Most fraud relies on getting around a bank's defences. Authorised push payment fraud does something stranger and far harder to stop: it persuades you to step over those defences yourself. You log in, you confirm the payment, you press send. By the time the truth surfaces, the money is already gone — and on paper, you authorised every penny of it.
That single feature is what makes authorised push payment fraud — usually shortened to APP fraud — so corrosive. There is no skimmed card, no hacked password, no stolen device. A criminal simply convinces you to move your own money into an account they control, using the same bank transfer you would make to pay a builder or a friend. The transaction is genuine; only the reason for it is a lie.
APP fraud has become, by most estimates, one of the largest categories of fraud loss in the United Kingdom. It cuts across every demographic and every level of financial sophistication, because it does not exploit a weakness in technology. It exploits trust, urgency, and the ordinary human instinct to do as we are told by someone who sounds official. Understanding its shape is the first step to refusing it.
What APP fraud really is
The defining feature is in the name. A "push" payment is one you initiate yourself — a bank transfer that pushes money out of your account, as opposed to a "pull" payment such as a card transaction a retailer requests. When that push is "authorised," it means you, the genuine account holder, instructed the bank to make it.
In an APP scam, a criminal manipulates you into making exactly that instruction. You believe you are paying a legitimate person or organisation — a tradesperson, a supplier, your own bank's "fraud team," a romantic partner, an investment firm. In reality, the account on the other end belongs to the fraudster or to a money mule working for them. The bank sees a customer authorising a payment they appear to want to make, so its automated fraud controls, designed to catch unauthorised activity, have nothing obvious to flag.
The danger of APP fraud is precisely its legitimacy. The system did not fail; it did exactly what you told it to. The deception happened entirely in the conversation that came before the click.
The main varieties
APP fraud is an umbrella over several distinct scams. They share a method — getting you to transfer money — but differ in their cover story. Recognising the categories helps you spot one mid-deception.
- Purchase scams. You pay in advance for goods or services — concert tickets, a puppy, a holiday let, a marketplace bargain — that never arrive. The seller vanishes once the transfer clears.
- Invoice and mandate fraud. A genuine-looking invoice arrives, often from a real supplier whose email has been compromised, with the bank details quietly changed. You pay the right amount to the wrong account.
- Impersonation and the "safe account" scam. Someone phones claiming to be from your bank, the police, or a fraud department, warns that your account is compromised, and urges you to move your money to a "safe account" they have set up. That account is theirs.
- Romance fraud. A relationship built online turns, sooner or later, into a request for money — for an emergency, a flight, a business deal — sent by transfer to someone you have never met.
- Investment fraud. A "guaranteed" opportunity in crypto, forex, or bonds invites you to deposit funds into a trading account that is, in fact, simply a criminal's bank account dressed up as a platform.
Why the money is so hard to recover
Once an APP payment leaves your account, recovery becomes a race against time — and it is a race the victim usually loses without help. The reasons are structural, not a matter of effort.
Modern bank transfers settle almost instantly. Within minutes of arriving in the fraudster's account, the funds are typically broken up and pushed onward through a chain of "mule" accounts, then withdrawn as cash or converted into cryptocurrency. By the time you realise what has happened, there is reportedly often nothing left in the receiving account to freeze. Because you authorised the original payment, your bank cannot simply reverse it as it would an unauthorised one; it must instead attempt a recall and rely on the receiving bank's cooperation, which may come too late.
Any one of these warrants a pause. Several together are a near-certain sign of an APP scam in progress:
- Pressure to move money to a "safe account" — something no bank or police force will ever ask you to do.
- An unexpected change of bank details on an invoice or payment request you were expecting.
- Manufactured urgency: you must act now, today, before your account is "drained" or the deal is lost.
- A request for secrecy — being told not to discuss the matter with bank staff, family, or anyone else.
- An unsolicited call, text, or email that already seems to know your details and uses them to build trust.
- Any instruction to lie to your bank about the true purpose of a payment.
- Payment demanded only by bank transfer, with no card option, receipt, or recourse.
Your rights under the new reimbursement rules
The legal landscape has shifted decisively in the victim's favour. The Payment Systems Regulator (PSR) has introduced a mandatory reimbursement scheme for APP fraud, fundamentally changing what banks owe their customers when a transfer is lost to a scam.
Under the scheme, where you have been the victim of an APP scam on a relevant payment, your bank is generally required to reimburse you, rather than treating the loss as your problem because you pressed send. Crucially, the cost of that reimbursement is split 50/50 between the sending and receiving banks — a deliberate design that gives the bank receiving fraudulent funds a financial stake in stopping mule accounts, not just the bank you transferred from. Reimbursement is subject to limits and to a consumer-standard-of-caution requirement, so it is not unconditional, but the default has moved firmly toward the customer.
Alongside this sits Confirmation of Payee, the name-checking service that warns you when the account name you have typed does not match the name on the account you are about to pay. It is one of the simplest and most effective frictions against invoice and impersonation fraud — provided you actually read the warning rather than clicking past it.
- Never move money to a "safe account." No genuine bank, police officer, or fraud team will ever ask you to do this. The request itself is the scam.
- Verify any change of details independently. If an invoice or message asks you to pay a new account, confirm it by calling a number you already trust — never the number on the suspicious message.
- Use Confirmation of Payee. Read the name-match result before you send. A "no match" or "close match" is a reason to stop, not to proceed.
- Slow down. Urgency is the fraudster's chief weapon. A real payment can wait while you check; a scam cannot survive the delay.
- Treat unsolicited contact with suspicion. Hang up and call the organisation back on its official number, from a different line where possible.
- APP fraud works because you authorise the payment yourself, so the bank's automated defences against unauthorised activity never trigger.
- Its main forms are purchase scams, invoice and mandate fraud, the "safe account" impersonation scam, romance fraud, and investment fraud.
- Recovery is hard because instant transfers are dispersed through mule accounts within minutes and authorised payments cannot simply be reversed.
- The PSR's mandatory reimbursement scheme now generally requires banks to refund victims, with the cost split 50/50 between the sending and receiving banks.
- No bank or police force will ever ask you to move money to a "safe account" — verify every payment change on a trusted number, use Confirmation of Payee, and slow down.
How Crejj & Partners can help
Our Financial Recovery & Civil Claims team acts for individuals and businesses who have lost money to authorised push payment fraud. We move quickly to preserve evidence, press your bank to attempt a recall and to honour its reimbursement obligations under the PSR scheme, and escalate to the Financial Ombudsman Service where a claim is wrongly refused. Where funds can be traced, we pursue freezing injunctions and civil claims against those who can be identified, and coordinate with banks and payment providers to interrupt the onward flow. If you are worried about a transfer you are about to make, or one you have already made, the time to speak to us is now.
This article is provided for general information only and does not constitute legal advice or create a solicitor–client relationship. Fraud situations are fact-specific and time-sensitive; if you believe you have been targeted, seek tailored advice promptly. Crejj & Partners is a fictional firm presented for illustrative purposes on this website.