TL;DR: APP fraud is increasing on real-time payment rails because authorised transfers settle instantly and are irreversible, while fraudsters exploit impersonation and social engineering to make payments look legitimate, according to Unit21. Effective detection depends on low-latency real-time monitoring, behavioural rules, and onboarding data that can spot anomalies before funds leave.
At a glance
What this is: Unit21 examines why authorised push payment fraud is growing on real-time payment rails and how behavioural monitoring rules help detect it.
Why it matters: It matters because IAM and fraud teams need controls that evaluate intent, context, and payee risk in real time, not after a customer-authorised transfer has already settled.
By the numbers:
- Real-time payments are predicted to reach 511.7B global transactions by 2027, up from 195.0B in 2022.
- The CAGR of APP scams value is 9% versus 41% for real-time transactions value from 2022 to 2027.
Context
Authorised push payment fraud exploits a governance gap rather than a technical flaw: the customer authorises the transfer, so the payment may look valid even when the recipient is fraudulent. Real-time payment rails compress the window for intervention, which is why traditional post-transaction monitoring is no longer enough.
The identity problem is not just who logged in, but whether the payee, device, timing, and transfer pattern fit the customer’s normal behaviour. For fraud teams, the control objective shifts from confirming authorisation to detecting deception before settlement.
Key questions
Q: How can security teams detect real-time payments fraud?
A: Security teams detect real-time payments fraud by looking for unusual payee changes, first-time recipients, abnormal transfer timing, and transactions that diverge from a customer’s normal behaviour. Use transaction monitoring, device and session risk signals, beneficiary verification, and step-up authentication for risky payments. The aim is to interrupt social engineering before the transfer is irrevocable.
Q: Why is real-time payment fraud harder to stop than card fraud?
A: Real-time payment fraud is harder to stop because settlement is immediate and usually irreversible. That removes the recovery window that many card workflows still have. Defenders have to make a risk decision before funds leave the account, using recipient verification, behaviour, and velocity rather than relying on later disputes or manual review.
Q: What are the warning signs that a payment may be part of APP fraud?
A: Common indicators include an unfamiliar payee, an unusual transfer amount, a sudden change in transaction frequency, a new device or IP address, and behaviour that diverges from the customer’s normal pattern. No single signal is decisive, but several together can justify a hold or manual review before funds are released.
Q: Should organisations prioritise latency or rule depth in fraud monitoring?
A: They need both, but latency comes first when settlement is immediate. A deep rule set is useless if the system cannot act before funds move. The practical test is whether the control can change the payment decision within the settlement window, not whether it produces a detailed alert after the fact.
Technical breakdown
Why authorised transfers are harder to stop than unauthorised fraud
APP fraud works because the fraudster does not need to break the payment rail. Instead, they manipulate the customer into initiating a transfer to a mule or fraudulent account, which means the transaction often satisfies normal authorisation checks. That makes the payment look legitimate at the point of execution, even when the decision to pay was induced by deception. In a real-time environment, the risk is not just fraud volume but the narrow intervention window between initiation and settlement. Monitoring therefore has to look beyond the payment message itself and into behavioural signals that indicate coercion, impersonation, or account compromise. See the Authorised Push Payment (APP) Fraud Guide.
Practical implication: Treat customer-authorised transfers as a fraud signal problem, not a simple approval problem.
How behavioural rules surface APP fraud in real time
Behavioural rules compare a transaction or action against the customer’s baseline. In APP fraud, that baseline matters more than usual because the payment may be technically valid yet contextually abnormal. Useful signals include unusual time of day, a new payee, rapid changes in value, unfamiliar IP addresses, and device or login patterns that do not match prior behaviour. The article also notes that teams should evaluate non-transactional attributes alongside payments, which is important because deception often begins before the transfer is attempted. Good monitoring systems can combine these features into rules that hold, block, or route events for review before funds are irreversibly moved. See the Payment Fraud Guide.
Practical implication: Combine payment, login, device, and payee signals in one decision path.
Why latency is a fraud-control issue, not just a systems metric
In APP fraud, speed is part of the attack. Real-time payment systems settle within seconds, so even a small delay in risk scoring or analyst review can eliminate the chance to intervene. The article’s emphasis on sub-150 millisecond action is really about preserving a usable decision window before final settlement. This is a governance issue as much as a technical one: if rules, alerts, or manual review paths cannot act fast enough, the organisation has effectively accepted that some fraudulent transfers will complete. The control problem is therefore not detection alone, but detection fast enough to change the payment outcome.
Practical implication: Measure fraud controls by decision latency as well as detection quality.
Threat narrative
Attacker objective: The attacker’s objective is to divert authorised funds into accounts they control before the victim or bank can stop settlement.
- Entry occurs through impersonation, phishing, or social engineering that convinces the victim to initiate a payment.
- Credential harvesting or trust abuse gives the fraudster enough credibility to mimic a legitimate person or institution and steer the transfer.
