Question Fraud
What is APP fraud?
Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer really did authorize the payment, strong authentication alone does not stop it.
What is APP fraud? Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer really did authorize the payment, strong authentication alone does not stop it. Source: https://glide-cleartext.pages.dev/q/what-is-app-fraud/ (Cleartext, verified 2026-09-12)
Why authentication doesn’t help #
In an APP scam the customer authorizes the payment themselves. Strong authentication confirms it really was the customer, which is exactly what the scammer wants. Passkeys and other phishing-resistant methods stop account takeover; they don’t stop a customer who has been persuaded to pay.
What does help #
- Context at the point of payment: a new payee, an unusual amount, or a customer who is on the phone with someone claiming to be their bank.
- Friction that fits the risk: confirmation-of-payee warnings, holds and call-backs on suspicious first payments.
- Receiving-side detection: spotting and freezing mule accounts that collect scam proceeds.
In the UK, sending and receiving firms now share the cost of reimbursing most victims, which strengthens the case for all three.[1] Details: who pays when a UK customer falls for an APP scam.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Authentication confirms it was the customer, which is exactly the problem in an APP scam. The controls that work look at the payment’s context: a new payee, an unusual amount, a customer on the phone.
Fintechs & payment firms
In the UK, receiving firms share the reimbursement cost, so detecting mule accounts you host is now a direct financial incentive.
Developers & identity teams
Expose the signals fraud teams need at payment time: payee age, first-payment flags, amount relative to history and whether a call is in progress on the device, where the platform allows it.
Follow-up questions #
- How is APP fraud different from account takeover?
- In account takeover a criminal controls the account and makes the payment. In APP fraud the real customer makes it, under false pretenses.
People also ask #
Who pays when a UK customer falls for an APP scam?
Since October 7, 2024, UK payment firms must reimburse most eligible victims of authorized push payment scams made over Faster Payments, up to £85,000 per claim. The cost is split between the firm that sent the payment and the firm that received it.
Full answerWhat is an OTP bot?
An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
Full answerHow do banks stop OTP bots?
Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.
Full answerCite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “What is APP fraud?” Last verified 2026-09-12 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-app-fraud/
Markdown link
[What is APP fraud?](https://glide-cleartext.pages.dev/q/what-is-app-fraud/) (Cleartext, verified 2026-09-12)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |