Stopping Silent Theft: A Guide to Detecting and Preventing Authorized Push Payment (APP) Fraud

Introduction

Authorized Push Payment (APP) fraud is often called silent theft. The criminal never steals a password or a card. Instead, they persuade the victim to send the money themselves, usually by bank transfer, to an account the criminal controls.

That single detail changes everything for fraud teams. The payment comes from the real customer, on their usual device, through a login that passed every check. On paper, it looks legitimate. This guide explains how APP scams work, which signals still give them away, and how to build layered defenses that stop the payment before the money leaves.

According to UK Finance's Annual Fraud Report 2026, APP fraud losses in the UK rose 19% to £576.4 million in 2025, across 248,070 cases.

Why APP Fraud Slips Past Traditional Controls

Most fraud controls were built to answer one question: is this really the account holder? With APP fraud, the answer is yes. The customer logs in, passes multi-factor authentication, and approves the transfer.

Compare this with card-not-present fraud. There, a criminal uses stolen card details, and the real cardholder can later dispute the charge. In an APP scam, the victim initiates the payment, so there is no stolen credential to detect and nothing obviously "unauthorized" to dispute.

Speed makes the problem worse. Real-time payment rails settle in seconds, and criminals move stolen funds through mule accounts almost immediately. Once the money is gone, recovery is slow and often partial. That is why prevention, not recovery, has to be the main goal.

How a Typical APP Scam Unfolds

APP scams follow a predictable pattern, even when the story changes. Knowing the stages helps you decide where to place controls.

1. Research: The criminal gathers details about the target, such as suppliers, colleagues, or recent purchases.
2. Contact: They reach out by email, text message, phone call, social media, or an online marketplace while posing as someone trusted.
3. Pressure: They create urgency, such as a "compromised" account, an overdue invoice, or a limited-time investment.
4. Payment: The victim sends money to a new payee, often in one large transfer or several smaller ones.
5. Cash-out: Funds are moved quickly through mule accounts, sometimes abroad, to make recovery harder.

The contact stage matters more than many teams expect. UK Finance reports that 66% of APP cases in 2025 started online and 17% started through telecommunications networks. In other words, most scams begin outside the bank, long before the payment screen appears.

The Most Common APP Scam Types

Criminals reuse a handful of proven scripts. Each one targets a different kind of trust, so each needs slightly different warnings and checks.

• Purchase scams: The victim pays upfront for goods or services that never arrive. UK Finance says these made up 71% of APP cases in 2025.
• Investment scams: Victims are lured into fake funds or trading platforms, often through social media ads. These caused the largest losses in 2025, at £221.5 million.
• Invoice and mandate scams: A criminal poses as a supplier and sends "updated" bank details, so the next genuine invoice is paid to the wrong account.
• CEO fraud: A message that appears to come from a senior executive asks finance staff for an urgent, confidential transfer.
• Impersonation scams: The criminal poses as a bank, the police, or a utility and convinces the victim to move money to a "safe account."
• Romance scams: A long online relationship ends with a fabricated emergency and a request for money.

Business-focused versions of these scams are a global problem, not only a UK one. The FBI's 2025 Internet Crime Report recorded 24,768 business email compromise complaints with more than $3.04 billion in reported losses.

The Real Cost of APP Fraud for Businesses

The stolen amount is only the most visible cost. A successful scam also triggers investigation work, customer support load, and hard conversations with partners and auditors.

For payment providers, the financial exposure now includes reimbursement. In the UK, the Payment Systems Regulator introduced mandatory reimbursement rules on 7 October 2024 for eligible APP scams sent over Faster Payments and CHAPS. The maximum claim is £85,000, and the cost is shared between the sending and receiving firms, as explained on the PSR's consumer guidance page.

Trust is the cost that lasts longest. Customers who lose money, or who feel their provider did nothing to warn them, are likely to leave. A visible, well-designed fraud program is part of the product, not just a back-office function.

Key Warning Signs Before a Payment Leaves

APP scams are hard to spot, but they are not invisible. The best signals usually come from combining payment context with session and identity data.

Payment context often shows the first red flags:

• A first payment to a brand-new payee, especially for a large amount
• A sudden change to a supplier's bank details shortly before a payment run
• An amount or frequency far outside the customer's normal pattern
• A payment to an account in a new country for this customer

Session and identity data add another layer. Look for logins from unusual locations, connections through VPNs or proxies, new devices, or contact details that were changed shortly before the transfer. A customer who stays on a phone call during the whole session, or who types payment details unusually slowly while being coached, may also be under a scammer's control.

No single signal proves fraud. The goal is to score them together and add the right amount of friction when the combined risk is high.

How Real-Time Data Signals Expose Hidden Risk

Real-time enrichment turns raw session data into clear risk signals in milliseconds. This is where APIs fit naturally into the payment flow.

Start with the connection. IP Location Intelligence tells you where a session really comes from, so you can compare it with the customer's profile. VPN & Proxy Detection flags anonymized or hosting-provider traffic, which is common when criminals act on a victim's behalf.

