Community hub
0 subscribers7 pages, 0 posts
Recent from talks
All channels
Be the first to start a discussion here.
Be the first to start a discussion here.
Be the first to start a discussion here.
Be the first to start a discussion here.
Contribute something
Welcome to the community hub built to collect knowledge and have discussions related to Authorised push payment fraud.
Nothing was collected or created yet.
Authorised push payment fraud
View on Wikipediafrom Wikipedia
 | The examples and perspective in this article deal primarily with United Kingdom and Ireland and do not represent a worldwide view of the subject. (January 2023) |
Push payment fraud (also known as "authorised push payment fraud" or APP fraud) is a form of fraud in which victims are manipulated into making real-time payments to fraudsters, typically by social engineering attacks involving impersonation.[1][2] These authorised frauds can also be related to investment scams, where the victim is tricked into sending money for investments that do not exist, and to romance scams, where the fraudster tricks the victim into thinking they are in a relationship. The opposing type of fraud is known as "pull payment fraud", which occurs when an account holder provides a payee with the relevant bank account details enabling a fraudulent payee to take (or "pull") funds from the payer’s account.[3]
Worldwide
[edit]Canada
[edit]A subset of push payment fraud is bank investigator fraud. The fraudster poses as an authority or bank investigator and persuades the victim to transfer the funds from their original account (which is claimed to be "compromised") to another account owned by the fraudster (but obstinately setup for the victim). Banks had refused to reimburse victims for such scams since the victim authorized the movement of funds. The Canadian Anti-Fraud Centre has recorded $11.7 million in victim losses from bank investigator scams in 2025 alone. [4]
United Kingdom
[edit]Until 2019 in the United Kingdom, because the victims of these frauds authorised the payments, albeit mistakenly, they were typically not fully reimbursed by their banks.[5] In September 2016, Which? raised a super-complaint regarding push payments and calling for changes in legislation to provide better protection for innocent bank customers.[3] The Payment Systems Regulator (PSR) investigated and found within "a short space of time" that the UK banks could work together in a better way to avoid scams and that some banks needed to do more to identify "potentially fraudulent incoming payments". The regulator was also concerned that there was limited information available on the scale and nature of the problem.[6] The PSR initiated a consultation process in November 2017, which was completed in February 2018. In March 2018 a "draft contingent model code" was published.[3]
From May 2019 some victims were able to receive refunds under the Contingent Reimbursement Model Scheme,[7] a voluntary scheme overseen by the PSR which provides protections for customers of signatory firms,[8] subject to a number of exclusions.
New rules where introduced on 7 October 2024 covering claims for reimbursement for amounts up to £85,000.[9]
Ireland
[edit]KPMG has reported that the Central Bank of Ireland set out its APP fraud banking expectations in its Consumer Protection Outlook Report 2023. The Central Bank requires financial businesses, to operate "effective measures to mitigate the risk of fraud", taking a proactive approach, and helping customers where necessary to recover funds where possible.[10]
References
[edit]- ^ Tims, Anna (2018-10-17). "If you've been sent bank details by email, be warned". The Guardian. ISSN 0261-3077. Retrieved 2019-01-07.
- ^ Lindsay, Jessica (2018-09-28). "What is a push payment and how to avoid fraud?". Metro. Retrieved 2019-01-07.
- ^ a b c Power, L. and Elgar, R., Push payment fraud: Update Autumn 2018, Walker Morris published on 17 October 2018, accessed on 1 April 2025
- ^ https://www.cbc.ca/news/business/rbc-bank-investigator-scam-1.7577770
- ^ "Refund hopes rise for payment scam victims". BBC News. 2018-09-28. Retrieved 2019-01-07.
- ^ Payment Systems Regulator (part of the Financial Conduct Authority), Which? authorised push payment super-complaint, Factsheet No. 16/9, accessed on 2 April 2025
- ^ "Consumer protection standards for APP scams". The Lending Standards Board (LSB). Retrieved 24 April 2023.
- ^ "Registered Firms". Lending Standards Board (LSB). Retrieved 24 April 2023. List of banking institutions signed up with the Lending Standards Board, updated as required.
