Picture an illustrative buyer:
- Monday 2 March 2026. She finds a used car online for £2,400.
- Tuesday 3 March. She pays by Faster Payment; the payee name check shows a match.
- Friday 6 March. The seller stops answering. There is no car.
What does authorized push payment (APP) fraud mean?
In APP fraud the victim makes the payment; the what fraud is entry covers the wider crime. UK Finance defines it: "Authorised Push Payment (APP) fraud occurs when a person is tricked into authorising a payment to a fraudster, where the recipient is not who the user intended to pay, or the purpose is fraudulent" (Annual Fraud Report 2026, page 33).
A push payment, such as a bank transfer, is sent by the payer; a card payment or direct debit is pulled by the payee's side.
UK Finance counted 248,070 APP cases in 2025 and £576.4 million lost, £354.3 million of it returned.
Is APP fraud the same as unauthorized fraud, application fraud or a fraud app?
No. In unauthorized fraud the criminal makes the payment, with a stolen card or through account takeover; "APP fraud is different to unauthorised fraud", says the Payment Systems Regulator (PSR). Application fraud instead opens an account or loan in someone else's name. Fraud apps, fake mobile apps, can be the lure.
The money lands with the criminal or a money mule.
How do fraudsters get people to send the money themselves?
How it works, in the buyer's case:
- Impersonation. The criminal poses as a private seller and advertises the car at a low price.
- Deception. The seller asks for a bank transfer instead of the marketplace's payment option, as UK Finance describes.
- Payment authorization. She approves £2,400 to a new payee from her own phone, so login checks pass.
- Fund transfer. Once it lands, in seconds, the money moves to two other accounts.
- Discovery. Three days later the seller is gone.
Which signs show that a payment request is a scam?
Table 1. What to look for: signs of an APP scam and what the bank can check.
| Sign (UK Finance wording in quotes) | What the bank's data shows | Control |
|---|---|---|
| A "low price to attract buyers" | First payment to a new payee | Scam warning before payment |
| Asked to "pay via a bank transfer instead" | Payee added and paid in one session | Ask what is being bought |
| A "high return", "time limited" | Amount out of line with the account's history | Hold and call back |
| Someone met online needs money for a visa or flights | Many payments over time (9.7 per romance scam) | Review the payee |
| Invoice bank details that "have changed" | Name check: no match or a close match | Confirm by a known number |
| An urgent payment request from the CEO | Urgent business payment to a new account | Second approver |
| A "safe account" for the money | Balance moved to a new payee | Hold and call the customer |
| A payment to a bank abroad | Beneficiary bank outside the UK | Check a beneficiary bank's SWIFT code |
Confirmation of Payee, the UK's payee name check, is "designed to help reduce misdirected payments" (Pay.UK).
Burçak Aydın, a former bank compliance specialist: "A payee name check can return a match when the criminal is the payee the victim meant to pay: those malicious payee scams were 221,117 of the 248,070 UK APP cases in 2025, and Nacha's new definition of false pretenses, a lie about identity, authority or who owns the account, leaves fake goods scams out."
Which types of APP scams influence people, and which cost the most?
Table 2. The eight APP scam types UK Finance reports, 2025 (Annual Fraud Report 2026, pages 36 to 44).
| Type | Group | How it influences people | Cases | Losses |
|---|---|---|---|---|
| Purchase | Malicious payee | Victims pay for goods that never arrive | 175,809 | £118.1m |
| Investment | Malicious payee | Fund a fake investment for a high return | 14,893 | £221.5m |
| Romance | Malicious payee | Pay someone they believe is a partner | 6,335 | £39.2m |
| Advance fee | Malicious payee | Pay a fee to release a larger sum | 24,080 | £58.4m |
| Invoice and mandate | Malicious redirection | Pay a bill to bank details that "have changed"; targets consumers and firms | 2,305 | £41.3m |
| CEO fraud | Malicious redirection | Pay an urgent request from a fake CEO | 197 | £5.6m |
| Impersonation: police or bank staff | Malicious redirection | Move money to a "safe account" | 6,016 | £55.5m |
| Impersonation: other | Malicious redirection | Pay a fake fine or tax bill, or return a refund paid in error | 18,435 | £36.9m |
These eight types form two groups: malicious payee scams pay the person the victim meant to pay, for a fraudulent purpose, and malicious redirection sends the money to someone else. Purchase scams are the most common, 71 percent of 2025 cases, and investment scams cost the most, 38 percent of losses. CEO fraud has the highest average loss, over £28,000. Tech support scams, remote access to "fix" a problem, appear under "impersonation: other"; charity appeals have no row. Both impersonation rows are impersonation fraud.
Why do instant payments like FedNow make APP fraud harder for financial institutions to stop?
FedNow lets banks "instantly transfer money" "any time of the day, on any day of the year" (Fed release, 20 July 2023). Faster Payments carried £460.9 million of the £576.4 million UK APP losses in 2025 (UK Finance). Real time rails make it worse, since a hold must precede settlement.