- Impact occurs when the authorised payment settles instantly and becomes difficult or impossible to reverse.
Breaches seen in the wild
- Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
APP fraud is fundamentally an identity governance problem at the payment layer. The fraudster does not need to defeat authentication if they can manipulate the user, impersonate a trusted party, and induce a legitimate transfer. That makes payee trust, behavioural context, and onboarding controls part of the identity boundary, not just fraud operations. Financial institutions should treat payment approval as a governed identity event, not a routine transaction.
Real-time payment systems compress the control window so tightly that old monitoring assumptions break. Traditional monitoring often assumes there is time to observe, investigate, and reverse. Real-time rails remove that cushion, which means latency becomes a security variable rather than an engineering detail. Fraud teams need policies that are tuned to the speed of settlement, not the speed of a batch review cycle.
Behavioural anomaly detection is only useful when it is anchored to customer context. A spike in value, a new device, or a transfer at an unusual hour may be routine for some customers and anomalous for others. The article correctly points to historical deviation models because APP fraud detection has to distinguish ordinary variation from induced trust failure. Practitioners should build controls around customer baselines, not generic red-flag lists.
APP fraud exposes the limits of authorisation as a security control. Authorisation proves that a user consented to a transfer, not that the transfer is safe. That distinction matters across fraud, IAM, and transaction governance because it shows where identity assurance ends and deception risk begins. Teams should strengthen the decision layer that sits between intent and execution, especially where payments are irreversible.
From our research library:
- Authorised push payment (APP) fraud is projected to cause global losses of US$331 billion by 2027.
What this signals
APP fraud pushes fraud governance into the identity boundary. The most effective controls now sit at the intersection of payee trust, customer behaviour, and payment execution. For practitioners, that means treating transfer approval as a contextual trust decision rather than a binary authentication event.
Real-time rails force teams to design for intervention before finality. Once settlement happens, reversal becomes exception handling rather than control design. The programme implication is straightforward: if a control cannot act inside the payment window, it is not a preventive control for this channel.
For practitioners
- Strengthen real-time decisioning for payment events Evaluate transactions and related action events in the same workflow so risk scoring can intervene before settlement completes.
- Build behavioural rules around customer baselines Detect unusual amount, timing, device, IP address, and payee combinations by comparing each event to historical customer patterns.
- Add fraud signals to customer onboarding Use onboarding data to improve expectations for normal behaviour, account ownership, and payee legitimacy before transfers begin. See the IAM and IGA Basics.
- Create hold-and-review thresholds for high-risk transfers Route suspicious events into manual review when the rule set detects patterns associated with impersonation, new beneficiaries, or rapid value changes.
Key takeaways
- APP fraud succeeds because a customer can authorise a payment to a fraudulent recipient, which makes the transfer look legitimate unless context is monitored.
- The article points to instant settlement and irreversible transfers as the conditions that reduce the fraud team’s response window.
- Effective defence depends on behavioural rules, onboarding data, and decision latency that is fast enough to intervene before funds move.
Related NHI Mgmt Group resources: Authorised Push Payment (APP) Fraud Guide · Payment Fraud Guide · Top 10 Online Fraud Attacks · IAM and IGA Basics
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Payment authorisation and context-aware approval are central to APP fraud control. |
| Recommendation — Use PR.AA-05 to tighten approval logic around high-risk payment entitlements and beneficiary changes. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account and beneficiary governance shape the trust boundary exploited in APP fraud. |
| Recommendation — Apply CIS-5 to manage payment accounts, privileged approvers, and beneficiary changes tightly. | ||
| MITRE ATT&CK | TA0001;TA0006 — Initial Access; Credential Access | The fraud chain begins with social engineering and trust abuse that enables payment redirection. |
| Recommendation — Map APP fraud patterns to Initial Access and Credential Access to improve fraud detection content. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Payment approval paths should restrict who can authorise high-risk transfers. |
| Recommendation — Use AC-6 to limit who can approve, modify, or override payment workflows. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Access control governance supports controlled approval of high-risk payment actions. |
| Recommendation — Apply A.5.15 to govern approval rights and reduce unauthorised payment changes. | ||
Key terms
- Authorised Push Payment Fraud: A payment scam in which the victim is persuaded to authorise the transfer themselves. The transfer is technically authorised, but the decision is corrupted by deception, which makes liability, evidence, and prevention harder to separate from standard transaction controls.
- Real-Time Monitoring: Real-time monitoring is continuous observation of systems and events as they happen, rather than delayed review through batch scans or periodic reports. In governance contexts, it reduces the window between exposure, detection, and response so risk can be contained before it spreads.
- Behavioural anomaly: A behavioural anomaly is a deviation from established identity activity, such as a new device, unexpected geography, or unusual access pattern. It does not prove compromise on its own, but it becomes high-value evidence when it appears alongside other suspicious authentication signals.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle discipline. It helps security and identity practitioners connect access control to broader programme governance.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org