- ^ HSBC Bank, What is an authorised push payment (APP) scam?, accessed on 30 October 2024
- ^ KPMG, Authorised Push Payment Scams, accessed on 2 April 2025
 | This crime-related article is a stub. You can help Wikipedia by expanding it. |
 | This finance-related article is a stub. You can help Wikipedia by expanding it. |
Authorised push payment fraud
View on Grokipediafrom Grokipedia
Definition and Characteristics
Core Elements and Mechanisms
Authorised push payment (APP) fraud involves a victim being deceived into voluntarily initiating and authorising a real-time electronic funds transfer from their bank account to an account controlled by the fraudster, typically through social engineering tactics that exploit trust and urgency.[1][2] The core element is the victim's active consent to the "push" payment, distinguishing it from unauthorised access or credential theft, as the transaction originates directly from the payer's banking interface without intermediary compromise.[3] This authorisation occurs via established payment rails, such as the UK's Faster Payments Service, where funds move irreversibly once confirmed, often within seconds, amplifying the fraud's efficiency for perpetrators.[15] The mechanism begins with the fraudster establishing contact through channels like phone calls, emails, or messaging apps, impersonating credible entities such as banks, government agencies, or investment firms to build false legitimacy. Victims are then coerced into acting quickly—often under fabricated emergencies like account freezes or urgent refunds—prompting them to log into their online or mobile banking app and execute the transfer to a mule or fraudster-controlled account.[16] Confirmation bias and psychological pressure, including threats of loss or promises of gain, reduce victim scrutiny, with the payment appearing legitimate on the bank's end due to the explicit authorisation.[17] Key operational features include the reliance on low-friction payment systems that enable instant settlement without holds, enabling fraudsters to withdraw funds rapidly before detection.[18] Funds may pass through intermediary "mule" accounts to obscure trails, but the initial push remains victim-driven, placing initial liability on the payer's bank under standard rules, though reimbursement schemes have emerged in response.[19] This structure exploits the causal chain of human deception preceding technical execution, where prevention hinges on interrupting the social engineering phase rather than post-authorisation reversal.[20]Distinctions from Other Fraud Types
Authorised push payment (APP) fraud is distinguished primarily by the victim's active authorization and initiation of the payment, typically via real-time bank transfer systems, under deceptive pretenses, rather than through unauthorized access or credential theft. In contrast to unauthorized fraud—such as account takeovers or hacked transactions where criminals gain illicit control of the victim's account without consent—APP fraud involves the victim willingly entering payment details and confirming the transfer, often believing it to be legitimate, which complicates liability and reversal processes.[9][17][21] Unlike card-not-present or credit card fraud, which frequently exploits stolen card details for merchant transactions with built-in chargeback mechanisms and issuer protections, APP fraud leverages irreversible push payments through systems like the UK's Faster Payments Service or the US's RTP network, where funds are transferred directly from the victim's account to the scammer's without intermediary processors or easy reversibility.[22][2] This reliance on social engineering to induce consent, rather than technical breaches or data skimming, sets APP apart from phishing-led credential theft, as the fraudster does not require ongoing access to the victim's device or account post-authorization.[23][3] APP fraud also differs from traditional wire or check fraud precursors by exploiting digital immediacy and low-friction interfaces, such as mobile banking apps, enabling rapid, high-value transfers that evade pre-authorization checks common in slower legacy systems. While all involve deception, APP's "authorized" nature shifts evidentiary burdens toward proving victim coercion or negligence, often resulting in partial or no reimbursement absent regulatory mandates, unlike the statutory protections for unauthorized electronic fund transfers under frameworks like the US Electronic Fund Transfer Act.[5][9][17]Historical Context
Pre-Digital Era Precursors
The Spanish Prisoner scam, documented as early as the late 16th century and proliferating in the 19th century, exemplifies an early precursor to authorised push payment fraud, wherein victims were deceived into voluntarily forwarding funds via postal mail in anticipation of a substantial reward. In this scheme, fraudsters posed as intermediaries for a wealthy prisoner allegedly held in Spain, claiming the detainee possessed vast riches—often millions in gold or bonds—but required an upfront payment from the victim to secure release, bribe officials, or cover legal fees. Victims, typically affluent businessmen identified through trade directories, received letters promising shares of the fortune upon remitting small sums, such as travel expenses or bonds, leading to iterative demands for additional "fees" as obstacles arose. By 1898, U.S. authorities recorded numerous instances, including cases where victims lost thousands of dollars in mailed checks or money orders before realizing the ruse.