A UK payer's bank with reasonable grounds to suspect "fraud or dishonesty" may delay a payment, no longer than necessary and never past "the end of the fourth business day" after receipt (SI 2024/1013, regulation 86(2C), from 30 October 2024). EU payment firms must verify the payee of a euro credit transfer before the payer authorizes it (Regulation (EU) 2024/886, Article 5c).
What has the Federal Reserve added to FedNow against APP fraud?
FedNow had more than 1,400 participating organizations when Federal Reserve Financial Services raised its limit to $10 million from November 2025 (FRFS, 9 September 2025). A network intelligence API with data on the receiving account, its "latest risk mitigation tool", was due for early adopters on 28 April 2026, and the FedNow Service is exploring easier ways to enable Payee Name Verification (FRFS, 23 April 2026).
Monitoring is now required under Nacha's ACH rules: since 20 March 2026 every sending bank (ODFI) and each receiving bank (RDFI) with 10 million or more ACH receipts in 2023 must have processes to identify entries "initiated due to fraud" (credits, for receiving banks); the rest followed on 19 June 2026.
Who pays the victim back in the UK, the EU and the US?
The buyer's UK claim:
- Claim. £2,400, within 13 months of the payment.
- Excess. Up to £100, optional, so £2,300 comes back.
- Time. Within 5 business days, or 35 if the bank stops the clock.
- Who pays. The sending and receiving firms. They split it 50:50, £1,150 each.
The PSR's duty comes from section 72 of the Financial Services and Markets Act 2023, for Faster Payments orders "executed subsequent to fraud or dishonesty". Firms now reimburse 97 percent of in scope claims (PSR, 1 July 2026, citing Frontier Economics).
In England, Wales and Northern Ireland the criminal commits fraud by false representation (Fraud Act 2006, section 2): up to 10 years, a fine or both on indictment (section 1).
In the EU, Parliament and Council "have struck a deal" (27 November 2025): a payment firm "must refund the full amount" to a customer who was tricked by someone posing as its staff and tells the police and the firm, but the deal "needs to be formally adopted" first (European Parliament).
Table 3. Who pays the victim back: a comparison of the regulatory rules by jurisdiction.
| Rule | Covers | Bank's duty | Refund |
|---|---|---|---|
| UK: PSR reimbursement requirement, from 7 October 2024 | Individuals, microenterprises, charities; Faster Payments or CHAPS between UK accounts | Reimburse within 5 business days (an outcome within 35 if the clock is stopped); split 50:50 with the receiving firm | Up to £85,000, less an optional excess of up to £100; none if complicit, or grossly negligent unless vulnerable |
| UK: Payment Services Regulations 2017, regulation 86(2C) | Payments executed wholly within the UK in sterling | May delay a suspicious payment to the end of the fourth business day | Payer's bank covers charges and interest from the delay (regulation 94A) |
| EU: Regulation 260/2012, Article 5c | Euro credit transfers; euro area from 9 October 2025, others by 9 July 2027 | Verify the payee before authorization | Due without delay if a failed check led to a defective payment (5c(8)) |
| US: Regulation E, 12 CFR 1005 | Consumer electronic fund transfers, not Fedwire | Resolve errors, including unauthorized transfers (1005.11) | Liability limits for unauthorized transfers (1005.6) |
| US: Nacha Rules, from 20 March 2026 | ACH entries; participants (ODFIs and RDFIs), in two phases | Monitor for entries "initiated due to fraud" | None on Nacha's page |
Does Regulation E cover APP fraud in the US?
Regulation E covers an "unauthorized electronic fund transfer", one "initiated by a person other than the consumer without actual authority to initiate the transfer" (12 CFR 1005.2(m)). The CFPB counts a transfer as unauthorized when a consumer is "fraudulently induced into sharing account access information" that a third party then uses (CFPB EFT FAQs, question 5).
Fedwire transfers fall outside Regulation E (12 CFR 1005.3(c)(3)). Wire fraud under 18 U.S.C. 1343 can also cover a scheme using interstate wires: up to 20 years, or 30 when a financial institution is affected.
Who catches APP fraud: the sending bank, the receiving bank or the customer?
No single party sees the whole scam:
- The sending bank sees the payment first and can warn, hold or, in the UK, delay it.
- The receiving bank holds the account, perhaps a mule's; UK Finance says passing it a case in real time "greatly increases the chances of being able to freeze it".
- The customer decides last; the PSR says to pause before paying and to contact the bank immediately if they suspect a scam.
For the receiving bank this is also money laundering work, set out in the whitepaper on AML in the UK; how fraud detection works covers methods and solutions.
complead, formerly Sanction Scanner, can help on both sides: its bank transaction monitoring for fraud scores inbound and outbound transfers before execution and checks payees for mule links, and the fraud team decides.
Back to the buyer: £2,300 came back in five business days; the advert's account was a mule's.
Related terms
- Account takeover fraud. The criminal pays from a hijacked account.
- CEO fraud. Staff pay a fake executive's order.
- Romance scam. The victim pays a fake partner.
- Chargeback fraud. A cardholder disputes a real purchase for a refund.
