Authorized Push Payment Fraud Detection: When the Customer Approves the Payment

Most fraud controls are built to answer one question: is this really the customer? Authorized push payment (APP) fraud defeats that question. The customer logs in from a known device, passes authentication, and approves the payment personally. The customer has been deceived about who is receiving the money.

This creates a detection problem for banks, credit unions, and payment firms. This article explains how APP fraud works, why standard controls miss it, and which signals help financial institutions intervene before funds leave.

Key Highlights

1. APP fraud involves a genuine customer who is manipulated into sending money to a fraudster, so credential-based controls pass the payment.
2. Common scenarios include impersonation of banks or government agencies, invoice redirection, and investment and romance scams.
3. Payment context and unusual session behavior help identify payments made under pressure.
4. Payee risk, including signs of a mule account, adds a second detection layer on the receiving side.
5. Targeted friction, such as specific warnings and short holds, interrupts scams with less disruption to legitimate payments.

How Authorized Push Payment Fraud Works

Authorized push payment fraud occurs when a fraudster persuades a customer to send funds to an account the fraudster controls. The fraudster uses social engineering to obtain the customer’s consent. Common scenarios include:

1. Impersonation scams. A caller poses as the customer’s bank, a government agency, or a utility and urges immediate action.
2. Invoice and payment redirection. A supplier’s bank details are altered before a legitimate invoice is paid.
3. Investment and romance scams. The fraudster builds trust over weeks before requesting funds.

Fraudsters typically create urgency or fear, such as claiming the customer’s account is under attack. That pressure explains why victims override warnings and why generic messaging performs poorly.

Payments usually move in real time or close to it, and recovery becomes difficult once the funds move onward.

Why Standard Controls Miss APP Fraud

Compare APP fraud with account takeover fraud. In a takeover, a criminal gains access to the customer’s account, which produces signals such as new devices, credential resets, and unfamiliar locations. In an APP scam, those signals are absent. Rules built around them see a normal session.

Attribute	Account takeover	APP fraud
Who initiates the payment	The fraudster	The customer
Login and device signals	Often anomalous	Usually normal
Primary detection focus	Session and credential anomalies	Payment context and behavior
Customer awareness	Unaware of the access	Believes the payment is legitimate

Amount thresholds catch some cases. Scammers often stay under those limits or coach victims to split a payment into smaller transfers.

Signals That Support APP Fraud Detection

Detection shifts from verifying identity to evaluating context. Useful signals fall into three groups:

1. Payment context. A first-time payee, an amount well above the customer’s history, a near-total balance transfer, or several payments in a short window.
2. Session behavior. Prolonged activity before a large payment, repeated edits to payment details, or hesitation at warning screens.
3. Payee risk. Signs that the receiving account is a mule account, such as recent opening, rapid pass-through of incoming funds, and prior scam reports.

These signals are individually weak, so institutions typically combine them into a risk score. Rules-based logic provides transparent thresholds, while machine learning can find combinations that rules miss. Teams should test both against confirmed scam cases on a regular schedule.

Feedback closes the loop. Confirmed scam reports from customers and from receiving institutions should flow back into the models and payee watchlists, so each case improves the next decision.

Intervening Without Adding Unnecessary Friction

Most legitimate payments should proceed untouched. For higher-risk payments, institutions have several options, ordered here from lightest to strongest:

1. A warning that names the specific scam scenario the payment resembles.
2. A confirmation-of-payee check, where the payment scheme supports one.
3. A short hold for manual review.
4. An outbound call to the customer for the highest-risk payments.

Measure results in two directions: scams stopped and legitimate payments delayed. Tracking only one skews tuning toward either missed fraud or frustrated customers.

Frontline staff training and customer education support these controls. Regulatory pressure is also growing. The United Kingdom introduced mandatory reimbursement for many APP fraud victims in October 2024, which raised the cost of missed detection for institutions there. Institutions elsewhere also carry customer trust and complaint costs when scams succeed.

Building APP Fraud Defenses Around Context

APP fraud succeeds because the customer, the device, and the credentials all look genuine. Defenses therefore depend on payment context, session behavior, and payee risk, combined into scoring that supports proportionate intervention. Institutions that apply these signals consistently can stop more scams while keeping legitimate payments moving.