[24][25] This advance-fee mechanism mirrored modern APP fraud's reliance on social engineering to elicit authorised transfers, predating electronic banking by centuries and relying instead on physical remittances like postal orders or bank drafts. Historical records indicate the scam's spread across Europe and North America in the 1800s, with variations adapting to local contexts, such as claims tied to Spanish nobility or imprisoned aristocrats during political upheavals. U.S. Postal Inspectors in the early 20th century documented losses exceeding tens of thousands of dollars annually from such mail frauds, where victims initiated payments from their own accounts or cash reserves, akin to today's bank-initiated pushes. The scheme's persistence into the fax era of the 1980s, particularly from Nigeria, transitioned these voluntary payment deceptions toward proto-digital formats but retained the core element of victim-authorised disbursements.[26][27] Other pre-digital confidence tricks, such as inheritance or lottery swindles via correspondence, similarly induced victims to mail funds for purported "processing fees" or taxes on winnings, with documented cases in the U.S. as early as the 1830s involving fraudulent claims of unclaimed estates. These analogs underscore a consistent causal pattern: perpetrators exploited trust to prompt self-initiated transfers, unmediated by account takeovers, much like APP fraud's distinction from unauthorised access crimes. Empirical evidence from postal fraud prosecutions reveals systemic vulnerabilities in voluntary payment systems, where absence of reversal mechanisms amplified losses, paralleling challenges in pre-regulatory banking eras.[28][29]Acceleration with Real-Time Payment Systems
The introduction of real-time payment systems marked a pivotal acceleration in authorised push payment (APP) fraud, as these infrastructures enabled near-instantaneous and irrevocable fund transfers, minimizing opportunities for intervention or reversal. In the United Kingdom, the Faster Payments Service (FPS), launched on 27 May 2008 by the Payments Council (now under Pay.UK), pioneered domestic real-time retail payments, allowing transfers up to £1 million (later adjusted) to settle in seconds, 24/7.[30] This shift from slower batch systems like BACS, which processed payments overnight or in days, empowered scammers to exploit victim authorizations before banks could detect anomalies, as real-time rails provide scant window for fraud monitoring or clawback.[10] Globally, similar systems—such as the US's RTP network (2017) and FedNow (2023)—have correlated with APP fraud surges, as instant settlement renders pushed payments effectively final, with scammers often withdrawing funds abroad via mule accounts within minutes.[9] Post-launch, UK APP fraud rapidly migrated to FPS, comprising 98% of such scam payments by volume in recent years, as slower alternatives like CHAPS saw diminished use for fraudulent transfers.[31] Domestic payment fraud transitioned "almost immediately" to FPS, with losses escalating due to its ubiquity and speed; for instance, UK Finance data indicate APP incidents reached 195,996 cases with £583.2 million in gross losses by 2021, reflecting compounded growth from the system's maturation.[32][33] This acceleration stemmed causally from reduced friction: pre-FPS, delayed clearing allowed for potential halts, but real-time finality incentivized scammers to prioritize push mechanisms, exploiting social engineering without needing account compromises. Empirical patterns show over 90% of UK APP losses now tied to real-time channels, underscoring how these systems, while boosting efficiency, amplified fraud vectors absent robust pre-authorization safeguards.[34] Regulatory acknowledgments highlight this dynamic; the UK's Payment Systems Regulator (PSR) notes FPS's role in enabling "irreversible" scams, prompting mandatory reimbursements from October 2024 to mitigate harms that batch-era fraud rarely inflicted at scale.[35] Internationally, bodies like the Federal Reserve observe that fast payment adoption heightens APP efficacy, with US projections estimating losses nearing $15 billion by 2028, driven by analogous real-time infrastructures.[23] Thus, real-time systems catalyzed APP fraud's proliferation by aligning technological speed with scammers' operational needs, transforming episodic deceptions into high-volume, low-reversibility crimes.Typology of Scams
Impersonation and Authority Scams
Impersonation and authority scams represent a core variant of authorised push payment (APP) fraud, wherein scammers pose as trusted individuals, organizations, or officials to exploit victims' compliance and induce voluntary fund transfers via real-time payment systems.[3] These tactics rely on social engineering to establish false credibility, often through unsolicited phone calls (vishing), emails, or messages that mimic legitimate communications from banks, law enforcement, or government bodies.[36] Victims are coerced into authorizing payments to purportedly "safe" accounts or to resolve fabricated emergencies, with the scammer providing account details that lead directly to mule or controlled accounts.[1] In bank impersonation schemes, fraudsters contact victims claiming to represent their financial institution, alleging account compromise or suspicious activity, and direct them to transfer funds immediately to a "protected" holding account under the bank's control—effectively routing money to the perpetrator.