APP fraud and reimbursement rules: what banks need to change

TL;DR: APP fraud let criminals steer victims into authorised transfers that bypass traditional fraud controls, and Feedzai cites $442 billion in worldwide consumer losses in 2025 alongside tighter reimbursement rules in multiple markets. The control problem is no longer just transaction screening; it is detecting manipulation, intent shifts, and mule-network exit paths before funds leave the regulated system.

Editorial analysis by NHI Mgmt Group, based on content published by Feedzai: “What Is APP Fraud? A Simple Guide to Authorized Push Payment Scams”.

By the numbers:

• Consumers worldwide lost a staggering $442 billion to APP fraud and scams in 2025, according to the Global Anti-Scam Alliance.
• The UK Payment Systems Regulator requires reimbursement for most APP victims who lost money over Faster Payments, with losses split 50-50 between sending and receiving organizations.
• More than half of consumers surveyed by GASA, 54%, experienced a shopping scam in 2024.

Key questions

Q: What breaks when banks rely on unauthorized-fraud controls for APP scams?

A: Those controls assume the payment was initiated by an attacker or by stolen payment credentials.

Q: Why do real-time payments increase APP fraud risk?

A: Real-time payments compress the window between authorisation and settlement, which gives defenders less time to detect manipulation or reverse the transfer.

Q: What are the signs that APP fraud controls are failing in real payment flows?

A: Common warning signs include unusual payment urgency, new or altered payee details, repeated pressure to bypass normal checks, and transaction patterns that differ from the customer’s normal behaviour.

Practitioner guidance

• Implement pre-transfer decisioning for outbound payments Score the transaction before the funds leave the account, using customer behaviour, recipient context, and scam indicators rather than waiting for post-payment review.
• Build inbound monitoring for mule activity Track receiving-account patterns, onboarding anomalies, and incoming fund behaviour so you can spot mule accounts that serve as exit ramps for scam proceeds.
• Add behavioural and device intelligence to fraud triage Use typing cadence, mouse movement, touchscreen pressure, and device signals to detect when a customer’s actions diverge sharply from their normal profile.

Bottom line: APP fraud succeeds because the customer authorises the payment, which means the bank must govern intent and manipulation rather than only unauthorised access.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →