Authorized Push Payment Fraud Prevention Guide

Last updated: October 2026

Authorized push payment fraud prevention starts from an uncomfortable fact: the real customer, on their own device and with their own credentials, sends the money. Authentication cannot stop a payment the account holder really is making. What can is a combination of transaction context, signs of coercion in the session, new-payee and receiving-account risk, and an intervention built for the seconds a real-time payment allows. The realistic goal is timely intervention, not a guarantee, and in the US the loss generally stays with the customer.

TL;DR

• In authorized push payment (APP) fraud, a scammer manipulates the customer into sending the payment themselves. The payment is authorized, but deception induced it.

• Passwords, one-time passcodes and step-up checks do not stop it, because the coached customer completes every step.

• Detection combines signals: a new payee, a first use of a rail, an amount or pace unusual for this customer, signs of remote access or coaching in the session, and risk on the receiving account.

• Intervention has to land before the funds leave: specific warnings, in-flow questions that adapt to the answers, holds and outbound calls. Some customers will still insist on sending.

• In the US, Regulation E's definition of an unauthorized transfer requires someone other than the consumer to initiate it, and no CFPB rule covers scam-induced payments. The UK has required reimbursement since October 2024.

What is authorized push payment fraud?

Authorized push payment (APP) fraud is a scam in which a criminal manipulates a customer into sending money from their own account to an account the criminal controls. The customer initiates and approves the payment, so it is authorized, but deception induced the decision. That separates APP fraud from account takeover, where someone other than the account holder initiates the payment.

The Federal Reserve's ScamClassifier, whose scam definition was published in 2023, defines a scam as "the use of deception or manipulation intended to achieve financial gain." The working distinction for a fraud team is who pressed send. In an account takeover the criminal acts alone with stolen access, which calls for different controls, covered under account takeover prevention. In an APP scam the criminal works through the victim.

Common forms of APP fraud

• Impersonation. The caller claims to be the bank's fraud team, a government agency or the police, and tells the customer to move their savings to a safe account. Fraud teams describe customers who empty their accounts believing they are helping law enforcement keep the money secure.

• Investment scams. The victim is shown fake returns and keeps sending more. FinCEN's current alerts call one form of these a digital asset investment scam.

• Romance scams. A relationship is built over weeks or months before the first request for money.

• Invoice and payroll redirection. Business email compromise changes where a regular payment goes, often without changing the amount, so a rule that watches amounts does not fire.

• Tech-support scams. The victim is told to install remote-access software, and the scammer then moves the money or talks the victim through the transfer.

Why authentication does not stop it

Authentication answers one question: is this the real customer? In APP fraud the answer is yes. A head of operational and fraud risk at a digital bank described scams as the hardest case for exactly that reason: the client does everything on their own, sends the money to the fraudster and loses it.

Step-up authentication fails for the same reason. A fraud analytics and operations director at a digital bank said that in many of the cases they see, "the step ups are also obviously like the customer itself because they're being coached over the phone most of the time," especially with older victims. The scammer stays on the phone and guides each step.

Onboarding checks do not catch it either. A fraud operations manager at a digital wealth manager described customers who give off normal signals when they open the account, and only later start working with someone else or hand over account access.

A single transfer often looks ordinary. An AML officer at a wealth management firm said the best way to detect a scam is "probably the second or third transaction," because one first-party payment "isn't unusual in and of itself." Detection therefore moves from identity to context: is this payment, to this payee, at this moment, consistent with how this customer behaves, and does anything in the session suggest someone else is directing it?

How big the problem is

Consumers reported $15.9 billion in fraud losses to the Federal Trade Commission in 2025, up from $12.5 billion in 2024. Investment scams made up about $7.9 billion of the 2025 total, and bank transfers and payments were again the payment method with the highest reported losses. The FBI's Internet Crime Complaint Center (IC3) recorded $8.65 billion in reported investment fraud losses for 2025, one of its two largest categories alongside business email compromise.

Both loss figures count what victims reported, not everything that was lost.

FinCEN's September 2026 alert on scam centers asks institutions to use the key term FIN-2026-SCAMCENTERS in suspicious activity reports, and it uses the term digital asset investment scam rather than pig butchering. FinCEN's 2023 alert on those scams and its 2022 advisory on elder financial exploitation remain in force.

Signals that separate coercion from normal behavior

No single signal identifies a scam. Customers add new payees and send large payments every day for good reasons. The signal is the combination, read against this customer's own history.

A payment that scores on two or three rows deserves an intervention. A payment that scores on one rarely does.

Remote access and coaching in the session

Remote access turns the customer's own session into the scammer's. A senior fraud analyst at a broker-dealer described a customer who had given a scammer remote access: money moved out over several months, first to her existing accounts at other banks, and then the fraudster added their own bank account. The customer reported it only after the account had been emptied.

Some institutions add friction to any payment made while the customer is on an active phone call, because coached victims are often on the phone with the scammer while they pay. How device and behavioral signals are collected, and how to govern them, is covered in our guide to device intelligence and behavioral biometrics.

Weight session signals with care. Hesitation, slow typing or unfamiliar navigation also describe many older or less confident customers who are doing nothing wrong. Combine them with payee and payment context before adding friction, and measure how often each rule stops a legitimate customer.

The receiving side

The receiving institution sees the other half of the scam. A BSA/AML compliance manager at a credit union described the pattern on instant payments: funds arrive, the account is accessed online from outside the member's normal digital footprint, and the money moves straight back out. Two devices working the same account at the same time can point to a mule or an account that has been handed over. For what to require from a platform here, see our guide to detecting mule accounts.

