud involves unauthorised use of a payment credential without the cardholder's knowledge. APP fraud involves the victim deliberately authorising a payment, believing it legitimate. Card fraud triggers the unauthorised transaction dispute process; APP fraud historically offered victims much weaker recourse because the payment was technically authorised.
Can APP fraud losses be recovered?
In the UK, mandatory reimbursement rules require institutions to reimburse most APP fraud victims up to £85,000. In other markets, recovery depends on whether the receiving institution can freeze the mule account before funds move onward. Early reporting is critical; the longer the delay, the lower the recovery probability.
What is Confirmation of Payee and how does it prevent APP fraud?
In the UK, Confirmation of Payee checks the payee name against the sort code and account number entered by the payer, and in the euro area the equivalent Verification of Payee checks it against the IBAN, before payment submission. If the name doesn't match the account registration, the payer receives a warning. This interrupts the fraud flow in cases where the victim has been given a fake beneficiary account that doesn't match the name of the supposed payee.
Revolutionize your business with PXP
Take complete control of your commerce and payments with one platform.
Get Started