Next, check the identity data attached to the payee or the request. Data Scoring & Validation can score email addresses and phone numbers for signs like disposable or invalid data. This is useful when a "supplier" sends new details from an unfamiliar address.

Finally, look at the destination and the transaction as a whole. IBAN Validation & Insights checks that a beneficiary IBAN is structurally valid and returns its country and bank details. Payment Fraud Analysis combines signals such as IP, email, device, and purchase velocity into a single score with a recommended action.

Step-by-Step: Check a New Beneficiary IBAN

A new or changed payee is one of the strongest APP risk moments. The example below checks a beneficiary IBAN with the Greip API v2 before a payment is released. Run it on your server so the API key never reaches the browser.

// Node.js 18+ (built-in fetch). Keep GREIP_API_KEY in a server environment variable.
async function checkBeneficiaryIban(iban, customerId) {
  const url = new URL(`https://v2.greipapi.com/lookup/iban/${encodeURIComponent(iban)}`);
  url.searchParams.set("user_id", customerId);
  const res = await fetch(url, {
    headers: { Authorization: `Bearer ${process.env.GREIP_API_KEY}` },
  });
  const body = await res.json();
  if (!body.success) {
    throw new Error(`Greip error ${body.code}: ${body.description}`);
  }
  const { is_valid, country, bank } = body.data;
  return {
    isValid: is_valid,
    country: country?.iso3166,
    isSepa: country?.is_sepa,
    bankName: bank?.name,
  };
}

The response tells you whether the IBAN is valid and which country and bank it belongs to. You can then compare that with what the customer expects. For example, a "local supplier" whose new IBAN points to a bank in another country deserves a second look. Field names come from the IBAN Validation API reference.

A Practical APP Fraud Prevention Playbook

Technology works best when it supports clear processes and well-informed people. This playbook combines all three.

1. Educate customers and staff. Explain common scam scripts in plain language. Remind customers that you will never ask them to move money to a "safe account."
2. Use Confirmation of Payee or a similar name check. Warn the payer clearly when the payee name does not match the account.
3. Score every high-risk payment in real time. Combine payment context, session data, and identity signals into one risk score.
4. Add friction where risk is high. Use dynamic warnings, a short delay, or a step-up check for new payees and unusual amounts.
5. Verify changed bank details out of band. For business payments, call the supplier back on a number from your own records, never one in the email.
6. Watch the receiving side too. Monitor incoming payments for mule account behavior, such as rapid inflows followed by fast outflows.

Small, targeted interventions often work better than blanket rules. A well-timed warning that names the exact scam type can make a victim pause long enough to reconsider.

Balancing Security and Customer Experience

Strict controls can stop fraud and frustrate good customers at the same time. Too many blocked or delayed payments push people to other providers.

Risk-based decisions solve much of this tension. Low-risk payments go straight through. Medium-risk payments get a tailored warning or a quick confirmation step. High-risk payments are held for review. This keeps the experience smooth for most people while focusing effort where it matters.

Review your outcomes regularly. Track false positives, customer complaints, and confirmed fraud together, and adjust thresholds as patterns change. Criminals adapt quickly, so a model or rule set that is never tuned will slowly lose its edge.

Where APP Fraud Prevention Is Heading

Three trends are shaping the next few years. First, shared responsibility is growing. UK Finance is calling for online platforms and telecom firms, where most scams start, to take on stronger fraud-prevention duties.

Second, behavioral signals are becoming central. Because the customer is genuine, the most useful clues are often how they behave during the session, not who they are. Third, criminals are using AI to scale and personalize scams, which makes fast, data-driven detection even more important.

For businesses, the direction is clear. Decisions need to happen in real time, use many signals at once, and focus on the moment before the money moves.

Frequently Asked Questions

What is Authorized Push Payment fraud?

APP fraud happens when a criminal tricks someone into sending money by bank transfer to an account the criminal controls. The victim authorizes the payment, believing it is genuine.

Why is APP fraud hard to detect?

The real customer makes the payment from their usual account and device, so standard login and authentication checks pass. Detection depends on payment context, behavior, and identity signals instead.

Are APP fraud victims reimbursed in the UK?

Since 7 October 2024, UK payment firms must reimburse eligible victims of APP scams sent over Faster Payments and CHAPS, up to £85,000 per claim, with some exceptions. Rules in other countries differ.

Can IBAN validation stop APP fraud?

It helps, but it is not enough alone. IBAN validation confirms that an account number is valid and shows its country and bank. It does not confirm the account owner, so combine it with name checks and risk scoring.

Conclusion

APP fraud targets people, not systems. The payment looks genuine because the customer really made it, which is exactly why traditional controls miss it.

The answer is a layered approach. Educate customers, check payee names, verify changed bank details out of band, and score risky payments in real time using location, connection, identity, and beneficiary signals. With the right data at the right moment, you can add friction only where it is needed and stop more scams before the money is gone.