[3] Authority-based variants escalate urgency by mimicking officials from entities like the police or HM Revenue and Customs (HMRC); for instance, scammers may assert that the victim's funds are linked to criminal investigations, requiring transfers to "seize" or safeguard assets, or demand payments for alleged unpaid taxes under threat of arrest.[36] Such scams prey on deference to authority, with perpetrators using spoofed caller IDs, official-sounding scripts, and fabricated documentation to bypass skepticism.[37] These scams differ from unauthorized fraud by securing the victim's explicit consent, often reinforced through repeated confirmations or secondary verifications that the scammer controls.[2] In the UK, where APP fraud is prevalent due to systems like Faster Payments, impersonation tactics contributed to losses exceeding £148 million in 2023 across forms including police, bank staff, and government impersonations.[38] Official data from UK Finance indicates that while purchase and investment scams dominate volume, impersonation-driven cases persist due to their adaptability, with scammers leveraging publicly available personal data to personalize approaches and heighten plausibility. Mitigation challenges arise from the remote nature of initiations, predominantly via telecommunications or online channels, underscoring the need for cross-sector verification protocols beyond victim education.[39]Investment and Romance Scams
Investment scams in authorised push payment (APP) fraud entail fraudsters deceiving victims into authorizing transfers to bogus investment vehicles, such as fictitious cryptocurrency schemes or stock trading platforms, under promises of exceptional returns. These operations exploit victims' financial aspirations through initial contacts via social media advertisements, unsolicited messages, or fabricated online seminars, gradually building urgency to "invest" via push payments on real-time systems like the UK's Faster Payments Service.[40][19] The scammers often use fabricated testimonials, dashboards showing illusory profits, and pressure tactics to prompt multiple, escalating transfers, with funds routed to mule accounts or overseas entities for rapid dissipation.[23] In the UK, investment scams drove the overall rise in APP losses, contributing to £257.5 million in total APP fraud for the first half of 2025—a 12% increase from the prior year—despite a decline in case volume, due to their high per-victim value averaging £15,098.[41][42] Globally, the U.S. Federal Bureau of Investigation reported $4.57 billion in investment scam losses for 2023, many involving authorized electronic transfers akin to APP mechanisms, marking a 38% year-over-year surge.[43] These scams disproportionately affect middle-aged and older demographics seeking retirement security, with fraudsters leveraging algorithmic targeting on platforms to identify vulnerable profiles.[9] Romance scams, another prevalent APP variant, involve perpetrators cultivating fabricated online relationships—typically via dating apps or social networks—to extract funds through authorized payments framed as emergencies, gifts, or shared "opportunities." Victims, often isolated individuals, are groomed over weeks or months with affectionate communication, shared fabricated life stories, and escalating requests, such as covering medical bills or travel costs, leading to direct bank transfers.[44][45] These frequently overlap with investment elements, where "partners" urge victims to co-invest in high-yield schemes, transitioning emotional manipulation into financial exploitation.[46] UK data from the first half of 2025 showed romance scam losses rising 35%, amid a broader APP uptick, while Barclays reported a 20% increase in cases for the first quarter alone, with average victim losses climbing to £8,000 in 2024 from £5,800 the previous year.[47][48] In the U.S., romance scams inflicted $1.14 billion in losses in 2023, per the Federal Trade Commission, with median per-victim amounts at $2,000, though UK and global patterns indicate higher aggregates due to repeated extractions.[49] Perpetrators, frequently operating from regions like West Africa or Eastern Europe, exploit platform algorithms and anonymized communications, evading detection until significant sums are transferred.[50]Empirical Impacts
Global and Regional Statistics
Authorised push payment (APP) fraud losses have escalated with the adoption of instant payment infrastructures, though comprehensive global aggregation remains challenging due to varying definitions and underreporting across jurisdictions. Estimates indicate billions in annual losses worldwide, with imposter and investment scams as primary vectors. In 2023, global scam pages mimicking financial institutions proliferated at over 2,000 launches per month, facilitating APP schemes. Projections suggest APP fraud will contribute substantially to payment fraud's compound annual growth rate of 11% from 2022 to 2027. In the United Kingdom, where Faster Payments enable rapid transfers, APP fraud accounted for £450.7 million in losses in 2024, down slightly from prior years but still comprising a dominant share of personal fraud. The figure includes £365.7 million from purchase, investment, and romance scams. For the first half of 2025, losses rose 12% year-over-year to approximately £258 million, with 226,306 cases reported—a 4% increase in volume despite reimbursement mandates.