What Authorised Push Payment Fraud Is

Authorised push payment (APP) fraud is when a scammer tricks you into sending money to an account they control, and you authorise the payment yourself—meaning the bank processes it as legitimate because you typed in the details and hit send. The scammer impersonates someone you trust: your bank, your employer, a solicitor handling a house purchase, a utility company, or someone else with reason to ask for money. You believe you are paying the real person or organisation, so your bank has no reason to stop the transaction.

The difference between APP fraud and other payment scams is that you are not hacked, your account is not compromised, and no one steals your password. Instead, you are socially engineered into moving your own money to the wrong place. Once the money lands in the scammer's account, it is extremely difficult to recover because the payment was authorised by you.

Key Takeaways

  • APP fraud happens when you authorise a payment to an account you think belongs to a trusted person or organisation, but it actually belongs to a scammer.
  • Scammers typically contact you by email, phone, or text claiming to be your bank, a solicitor, your employer, or a utility company, and create urgency or fear to rush your decision.
  • Banks can sometimes recover APP fraud if you report it within a few hours, but the window closes quickly as scammers move money out of the receiving account.
  • The strongest defence is to stop and verify independently: call the organisation on a number you find yourself, never use contact details from the message that prompted the payment.
  • If you send money to a scammer, contact your bank immediately and report the fraud to Action Fraud; waiting reduces the chance of recovery.

How the Scam Unfolds

The scammer contacts you out of the blue, usually by email, phone call, or text message. They may claim your bank account has suspicious activity and you need to transfer money to a "safe account" immediately. Or they say they are a solicitor handling your house purchase and need the deposit wired today. Or they pose as your employer's payroll department asking you to update your bank details for a bonus payment. The message creates pressure: act now, do not delay, do not tell anyone.

You are then directed to make a payment—often a large one—to a bank account the scammer has set up or compromised. Because the message came from what looks like an official source (a spoofed email address, a caller ID that matches your bank), you believe the request is real. You log into your own banking app or online account, enter the account details you were given, and authorise the transfer. From your bank's perspective, the transaction is legitimate: you initiated it, you authorised it, and you used your own credentials.

By the time you realise something is wrong—the "safe account" was never mentioned again, the solicitor does not recognise the payment, or your employer says they never asked for it—the scammer has already moved the money out of the receiving account into other accounts or withdrawn it as cash. Your bank then faces a difficult situation: you authorised the payment, so technically you are liable, even though you were deceived.

Common Scenarios and Red Flags

APP fraud takes many forms depending on what the scammer is impersonating. In banking fraud, you receive a call or email claiming to be from your bank's fraud team. They say suspicious transactions have been detected and ask you to move money to a "secure account" for protection. A real bank will never ask you to transfer money out of your account; they will freeze it or issue a new card. If someone claiming to be your bank asks you to move money, it is a scam.

In property purchase fraud, a scammer intercepts emails between you and your solicitor, or spoofs the solicitor's email address entirely. They send you an invoice for the deposit or completion funds with slightly altered bank details—one digit changed, a similar-looking account number. You trust the solicitor, the email looks official, and the amount matches what you expect to pay. You send tens of thousands of pounds to the wrong account. By the time your solicitor asks where the money is, it has vanished.

In CEO fraud (also called business email compromise), a scammer spoofs your company's email system or hacks an employee account and sends you a message purporting to be from the CEO or finance director. They ask you to process an urgent payment to a supplier, a tax authority, or a new vendor. The email uses company language and formatting. You process the payment without questioning it because it came from someone senior. The money goes to a scammer's account.

Red flags include: pressure to act immediately, requests to keep the transaction secret, contact from an unexpected source asking for money, slight inconsistencies in email addresses or phone numbers, requests to use unusual payment methods (bank transfer rather than card), and instructions to ignore security warnings your bank might show you.

Why Banks Struggle to Stop APP Fraud

Banks can theoretically intervene at the moment you authorise the payment, but in practice this is difficult. When you log into your banking app and enter the recipient's details, the bank sees only the account number and sort code (or IBAN for international transfers). The bank does not know whether that account actually belongs to the person you think you are paying. Modern banking systems do include Confirmation of Payee (CoP), a service that checks whether the account holder's name matches the name you entered, but CoP only works for UK accounts and only if both banks participate.

Even with CoP, the system can only warn you if there is a mismatch—it cannot stop you from sending money to an account that exists and is in a real person's name, even if that person is a scammer. If the scammer has opened the account under a false identity or a name similar to the real organisation, CoP may not catch it.