Intervening in the seconds before the money leaves

Detection only helps if it lands before the payment settles. On an instant payment that can mean seconds; on ACH it can mean the next batch window. A chief compliance and risk officer at a community bank said the alert does not have to be instant, as long as it arrives before the transaction leaves the organization, so that staff "can call the client and say, hey, do you really want to send this money?"

The decision engine has to fit inside that window. Oscilar's platform is specified to return decisions in under 100 milliseconds, so a check can run before the payment is released rather than after it. Rails run on different clocks, with wires and online banking closer to real time and ACH in batches, which shapes what a platform has to do; see real-time fraud prevention platform requirements.

Intervention options, from lightest to strongest

1. Specific warning. Name the scam the signals suggest, such as a caller claiming to be the bank's fraud team, and say plainly that the bank never asks customers to move money to protect it.

2. In-flow questions. A scams and elder fraud program lead at a bank described sending the customer a request for information at the moment the payment is initiated, with question logic that changes based on the answers. The answers give the analyst context and give the customer a moment to reconsider.

3. Hold or cooling-off period. Delay release for review, or cap the first payment to a new payee until it is confirmed.

4. Outbound call. A trained person calls the customer to ask about the payee and how they came to be paying them.

5. Decline and report. Where the evidence is strong, decline the payment, escalate to a specialist team and file a suspicious activity report where warranted.

Even a good intervention does not always work. The digital bank director quoted earlier said that when staff ask about the recipient, customers often say they know and trust the person, and some still go through with the payment. At one credit union, a fraud and compliance manager said staff "basically fight with our members to get them to realize we can't continue to do this because they're giving money to criminals and they don't want to believe it."

Pitfalls in intervention design

• Generic warnings. A message that appears on every payment gets clicked through. Tie the wording to the scam the signals point to.

• Friction on every new payee. Customers learn to ignore it, and the one warning that matters is lost in the rest.

• Scoring the payment but not the session. The payment can look normal while the session shows coaching.

• Uneven controls across rails. If one rail has much less friction than the others, scammers steer victims to it.

• No record of what was done. Without a log of the warning, the questions and the call, the institution cannot show what it did.

Who bears the loss

In the US, the loss from an APP scam generally stays with the customer. Regulation E defines an unauthorized electronic fund transfer as one "initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit." In an APP scam the consumer initiates the transfer. No CFPB rule addresses scam-induced payments, and a CFPB lawsuit filed in December 2024 against the operator of a payment network and three banks was dismissed in March 2025 without a ruling on whether Regulation E covers them.

ACH has its own, narrower definition. Since 1 October 2024 Nacha's rules have defined False Pretenses as "the inducement of a payment by a Person misrepresenting (a) that Person's identity, (b) that Person's association with or authority to act on behalf of another Person, or (c) the ownership of an account to be credited." That text describes impersonation, business email compromise and vendor or payroll redirection, not investment or romance scams. What ACH participants must now monitor for under Nacha's rules is covered in our readiness guide to the 2026 NACHA fraud rules.

The UK took a different route. Mandatory reimbursement for APP scam victims has applied there since 7 October 2024, capped at £85,000 per claim, and the US has no equivalent requirement.

US institutions act anyway. A fraud and compliance manager at the same credit union said that acting does not mean paying out every loss a member incurs, but "we have to show that we've done our due diligence, that we've made our efforts," in part so that a family member cannot later say the bank had the information and did nothing. The digital bank director quoted earlier said reputational risk means they do reimburse in some cases. Regulators now frame scams as payments fraud too: in June 2025 the Federal Reserve, FDIC and OCC issued a request for information on payments fraud that defined it to include scams across check, ACH, wire and instant payments.

Frequently asked questions

With APP scams the customer authorizes the payment. How can any system stop it?

A system cannot stop every APP scam, but it can interrupt many before the money leaves. It looks past who is paying to the circumstances: a new payee, an unusual amount or rail, signs of remote access or coaching in the session, and risk on the receiving account. When several of those line up, the institution pauses the payment and talks to the customer.

Is APP fraud covered by Regulation E?

Regulation E's protections for unauthorized transfers are written for transfers initiated by someone other than the consumer, and in an APP scam the consumer initiates the payment. No CFPB rule covers scam-induced payments, and the 2025 dismissal of a CFPB lawsuit left the question without a court ruling. How the rule applies to a specific case is a question for counsel.

What can the receiving institution do about mule accounts?

The receiving institution can watch for funds that arrive and leave almost at once, especially on instant payments, and for access from devices or locations that do not fit the account's history. A new or dormant account that suddenly receives large credits deserves a closer look. Institutions can also share information about suspect accounts with each other under FinCEN's 314(b) program.

Should a bank refuse a payment the customer insists on sending?

Sometimes, though rarely as the first step. A typical sequence is to warn, ask questions, hold the payment or call the customer, and record each step. Where the evidence of a scam is strong and the customer still insists, a longer hold, a decline or escalation to a specialist team can be justified, and a suspicious activity report may be warranted. The right policy depends on the account agreement and counsel's advice.

Where Oscilar fits

Oscilar is a unified platform: real-time data fabric, device and behavior intelligence, rules, and case management in one stack, with agents native to it. For APP fraud, that lets a fraud team combine payment and payee context with device and behavior intelligence in its rules, and work the resulting cases in the same place.

To see how this applies to scams, read about Oscilar's scam prevention.