[51][47] United States data highlights APP's scale in a fragmented reporting environment, with imposter scams alone causing an estimated $2.5 billion in losses in 2024, up sharply from prior years. Investment scams, frequently executed via authorised pushes, totaled $4.57 billion in victim-reported losses in 2023, a 38% increase from 2022. Median fraud incident values peaked at $500 in 2023, reflecting higher-value APP targets. Losses are forecasted to exceed $3 billion annually by 2028 without enhanced safeguards.[23][43][52] In Australia, APP losses surged at a 39% compound annual growth rate from 2018 to 2023, embedded within broader scam reports of $2.03 billion in 2024. Projections estimate $1.76 billion in APP-specific losses by 2028, driven by online-solicited transfers accounting for nearly half of scam values.[53][54] European Union and European Economic Area figures show APP comprising 57% of €1.13 billion in fraudulent transfers during the first half of 2023, equating to roughly €644 million. Card-not-present and social engineering-driven APP variants dominate, with relative fraud rates at 0.031% of payment value in recent analyses.[55][56]| Region | Key Statistic (Recent Period) | Source Notes |
|---|---|---|
| UK | £450.7M losses (2024 full year) | UK Finance via Forbes; includes major scam types.[51] |
| US | $2.5B imposter APP losses (2024); $4.57B investment scams (2023) | Deloitte estimate; FBI IC3 data.[23][43] |
| Australia | Projected $1.76B by 2028; 39% CAGR (2018-2023) | Cybersecurity projections; within $2.03B total scams (2024).[53] |
| EU/EEA | €644M APP (H1 2023, 57% of €1.13B fraud) | LSEG data on transfers.[55] |
Causal Effects on Victims and Economies
Authorised push payment (APP) fraud directly results in substantial financial losses for victims, with the average loss per incident in the UK often exceeding several thousand pounds, depleting personal savings, retirement funds, or liquid assets essential for daily living and future security.[57] These losses compel many victims to incur debt, sell assets, or rely on family support, exacerbating household financial instability and potentially leading to long-term credit damage or bankruptcy in severe cases.[58] Beyond immediate monetary harm, APP fraud inflicts profound psychological and emotional tolls, including heightened anxiety, depression, shame, and suicidal ideation, as victims grapple with self-blame for being deceived despite authorizing the payments themselves.[59] Approximately one-third of UK victims report deteriorated mental health, with effects persisting for months or years, often isolating individuals from social networks and straining personal relationships due to eroded trust and interpersonal conflicts.[15][58] Physical health consequences, such as stress-induced conditions like insomnia or hypertension, further compound these issues, sometimes necessitating medical intervention and associated costs.[60] On a macroeconomic scale, APP fraud drains resources from productive economies, with UK losses totaling £450.7 million in 2024, representing a net transfer of funds—often to overseas criminals—that reduces domestic consumption, investment, and liquidity without generating equivalent economic value.[61] This direct extraction contributes to broader inefficiencies, as victims curtail spending and businesses face heightened caution, evidenced by UK small and medium enterprises reporting £6.15 billion in foregone transactions due to fraud-related hesitancy in the 2024-2025 financial year.[62] In the US, analogous imposter-driven APP losses reached an estimated $2.5 billion in 2024, amplifying systemic drags on growth through diminished consumer confidence and increased financial sector compliance expenditures.[23] Collectively, these effects erode trust in payment systems, prompting reduced participation in digital transactions and perpetuating a cycle of lower economic velocity and higher indirect costs for verification and recovery efforts.[63]Institutional and Regulatory Responses
Technological and Procedural Safeguards
Technological safeguards against authorised push payment (APP) fraud primarily involve systems designed to verify transaction details and detect anomalies in real time. Confirmation of Payee (CoP), a service operated by Pay.UK in the United Kingdom, requires payers to confirm that the recipient's name matches the account holder before processing certain payments, aiming to reduce misdirected funds and some APP incidents. Rolled out progressively since 2019, CoP coverage expanded to include CHAPS payments in 2023 and reached over 400 firms by October 2024, with further extensions to hundreds more participants to broaden its application across payment chains.[64][65] However, empirical evidence indicates CoP's limitations in fully mitigating APP fraud, as perpetrators frequently exploit name-matching tactics or partial matches, rendering it more effective against errors than sophisticated social engineering scams.[66] Artificial intelligence (AI) and machine learning (ML) models enhance detection by analyzing behavioral patterns, transaction velocities, and contextual signals to flag potential APP risks before authorization. A Pay.UK pilot in 2024 tested an AI-driven solution that detected 56% of APP scams in faster payments, demonstrating predictive capabilities through aggregated industry data.