Rise of authorized push payment (APP) fraud — what controls are working?

APP fraud has exploded in our customer base over the past 12 months. Social engineering attacks are becoming incredibly sophisticated — deepfake voice calls, AI-generated phishing emails, and impersonation of trusted authorities.

Our current controls (confirmation of payee, payment delay for first-time recipients) aren't enough. The fraud is happening with the customer's active participation, which makes traditional detection difficult.

What additional controls or detection methods are you finding effective against APP fraud?

The UK's Contingent Reimbursement Model (CRM) Code and the upcoming PSR mandatory reimbursement requirement are also driving innovation here. When banks have to reimburse victims, the financial incentive to invest in prevention becomes much stronger.

We've also started using payment velocity checks specifically for new payees — limiting the total amount a customer can send to a never-before-used account within the first 24 hours. Customers complain occasionally, but fraud losses from that vector dropped significantly.

APP fraud is particularly challenging because the customer initiates the payment willingly — they've been socially engineered into believing the payment is legitimate. Traditional fraud controls that look for unauthorized access miss it entirely.

Controls that are actually making a difference:

Confirmation of payee — Checking whether the account name provided by the customer matches the actual account holder at the receiving bank. The UK mandated this and it's significantly reduced impersonation-type APP fraud. If you're in a jurisdiction without a mandate, consider implementing it voluntarily for high-risk payment types.

Contextual warnings at point of payment — Generic fraud warnings don't work. Specific, scenario-based warnings do. "You appear to be making a payment to a new payee shortly after receiving a phone call" is more effective than "beware of scams." Some banks are using dynamic interventions that trigger based on behavioral signals.

Cooling-off periods for large first-time payments — Introducing a delay (even 30 minutes) for payments above a threshold to new payees gives victims time to realize they've been scammed. Most APP fraud relies on urgency — disrupting that urgency is highly effective.

Inbound payment analysis — If you're a receiving bank, monitor for accounts receiving multiple payments from different sources in a short period. Mule accounts used to receive APP fraud proceeds show distinct patterns: rapid inflows from diverse sources followed by immediate withdrawals.

The liability question is still evolving globally. The UK's reimbursement mandate has shifted incentives significantly. Whether other jurisdictions follow remains to be seen, but the direction is clearly toward greater bank responsibility.