Notifications
Clear all
Topic starter
11/07/2026 8:42 pm
TL;DR: APP fraud is now a top threat to financial institutions because victims willingly authorise transfers through clean-looking accounts, leaving traditional sender-focused checks blind to recipient risk, according to Chainalysis. The control gap is not better fraud suspicion after the fact, but earlier visibility into who receives the money and whether the destination is already part of a scam network.
NHIMG editorial — based on content published by Chainalysis: Think you can outsmart the Grinch? APP fraud and recipient risk in the holiday season
By the numbers:
- Around $442 billion was lost to scammers this year.
- 67% believe their financial institutions should reimburse them for money lost in a scam even when they personally authorized the transaction.
- Over $10 billion worth of crypto was lost in 2024 due to reimbursements, operational costs, and more.
Questions worth separating out
Q: What breaks when fraud controls only assess the sender in APP scams?
A: Sender-only controls miss the core abuse pattern in APP fraud, which is that the victim authorizes a transfer to a recipient that may look legitimate but is actually risky.
Q: Why do clean-looking recipient accounts make APP fraud so hard to stop?
A: Clean-looking recipient accounts are effective because they borrow trust from normal onboarding signals and verified identity checks.
Q: How can financial institutions reduce losses from authorized push payment fraud?
A: They should add destination-side risk scoring, pre-transfer review for high-risk payments, and live account-network intelligence that updates as scam infrastructure changes.
Practitioner guidance
- Build recipient-risk scoring into payment decisioning Add destination-side signals such as prior scam exposure, mule-account indicators, velocity anomalies, and network relationships before a transfer is released.
- Separate identity assurance from transaction trust Do not treat successful onboarding, strong authentication, or behavioural biometrics as proof that the recipient account is safe for payment.
- Create a pre-transfer fraud containment path Route high-risk transfers into review, confirmation, or step-up validation before funds leave the sender account, especially in RTP flows.
What's in the full article
Chainalysis's full article covers the operational detail this post intentionally leaves for the source:
- The interactive customer journey that shows how APP fraud pressure changes payment decisions in practice.
- The scam and reimbursement framing behind holiday-season fraud losses across banks, RTP networks, and crypto platforms.
- The article's discussion of why recipient-risk blind spots persist in current fraud toolsets.
- Chainalysis's own explanation of the consumer reimbursement expectation that shapes dispute handling.
👉 Read Chainalysis's analysis of APP fraud, recipient risk, and holiday scam losses →
APP fraud and recipient risk: what financial controls miss?
Explore further
11/07/2026 9:12 pm
Recipient risk is the missing control plane in APP fraud. Most fraud stacks are built to answer whether the sender is suspicious, but APP fraud succeeds when the recipient is the compromised or fraudulent party. That leaves a governance gap between authentication and transaction trust. Fraud teams should treat destination risk as a first-class control objective, not a post-loss investigation input.
A question worth separating out:
Q: Who is accountable when a customer is tricked into authorising a fraudulent payment?
A: Accountability is shared across fraud operations, digital banking, and control owners, because the failure is usually one of detection design rather than a single missing control. Regulators increasingly expect banks to show they can identify coercion, device compromise, and anomalous behaviour during the transaction lifecycle, not after the loss is settled.
👉 Read our full editorial: APP fraud leaves recipient risk invisible in financial controls