Once the money leaves your account and lands in the receiving account, the scammer moves it again within hours—to another account, a cryptocurrency exchange, or withdrawn as cash. By the time your bank realises the receiving account is involved in fraud, the money is gone. Tracing it across multiple accounts and institutions is slow and often unsuccessful.

What to Do If You Spot the Scam Before Sending Money

If you receive a message asking you to make a payment and something feels off, stop. Do not use any contact details from the message. Instead, find the organisation's official phone number or website yourself and call them directly. Ask whether they sent the message and whether the payment request is real. A legitimate organisation will confirm or deny the request immediately.

If you are unsure, wait. Real urgent payments are rare. Your bank will not ask you to move money to a safe account. Your solicitor will send payment instructions through a secure channel you have already established, not a new email address. Your employer will not ask you to update bank details via email. If the request does not fit the pattern of how that organisation normally contacts you, it is probably a scam.

If you are certain it is a scam, do not reply to the message and do not click any links. Report it to Action Fraud (the UK's national fraud reporting centre) at actionfraud.police.uk or by calling 0300 123 2040. If the message impersonated your bank, also report it to your bank directly through their official app or website.

What to Do If You Have Already Sent Money

Contact your bank immediately—within the first few hours if possible. Tell them you have been the victim of APP fraud and that you authorised the payment under false pretences. Your bank can place a recall on the payment if it has not yet been processed, or they can contact the receiving bank and ask them to freeze the account and recover the funds. The faster you report it, the better the chance of recovery.

Be prepared to provide: the date and time you made the payment, the amount, the account details you sent it to, and a description of how you were deceived (the email, phone call, or message you received). Your bank will file a report and may contact the receiving bank's fraud team. If the receiving account is held by a scammer, the receiving bank may be able to freeze it and return the money, but this depends on how quickly they act and whether the money has already been moved.

After reporting to your bank, also report the fraud to Action Fraud. This creates an official record and helps law enforcement track patterns of APP fraud. You should also report the scam to the organisation that was impersonated (your bank, your solicitor, your employer) so they can warn other customers and investigate whether their systems were compromised.

Recovery and Your Bank's Liability

Whether you can recover APP fraud money depends on your bank's policies and the circumstances. Under the Payment Services Regulations 2017, banks are not automatically liable for APP fraud because you authorised the payment. However, many banks now offer some level of protection if you can show you took reasonable care and were the victim of a sophisticated scam.

Some banks have signed up to the Contingent Reimbursement Model (CRM) Code, a voluntary scheme that commits them to reimburse APP fraud victims in certain situations—for example, if the bank failed to warn you about the risk, or if the receiving bank failed to check the account holder's identity properly. The CRM Code does not may provide reimbursement, but it shifts some liability back to the banks.

If your bank is not part of the CRM Code, or if they refuse to reimburse you, you can complain to the Financial Ombudsman Service. The Ombudsman can order your bank to pay compensation if it failed in its duty of care. However, this process takes time and is not may provide to succeed. The best outcome is always prevention: spotting the scam before you send the money.

Frequently Asked Questions

Can my bank stop an APP fraud payment before it goes through?

Your bank can place a recall on the payment if you report it within a few hours and before the receiving bank has processed it. However, once the money is in the receiving account and the receiving bank has released it, recovery becomes much harder. This is why reporting immediately is critical.

What is the difference between APP fraud and card fraud?

Card fraud happens when someone uses your card details without your permission—your card is stolen, cloned, or your details are used online. APP fraud is when you authorise the payment yourself because you have been tricked about where the money is going. Card fraud is easier to dispute because you did not authorise it; APP fraud is harder because you did.

Will my bank reimburse me if I fall for APP fraud?

It depends on your bank and the circumstances. Banks signed up to the Contingent Reimbursement Model Code may reimburse you if you took reasonable care and the bank failed in its duty to warn you or protect you. Other banks may not. If your bank refuses, you can complain to the Financial Ombudsman Service, but reimbursement is not may provide.

How can I check if an email really came from my bank?

Do not use any contact details in the email. Instead, log into your bank's official app or website (by typing the address yourself, not clicking a link) and check your messages there, or call your bank on the number on the back of your card. A real bank will never ask you to move money to a safe account or provide sensitive information via email.

What should I do if I think I recognise the scammer's account number?

Report it to your bank and to Action Fraud immediately. Do not try to contact the account holder yourself or investigate further. Let the bank and law enforcement handle it. If the account is being used for fraud, the bank can freeze it and work with police to trace the scammer.