[9] Similarly, Mastercard's Decision Intelligence platform, deployed since 2023, leverages AI to assess scam probabilities in real-time payment requests, intervening prior to fund transfers by prompting additional user scrutiny.[67] Visa Direct employs layered approaches including pre-transaction checks, behavioral signals, account validation, and network-level intelligence via Visa A2A Protect for real-time scam detection. Both Mastercard Move and Visa Direct face similar APP fraud risks in real-time push payments, with Mastercard Move utilizing risk mitigation, fraud analytics, and AI-based Consumer Fraud Risk tools; no reliable sources show significant differences in fraud risk levels between the two.[68][69] These tools integrate with existing infrastructures to process vast datasets, including device fingerprints and geolocation, though their efficacy depends on continuous model retraining to counter evolving fraud tactics like deepfakes.[16] Procedural safeguards complement technology through standardized internal protocols and inter-institutional coordination to impose friction on high-risk transfers. Under guidance from the UK's Financial Conduct Authority (FCA), payment service providers (PSPs) must implement risk-based measures, such as mandatory warnings, transaction holds, or secondary authentications for flagged payments, without unduly disrupting legitimate flows.[70] The Payment Systems Regulator (PSR) mandates PSPs to maintain robust scam prevention processes, including intelligence-sharing via hubs like the Financial Crime Information Sharing Platform, which facilitates collective monitoring of mule accounts and scam patterns.[71] These procedures, enforced since the PSR's 2024 reimbursement regime, require PSPs to assess gross negligence thresholds and document intervention attempts, fostering accountability while empirical data from 2024 shows persistent APP losses exceeding £213 million in the UK alone during the first half of the year.[65]Mandatory Reimbursement Regimes
In the United Kingdom, the Payment Systems Regulator (PSR) established a mandatory reimbursement requirement for authorised push payment (APP) fraud effective 7 October 2024, applying to Faster Payments and CHAPS transactions.[72] This regime obliges sending payment service providers (PSPs) to reimburse eligible victims—individuals, microenterprises, and charities—for losses up to £85,000 per claim, a cap designed to cover 99.8% of incidents by volume and 90% by value.[72] Reimbursement must occur within five business days of a confirmed claim, with receiving PSPs required to contribute 50% of the amount to the sending PSP, promoting shared responsibility across the payment chain.[21] Sending PSPs may impose an excess fee of up to £100 on consumers found grossly negligent, but full denial applies only in cases of gross negligence by the victim, such as deliberately ignoring warnings.[73] The UK's framework excludes claims exceeding £85,000, international transfers, or fraud involving non-UK accounts, focusing solely on domestic UK-initiated payments to mitigate administrative burdens.[21] Early implementation data from October 2024 to December 2024 indicated that 86% of eligible claims were reimbursed within the initial three months, though PSPs reported challenges in assessing negligence and coordinating with receiving institutions.[74] By May 2025, the PSR issued a consolidated policy statement affirming the regime's structure while addressing compliance gaps, such as delays in inter-PSP reimbursements.[75] In the European Union, the Payment Services Regulation (PSR), building on PSD3 proposals, mandates full reimbursement for impersonation fraud victims from their PSP under Article 59, with broader APP fraud protections requiring compensation unless the payment service user acted fraudulently or with gross negligence.[76] These rules, effective following the regulation's adoption in 2024, emphasize PSP liability for failing due diligence, though implementation varies by member state and lacks the UK's fixed caps or shared model.[77] Singapore similarly enforces mandatory reimbursement for APP victims, prioritizing full recovery absent victim culpability, as part of its regional push against real-time payment scams.[78] Australia's Scams Prevention Framework, under legislative proposals in 2024, contemplates mandatory APP fraud reimbursements but has not yet imposed them, relying instead on voluntary codes and entity-specific obligations.[79] In contrast, the United States lacks federal mandates, with reimbursements handled via voluntary bank policies or state consumer protections, highlighting divergent approaches to balancing victim relief against incentives for vigilance.[80] These regimes aim to deter fraud by shifting costs to PSPs, yet critics argue they may reduce incentives for victims to exercise caution without robust negligence thresholds.[81]Liability and Accountability Debates
Victim Negligence and Personal Responsibility
