# What is APP fraud?

> **Short answer:** Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer really did authorize the payment, strong authentication alone does not stop it.

- URL: https://glide-cleartext.pages.dev/q/what-is-app-fraud/
- Last verified: 2026-09-12 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## Why authentication doesn’t help

In an APP scam the customer authorizes the payment themselves. Strong authentication confirms it really was the customer, which is exactly what the scammer wants. Passkeys and other phishing-resistant methods stop account takeover; they don’t stop a customer who has been persuaded to pay.

## What does help

- **Context at the point of payment:** a new payee, an unusual amount, or a customer who is on the phone with someone claiming to be their bank.
- **Friction that fits the risk:** confirmation-of-payee warnings, holds and call-backs on suspicious first payments.
- **Receiving-side detection:** spotting and freezing mule accounts that collect scam proceeds.

In the UK, sending and receiving firms now share the cost of reimbursing most victims, which strengthens the case for all three.[^1] Details: [who pays when a UK customer falls for an APP scam](https://glide-cleartext.pages.dev/q/who-pays-when-a-uk-customer-falls-for-an-app-scam/).

## What this means for you

### Banks & credit unions

Authentication confirms it was the customer, which is exactly the problem in an APP scam. The controls that work look at the payment’s context: a new payee, an unusual amount, a customer on the phone.

### Fintechs & payment firms

In the UK, receiving firms share the reimbursement cost, so detecting mule accounts you host is now a direct financial incentive.

### Developers & identity teams

Expose the signals fraud teams need at payment time: payee age, first-payment flags, amount relative to history and whether a call is in progress on the device, where the platform allows it.

## Follow-up questions

**How is APP fraud different from account takeover?**

In account takeover a criminal controls the account and makes the payment. In APP fraud the real customer makes it, under false pretenses.


## Sources

[^1]: PS25/5: APP scams reimbursement consolidated policy statement. Payment Systems Regulator, 2025-05. https://www.psr.org.uk/media/rhelv4op/ps25-5-app-scams-reimbursement-consolidated-policy-statement-may-2025.pdf
[^2]: PS24/7: Faster Payments APP scams reimbursement requirement: confirming the maximum level of reimbursement. Payment Systems Regulator. https://www.psr.org.uk/publications/policy-statements/ps247-faster-payments-app-scams-reimbursement-requirement-confirming-the-maximum-level-of-reimbursement/

## Related questions

- [Who pays when a UK customer falls for an APP scam?](https://glide-cleartext.pages.dev/q/who-pays-when-a-uk-customer-falls-for-an-app-scam/)
- [What is an OTP bot?](https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/)
- [How do banks stop OTP bots?](https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/)

## Cite

Cleartext. “What is APP fraud?” Last verified 2026-09-12 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-app-fraud/

## Changelog

- 2026-09-12: First published.