Topic starter
12/07/2026 12:23 pm
TL;DR: APP fraud in the UK reached £583 million in losses last year, with fraud up 39% year on year and scams accounting for more than half of all UK scams in 2021, according to Prove Identity. The control gap is not payment mechanics alone but the trust, timing, and verification assumptions built into push-payment journeys.
Editorial analysis by NHI Mgmt Group, based on content published by Prove Identity: “What is APP Fraud and How Can UK Companies Combat It?”.
Key questions
Q: What breaks when authorised push payments rely on user approval alone?
A: User approval becomes a weak control when fraudsters can manipulate the person making the decision.
Q: Why do APP scams bypass traditional payment controls so easily?
A: They bypass traditional controls because the attacker does not need to defeat the payment rail if they can defeat the user.
Q: What are the signs that payment verification is failing against APP fraud?
A: Common signs include repeated high-risk payments going through without step-up checks, warning messages being ignored, and fraud cases that originate from impersonation or urgency rather than compromised credentials.
Practitioner guidance
- Strengthen risk-based payment friction Apply additional verification only to high-risk transfers, high-value transactions and first-time beneficiary payments so warning fatigue does not neutralise the control.
- Replace universal OTP dependence Use stronger proof-of-possession and channel-binding methods where possible so a captured or shared code is less useful in a socially engineered transfer.
- Embed fraud signals into payment decisions Combine device, behavioural and account-history signals before authorisation so suspicious context can block or step up a payment before funds leave the account.
Bottom line: APP fraud is enabled by trust manipulation at the point of authorisation, which means the weak point is often the decision to send money rather than the mechanics of the payment rail.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:36 pm
APP fraud is fundamentally a trust-governance failure, not a payments-only problem. The article shows that the fraudster’s real control point is the victim’s belief state, not the transfer rail itself. That means financial institutions have to govern trust formation across channels, devices and payment moments, not just inspect transactions after initiation. Practitioners should treat payment-time trust as a first-class security boundary.
A few things that frame the scale:
- Authorised push payment (APP) fraud is projected to cause global losses of US$331 billion by 2027.
A question worth separating out:
A: Yes, if the goal is to reduce losses rather than simply inform users. Awareness campaigns help, but APP fraud persists because attackers exploit pressure and trust in the moment of authorisation. Transaction-time verification gives the organisation an enforceable control at the point where fraud becomes irreversible.
👉 Read our full editorial: APP fraud is a trust exploitation problem, not a payment problem