In authorised push payment (APP) fraud, victims initiate and authorise transfers to scammers' accounts, distinguishing it from unauthorised access and placing initial causal responsibility on the individual's decision-making process.[82] Empirical analyses indicate that victims frequently overlook verifiable red flags, such as unverified payee details or urgent demands inconsistent with standard transactions, contributing directly to losses. For instance, common errors include failing to utilise Confirmation of Payee services, which match account names and numbers, and proceeding without independent verification of the recipient's legitimacy despite accessible tools.[21][83] Regulatory frameworks acknowledge this by incorporating victim accountability thresholds. In the UK, the Payment Systems Regulator's (PSR) mandatory reimbursement regime, effective 7 October 2024, requires payment service providers to refund up to £85,000 per claim for most APP incidents, but explicitly excludes cases of victim complicity or gross negligence.[21] Gross negligence is defined as a high threshold involving significant carelessness exceeding the minimum consumer standard of caution, such as deliberately ignoring targeted scam warnings from the sending provider or repeatedly bypassing security prompts without justification; it does not apply to vulnerable individuals and requires case-specific evidence rather than presuming fault for single lapses.[84][85] Prior to mandatory rules, voluntary codes and ombudsman decisions emphasised shared liability, with the Financial Ombudsman Service rejecting automatic victim blame and instead scrutinising banks' investigations for procedural failures while upholding victim due diligence obligations.[86] Data from UK Finance's 2023 report, covering nearly 175,000 APP cases, highlight that pre-reimbursement prevention relied heavily on individual vigilance, as institutional safeguards alone proved insufficient against social engineering tactics exploiting haste or trust.[6] In jurisdictions like the US, authorised payments generally absolve financial institutions of liability, reinforcing that victims bear primary responsibility for authorising unverified transfers unless proven institutional negligence intervenes.[82] Critics argue that emphasising victim negligence deflects from systemic vulnerabilities, yet first-principles assessment reveals that scammers succeed through exploiting predictable cognitive biases—such as reciprocity or authority deference—rather than inevitable institutional flaws, underscoring the need for personal safeguards like pausing transactions and consulting independent sources.[87] Post-2024 UK data show 97% of claims resolved within 35 days with high reimbursement rates, but sustained reductions in APP incidents (down in volume per UK Finance 2025 preliminary figures) correlate with heightened consumer awareness campaigns promoting due diligence over reliance on post-fraud refunds.[88][89]Bank and Systemic Failures
Banks have demonstrated inconsistent capabilities in detecting and intervening in APP fraud transactions, with the Payment Systems Regulator (PSR) reporting significant disparities in performance across the 14 largest UK banking groups in 2023, where fraud losses per £1 million of outbound payments varied widely, indicating lapses in real-time monitoring and risk assessment protocols.[90][91] Prior to the mandatory reimbursement requirement effective October 7, 2024, many banks resisted reimbursing victims, attributing losses to customer gross negligence under Payment Services Regulations, which prompted over 1,000 court claims by 2023 and exposed deficiencies in proactive safeguards like transaction holds for high-velocity or atypical payments.[92][93] Litigation has highlighted specific bank shortcomings, such as in the 2025 UK Supreme Court case Philipp v Barclays Bank UK PLC, where the victim lost £700,000 in 2018 to scammers impersonating solicitors, yet the court affirmed no general duty on banks to recover misdirected funds or override authorizations, underscoring banks' historical reliance on customer instructions without sufficient overrides based on internal fraud signals.[92][94] Similarly, in CCP Graduate School Ltd v National Westminster Bank plc, the High Court in 2025 rejected claims of a "duty of retrieval," but the case revealed banks' failures to act on patterns like multiple rapid transfers to new accounts, which could have triggered interventions under existing anti-fraud policies.[95] Systemically, the UK's Faster Payments Service (FPS), operational since 2008, prioritizes speed—settling transfers in seconds—over reversible safeguards, creating a causal vulnerability where fraudsters exploit the brief detection window, leading to irreversible losses in 98% of cases as funds disperse across accounts before alerts propagate.[9][96] This design flaw, compounded by fragmented intelligence sharing among payment service providers (PSPs), has allowed APP fraud to escalate, with UK Finance data showing £459.7 million in losses in 2023 alone, representing 62% of total scam losses, despite voluntary codes like the 2019 Contingent Reimbursement Model (CRM) that failed to curb a 12% rise in cases from 2020 to 2023.[97][98] Delayed mandatory adoption of Confirmation of Payee (CoP), which matches payee details to reduce impersonation, until 2023 further perpetuated systemic gaps, as partial voluntary rollout left vulnerabilities in cross-bank transfers.[1] These failures reflect a broader institutional inertia, where banks' incentives aligned more with processing efficiency than fraud deterrence, as evidenced by PSR analyses showing low intervention rates on outbound payments—often under 1% for suspicious APP patterns—prioritizing customer convenience and revenue from transaction volumes over causal risk mitigation through holds or enhanced authentication.[99][100] The introduction of shared liability under the 2024 PSR rules, splitting reimbursements 50:50 between sending and receiving PSPs up to £85,000, acknowledges these shortcomings but highlights prior over-reliance on victim accountability, with empirical data indicating that without such mandates, fraud prevention investments remained suboptimal.[101]Prevention Strategies and Future Outlook
Individual and Educational Measures
Individuals can mitigate the risk of authorised push payment (APP) fraud by adopting vigilant verification practices before authorizing any transfer. Essential steps include pausing to reflect on unexpected payment requests, independently verifying the recipient's details through official channels rather than responding to provided contact information, and using tools like Confirmation of Payee (CoP) services, which have facilitated over 2 billion account name checks in the UK as of 2024 to flag mismatches.[21] Additionally, enabling multi-factor authentication (MFA) on banking apps and never sharing one-time passcodes (OTPs) or full account details unless identity is confirmed reduces unauthorized access risks.[102] [103] Contacting banks via verified numbers, such as the UK-wide 159 line for suspicious calls, allows direct confirmation without relying on caller-provided instructions.[104] Key personal safeguards encompass:- Refraining from rushed decisions on high-value or unusual transfers, instead consulting trusted advisors or helplines like Citizens Advice.[21]
- Avoiding disclosure of personal or financial information to unverified parties, including shredding documents containing sensitive data.[105]
- Regularly monitoring accounts for anomalies and reporting suspicions immediately to banks and authorities like Action Fraud within 13 months for potential reimbursement eligibility.[103]
Policy Recommendations for Causal Deterrence
To causally deter authorised push payment (APP) fraud, policies must target the incentives and operational enablers for fraudsters, such as low detection rates, rapid fund dissipation, and cross-border anonymity, rather than solely reimbursing victims after the fact. Empirical evidence from UK regulatory interventions indicates that enabling payment service providers (PSPs) to intervene pre-execution disrupts the causal chain, with delays allowing for verification and freezing of suspicious transactions. For instance, the UK's Financial Conduct Authority (FCA) policy permits PSPs to delay outbound payments for up to four business days on reasonable suspicion of fraud, based on indicators like new payees, mismatched names via Confirmation of Payee systems, or patterns of rapid onward transfers by recipients.[111] This measure increases the risk of interception for fraudsters, who rely on instant Faster Payments to evade recovery, as demonstrated by reduced execution times in scams where funds are moved within minutes.[9] Mandatory information sharing among PSPs represents another causal lever, facilitating real-time intelligence on mule accounts and fraud patterns without breaching data protection rules. FCA guidance encourages payer and payee PSPs to exchange details on suspicious activities, such as unusual velocity of incoming funds, enabling collective disruption of fraud networks.[111] Consortium analytics models, aggregating anonymized data across institutions, have shown efficacy in identifying international APP rings by flagging cross-border flows, with trials demonstrating improved detection of synthetic identities used by fraudsters.[112] Complementing this, enhanced identity verification mandates— including biometrics and stepped-up checks for high-risk transfers—raise the operational costs for fraudsters creating mule accounts, as evidenced by lower synthetic identity success rates in systems with robust know-your-customer protocols.[9] On the international front, policies promoting cross-border collaboration address the extraterritorial nature of many APP operations, where fraudsters in jurisdictions like Nigeria or India target UK victims. SWIFT's 2025 AI-driven trials with 13 banks achieved doubled real-time fraud detection across 10 million test transactions through privacy-enhanced data sharing, underscoring the value of standardized protocols for global payment rails.[113] Europol's emphasis on joint operations against payment system fraud, including APP variants, has led to disruptions in card-not-present schemes with similar mechanics, though APP-specific yields remain limited by jurisdictional barriers.[114] To amplify deterrence, regulators should incentivize PSPs via liability adjustments tied to prevention efficacy, such as reduced reimbursement burdens for firms demonstrating low fraud incidence through audited controls, thereby aligning private incentives with systemic risk reduction.[71]- Delay and verification protocols: Expand FCA-style payment holds to all real-time systems, calibrated to fraud probability assessments using machine learning on transaction metadata.
- Data consortia mandates: Require PSP participation in shared intelligence platforms, with penalties for non-compliance to ensure comprehensive coverage.
- Fraudster targeting: Legislate faster asset freezing for receiving accounts and harsher penalties for money laundering facilitators, building on Fraud Act 2006 provisions but with dedicated APP task forces.
- Global standards: Advocate for G20-level harmonization of CoP and verification, reducing safe havens for laundered proceeds.